TLDR;

LLM and agentic AI capabilities certainly crossed a threshold this year, but the criminal reality is still governed by basic economics that seem less likely to shift. The unpredictable nature of frontier LLMs might actually incentivize cybercriminals to stick with orchestration rather than attempt autonomous exploitation.

The impact of AI across cybercrime basically looks like a modest multiplier on scale, speed, and cost-effectiveness rather than an exponential growth in attack volume, or dramatic new capabilities/superpowers. This is plausibly because the cybercrime sector was generally saturated and already commoditized prior to the arrival of LLMs, and the bottlenecks are primarily around hurdles like initial access and cash out, which LLMs don’t obviously help with. In other words, economic pressures limit cybercriminals, even when augmented by AI.

The sector was already trending towards hardened, larger, more valuable targets. These will be the ones best able to defend against AI-enhanced criminals, if they can take advantage of the gap between the frontier and open source models.

While you can make a compelling argument for hardening our defenses around critical infrastructure in order to contend with the new threats posed by AI agents, cybercrime itself doesn’t look like it’s on track for a major upheaval, and those looking to make an impact in the AI safety area should consider this when choosing a focus area. Their time might be better spent on alignment or governance work.

Reviewing the evidence on AI and cybercrime

After the announcement and temporary public release of Anthropic’s Mythos 5 model, more alarms rang over an incoming “script-kiddie apocalypse”; the ability for low-skilled malicious actors to use pre-written scripts to wreak havoc on the rest of the internet. The argument is that AI coding agents will let pretty much anyone create their own malware and distribute it, or use it to pull off relatively sophisticated botting operations.

How severe is this problem, really? How much potential for damage is there? In my own reading, there have been write-ups arguing for a coming spike in cybercrime or against it, but nothing I’ve found has yet synthesized the disparate evidence and argumentation into a cohesive picture. This post is my attempt to give a high-level overview, consolidating as much as I can into one literature review and analysis.

The commentary around AI and cybercrime predominantly skews towards one of two narratives.

The incoming cybercrime apocalypse framing is argued by both political appointees and security vendors. The former director of CISA, Jen Easterly argued that AI will enable less sophisticated cybercriminals, making them more dangerous. Palo Alto Unit 42 similarly argued that unrestricted AI models just represent the “democratization of cybercrime”. Skeptics like Marcus Hutchins argue that the industry is attracted to the idea of unstoppable AI tools but that in reality most criminals are using them for prosaic productivity gains, while Kevin Beaumont would straight up refer to some counts of AI cyberattacks as “AI washing”.

I’m sure both arguments have merits, but my own analysis starts by trying to determine the baseline of cybercrime pre-AI boom, draws a distinction between the methods of using AI in cybercrime, looks at the economic incentives, and then tries to answer some of the outstanding questions.

Floor vs Ceiling

As we proceed, I’d like to make sure we distinguish between propensity and efficacy. Just because something trends in a specific direction or gestures at specific behaviors doesn’t mean it can reliably affect the world.

Benchmarks and headlines tell the tale of capabilities ceilings under ideal conditions, like being given context about the task, safeguards minimized, and soft targets. Criminals using AI are more likely concerned with the floor; real-world messy conditions, comparing their options to alternatives, and with various downstream frictions. Floor and ceiling are often, unhelpfully conflated.

Making that distinction helps us see that most of the uplift comes where the old bottlenecks were time invested and base quality, like phishing emails and lure-writing. Where the process needs real expertise or runs into downstream frictions, there’s less uplift. I suspect this accounts for the divergence in capabilities and the reality of cybercrime.

I’ll try to flag this explicitly wherever I rely on it below.

Establishing the cybercrime baseline

Before you set out to ask “what will the effects of Y be on X?”, you should first determine that X is actually happening the way you think it is. It helps to establish a pre-AI baseline, so that whatever effects you look at are contextualized against it. This section answers:

• What was the pre-AI baseline?
• Is the observed AI-enabled cybercrime actually attributable to AI?
• What’s the binding constraint? (Is the writing of code the binding constraint?)
• What counts as a cyberattack?

