There has always been a symmetry to security: every technology that empowers defenders eventually empowers attackers. The interesting thing about AI is the speed of the symmetry. The same large language models that have made software development faster have also lowered the barrier to writing convincing phishing emails to roughly zero. The same voice-synthesis models that produce useful audiobooks have produced an industrial-scale voice-clone scam economy. The same prompt-driven tool surfaces that make agents useful have created an entirely new attack class — prompt injection — that the field is still working out how to defend against.
This post is the plain-language field guide to the six ways attackers currently weaponize AI in 2026. Each one gets the same treatment: what it is, real cases, defenses, the relevant MITRE ATT&CK mappings, and the practical checks you can run with your team. It is the natural companion to the Securing & Governing AI post, which covers the defender’s side of the same engineering problem — how to use AI safely while attackers use it against you.
What it covers
Six attack vectors plus a checklist, about fourteen minutes.
§ 1 — AI-enhanced phishing. Grammatically perfect, personalized to the target, generated at scale. The end of the “look for typos and bad grammar” advice. The real cases (the Hong Kong CFO deepfake-video scam, the senator-impersonation campaigns). Defenses: out-of-band verification, sender authentication, the technical+human layered defense.
§ 2 — Voice cloning & deepfake audio. The five-second voice-sample-to-clone economy. The grandparent scam at industrial scale. Real cases. Defenses: code words within families, callback-to-known-number protocols, vendor-side audio watermarking.
§ 3 — Deepfake video & image. The wedding-photo-scam, the executive-impersonation video call. Why detection is a losing arms race. Defenses: provenance signing (C2PA), the “verify through a different channel” discipline.
§ 4 — Prompt injection. The genuinely new attack class. An attacker plants instructions inside content the LLM will process (a document, a webpage, an email, a tool output) and the LLM follows them. Why no fully-solved defense exists yet. Defenses: untrusted-content sandboxing, capability scoping, output-validating verifiers.
§ 5 — Model-supply-chain attacks. Poisoning training data. Backdoored model weights downloaded from public repositories. Real cases (the malicious Hugging Face uploads, the PyPI-package equivalent for ML libraries). Defenses: model provenance, signed weights, the lockfile discipline.
§ 6 — AI-assisted malware & vulnerability research. Attackers using AI to find zero-days faster, write better malware, automate reconnaissance. The cost-curve shift. The arms-race dynamic with defender-side AI doing the same work.
§ 7 — The checklist. Twelve items to run with your security team. Out-of-band verification protocols. Code words. C2PA adoption. The minimum hygiene baseline for the 2026 threat landscape.
Read it
The field guide lives at its own URL with a warm-paper layout — fault-red for attacks, defend-teal for mitigations. Six sections plus a hands-on checklist.
← Back to Autonomy