Six ways attackers use AI today — explained in simple words, with real cases, defenses, ATT&CK mappings, and a checklist you can run with your team.
AI is not inventing brand-new attacks. It makes old attacks faster, cheaper, more believable, and easier for low-skill attackers.
That single idea explains everything below. Brute-forcing a login, sending a phishing email, writing ransomware, building an exploit — none of these are new. What is new is that an attacker can now hand much of the work to AI agents and large language models. The result is an AI-versus-AI arms race: attackers automate the offense, and defenders must automate verification, detection, and response to keep up. Each section below adds a documented real-world case, a defense ledger, the relevant MITRE ATT&CK techniques, a maturity ladder, and a first-response card.
In simple words: a robot that finds your login page and keeps guessing passwords — intelligently.
Guessing passwords (brute force) and trying leaked passwords on many sites (credential stuffing) used to require scripts, tuning, and some skill. Now an AI agent can look at a webpage the way a human does: find the username and password fields, understand how the form works, and run guessing campaigns on its own. Tools in this category (the talk references the BruteForceAI concept) use LLM reasoning to plan the attack instead of a human writing custom code for every site.
Credential stuffing at scale. Attacks like the 2022–2023 wave against major retailers and streaming services reused billions of leaked username/password pairs from earlier breaches. Automation — not clever hacking — was the whole game: bots tried known passwords against millions of accounts, and the ones reused across sites fell. AI agents make the same approach cheaper to run and harder to rate-limit.
T1110 Brute Force T1110.004 Credential Stuffing T1078 Valid AccountsThe cheapest big win is MFA on every external-facing system, especially admin portals and VPNs. If a password alone can get someone in, assume an agent will eventually guess or find that password.
In simple words: ransomware that thinks — choosing what to lock, how, and what to charge.
Classic ransomware was fixed code: encrypt files, drop a note. AI-assisted ransomware (the talk references the PromptLock proof-of-concept) can inspect your files, decide which ones are valuable, generate the encryption logic on the fly, and even write a personalized ransom note. Because AI can generate endless variations, the malware becomes polymorphic — slightly different every time, so signature-based antivirus has less to match against.
Colonial Pipeline (2021). A single compromised VPN password with no MFA let the DarkSide group in, forcing a shutdown of the largest U.S. fuel pipeline and a ~$4.4M ransom payment (partly later recovered). It shows how ransomware combines with attack #1 — and why backups plus identity hardening matter more than any single tool. AI lowers the bar to launch campaigns like this.
T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1027 Obfuscated/PolymorphicBackups only count if they're immutable and actually restorable. Run a restore drill: if you've never tested recovery, you don't have backups — you have hope.
In simple words: the badly written scam email is gone. Now it reads like your colleague wrote it.
For years, training said: look for spelling mistakes and awkward grammar. LLMs erase that signal completely. They write fluent, professional, polite emails in any language, in seconds. Worse, they can pull public information — LinkedIn profiles, company pages, press releases, social media — and personalize the message to you: your role, your projects, your boss's name. The old red flags are no longer reliable.
Measured impact. Security researchers and vendors have repeatedly shown that AI-generated phishing matches or beats human-written lures on click-through, while taking a fraction of the time to produce. The practical effect: campaigns that once needed a skilled English-speaking writer can now be spun up in any language, instantly, by anyone.
T1566 Phishing T1566.002 Spearphishing Link T1598 Phishing for InformationUpdate your mental checklist: don't ask “does this email look fake?” — ask “is this request normal, and did it arrive through the normal channel?” A perfect-looking email asking for something unusual is exactly the modern attack.
In simple words: a fake voice or video of someone you trust, asking you to do something costly.
Generative AI can clone a voice from a short audio sample and produce convincing fake video. Attackers use this to impersonate executives, vendors, or even family members. The attack is psychological: our instinct says “I heard them, I saw them, so it's real.” That instinct is now unsafe.
Arup, Hong Kong (2024). A finance employee joined a video call with what looked like the company CFO and several colleagues — all of them AI deepfakes — and was convinced to make transfers totaling roughly $25 million. It remains the clearest example of deepfake video defeating human trust at scale, and why money movement must never rely on voice or video alone.
T1656 Impersonation T1585 Establish Accounts + FBI BEC typologiesMake it policy, in writing: no financial action is ever taken based on voice or video alone. Urgency + secrecy + money is the deepfake signature. The defense is procedure, not technology.
In simple words: AI shrinks the time between “a bug is announced” and “the bug is attacked.”
When a vulnerability (a CVE) is published, it describes a weakness. Turning that description into a working attack used to take real expertise and time — days or weeks. Now attackers can feed the public advisory, affected code, and documentation into AI systems and get help producing attack logic much faster (the talk references research like CVE Genie on automating this). AI doesn't magically invent exploits, but it compresses the timeline — and your patch window shrinks with it.
MOVEit Transfer (2023). The Cl0p group exploited a single vulnerability in a widely used file-transfer tool to breach 2,000+ organizations and affect tens of millions of people — exploitation began almost as fast as the flaw became known. AI-accelerated exploit development pushes more vulnerabilities toward this “patch in days, not weeks” reality.
T1190 Exploit Public-Facing App T1203 Exploitation for Client Execution T1588.006 VulnerabilitiesKeep an inventory of what's exposed to the internet and track it against CISA's Known Exploited Vulnerabilities (KEV) catalog. A medium-scored bug that's actively exploited matters more than a critical-scored one that isn't.
In simple words: not one AI tool — an AI agent running the entire attack, end to end.
This is the most serious idea in the talk. Everything above uses AI for one step. The real shift is an agent orchestrating all the steps: scan for targets, pick a strategy, craft the phishing, generate the exploit, move through the network, analyze stolen data, decide what's valuable, write the extortion demand, and adapt when blocked — with minimal human input. Cybercrime starts to look like an automated business process, running at machine speed against human-speed defenders.
The direction of travel. Security vendors and AI labs have begun reporting incidents where attackers used AI agents to automate large portions of intrusion campaigns — reconnaissance, code generation, and triage of stolen data — with humans only setting goals and approving key steps. Fully autonomous end-to-end attacks remain emerging rather than routine, but the trajectory is clear and is exactly what this section warns about.
Recon Initial Access Lateral Movement Exfiltration ImpactIf attacks run at machine speed, a purely manual SOC is structurally too slow. Defensive agents are needed — but treat them like junior staff with sharp tools: evidence, permission gates, audit logs, rollback, and human approval for high-impact actions. Observe → reason → verify → act → audit.
| Attack | What AI adds | Main defense |
|---|---|---|
| Login attacks | Automated page discovery + credential attacks | MFA, rate limits, anomaly detection |
| Ransomware | Adaptive targeting, generated polymorphic code | Immutable backups, EDR, segmentation |
| Phishing | Perfect grammar, scraped personalization | Verification habits, email authentication |
| Deepfake fraud | Cloned voice/video of trusted people | Callback verification, dual approval |
| Exploit generation | Faster CVE-to-exploit pipeline | Rapid patching, KEV-driven prioritization |
| Full kill chain | Autonomous multi-stage planning + execution | AI-assisted SOC, zero trust, deep logging |
The same six attacks, expressed as the standard tactics and techniques used across the security industry. Use these IDs to connect this awareness material to your detection rules, threat models, and SOC playbooks.
| Attack | Primary technique(s) | ATT&CK ID |
|---|---|---|
| Login attacks | Brute Force · Credential Stuffing · Valid Accounts | T1110 · T1110.004 · T1078 |
| Ransomware | Data Encrypted for Impact · Inhibit Recovery · Obfuscation | T1486 · T1490 · T1027 |
| Phishing | Phishing · Spearphishing Link · Phishing for Info | T1566 · T1566.002 · T1598 |
| Deepfake fraud | Impersonation · Establish Accounts | T1656 · T1585 |
| Exploit generation | Exploit Public-Facing App · Client Execution · Acquire Vulns | T1190 · T1203 · T1588.006 |
| Full kill chain | Spans Recon → Impact across the matrix | TA0043 … TA0040 |
For AI-specific threats — attacks on AI systems rather than with them — see MITRE ATLAS, the companion knowledge base covering adversarial machine learning. The LLM-risk section below is a plain-words version of that landscape.
The talk focuses on offense, but the same capabilities power defense. The arms race only makes sense seen from both sides: every advantage AI gives attackers has a defensive mirror.
Move at machine speed — automate recon, exploitation, and triage faster than humans can react.
Scale and personalize — generate thousands of tailored lures and payloads cheaply.
Lower the skill bar — let low-skill actors run sophisticated campaigns.
Detect anomalies — flag unusual login, file, and network behavior that rules miss, and correlate weak signals across sources.
Accelerate the SOC — auto-triage alerts, summarize incidents, draft response steps, and cut mean-time-to-respond.
Hunt and simulate — AI-assisted threat hunting, log analysis, and continuous red-team simulation to find gaps first.
Defensive AI must not be blindly trusted either. Give agents evidence requirements, permission gates, audit logs, rollback, and human approval for high-impact actions. Industry data consistently shows organizations using security AI and automation contain breaches faster and at lower cost — but only when the automation is governed, not left to act unchecked.
The six attacks use AI against you. But if you build with LLMs and agents — copilots, RAG systems, internal assistants — those systems become targets too. These are the headline risks from the OWASP Top 10 for LLM Applications, in plain words.
Hidden instructions in a webpage, document, or email trick the model into ignoring its rules or running unintended actions.
The model leaks secrets, internal data, or other users' information it shouldn't have surfaced.
Tainted training or RAG data quietly biases or backdoors the system's behavior.
Trusting model output blindly — passing it to code, SQL, or shells — turns a reply into an exploit.
An agent with too many permissions can take damaging actions when manipulated. Scope tightly.
Poisoned or over-shared embeddings let attackers plant content or pull data across tenant boundaries.
If you deploy internal copilots or agents, treat untrusted input as hostile, validate every model output before acting on it, scope tool permissions to the minimum, and keep a human in the loop for anything irreversible. The same observe → reason → verify → act → audit loop applies to your own agents.
Walk through this with your team. Every unchecked box is a place an AI-accelerated attack has an easier path. These boxes are for working through on screen — they don't save.
Tap a question to reveal the answer. Six questions — one per attack.
AI gives attackers scale, speed, personalization, and adaptability. Defenders need verification, identity hardening, automation, and AI of their own.
This is not just “hackers using a chatbot.” It's a shift toward agentic cyber operations — AI systems that plan and execute multi-step attacks. The attacker is becoming an orchestrator of agents, not a writer of scripts. Defense has to adopt the same agentic structure, with strict boundaries:
OBSERVE → REASON → VERIFY → ACT → AUDIT
Primary source first; the rest are standard, freely available references for going deeper on each topic.