The pre-AI baseline (the denominator)

According to the FBI IC3 2025 report, claimed cybercrime losses roughly quintupled, from about $4.2 billion in 2020 to $20.9 billion in 2025 . The largest jump by pure volume of losses was 2024 to 2025 (+$4.3 billion in losses), while by percentage it was 2020 to 2021 (+64% higher).

That essentially means that losses more than doubled -- going from $4.2 billion in 2020 to $10.3 billion in 2022 -- and all of this was before ChatGPT even launched in November of that year. The trend was already doubling pre-AI, so any AI-driven surge starts from a non-zero, fast-growing base. Losses grew at roughly comparable rates in the years after ChatGPT launched ($12.5B in 2023, $16.6B in 2024, $20.9B in 2025).

A trend that looks the same on both sides of its supposed cause is the opposite of evidence for that cause.

Now, it’s worth flagging that IC3 tracks only self-reported complaints. That means the loss metric isn’t a controlled measure. The rise could partly just reflect more reporting, and it’s also dominated by fraud (about 49% of IC3’s cyber-enabled-fraud losses, and about 41% of all reported IC3 losses, in 2025). Chainalysis found ransomware crypto payments hit a record approx. $1.25B in 2023. That’s the peak of a multi-year climb driven by big-game hunting (hospitals, corporations, city governments), ransomware-as-a-service (RaaS) professionalization, and crypto rails. All of these predate widespread LLM availability.

…And oh yes, the 2025 IC3 report ^[1] includes (for the first time) an AI crime section. It registers 22,364 complaints and an associated approximately $893 million in losses. So that’s about 4% of the $20.9 billion total in 2025.

The commercialization of cybercrime tools was nearly complete by the early 2020s, much of it predating ChatGPT. By 2022, phishing kits were sold through channels like Telegram with drag-and-drop interfaces, scam templates, and target lists; letting non-technical criminals run professional-looking scams. And they were cheap too. Phishing kits sold for around $25, ransomware was available from about $40/month up to a couple thousand dollars, many remote-access ads are listed under $1,000, you can find fraud guides for around $12 dollars, and get DDOS options for under a dollar. With many options under a hundred dollars, you could run up an equivalent bill on Claude Pro pretty easily.

The skill barrier and marginal cost for ransomware and phishing were already near zero before LLMs proliferated, worth saying that part out loud. Additionally, successful scams need convincing lures and functional payloads, both easily obtained pre-2022. What AI adds to those variables could just be an incremental efficiency gain rather than blowing a gate open for anyone motivated.

Still, AI does bring genuinely new complications to the offense–defense balance: it makes cross-language communication easy (quick translation, corrected grammar) so non-native speakers can produce flawless lures and reach wider audiences.

The attribution problem

The claim that some 80% of ransomware is “AI-powered“ is almost certainly premature.

It traces to a working paper from MIT Sloan’s cybersecurity group with the vendor Safe Security, based on 2024 data, later pulled from MIT’s site after cybersecurity experts questioned the methodology. Critics argued the paper defined “AI” so broadly as to be near-useless (the paper never explained its methodology for labeling a threat actor “AI-using,” called Emotet “AI-like”, and attributed GenAI use to ransomware groups that had already disbanded before generative AI existed) and labeled groups they knew weren’t using AI as AI-tool users.

So how much “AI-powered” cybercrime is actually, sufficiently, defined and applied correctly? Big question.

The core problem is that most incident telemetry can’t directly observe AI use (it has to be inferred) and there’s heavy conflation of similar phenomena. Acronis’s finding that “80% of RaaS operators now promote AI or automation features to affiliates” is a claim about market adoption, not proof that those tools are used in attacks. ^[2]

Likewise, SlashNext reported a phishing surge (a 1,265% increase in malicious phishing messages, 967% for credential phishing specifically) from Q4 2022 to Q3 2023 (its own telemetry plus a 300+ professional survey). The Slashnext CEO attributed the surge to ChatGPT because the timing “is not a coincidence…” But uhhh, it could be though…

Correlation isn’t causation, and here the confounders are serious: pre-existing exponential trend, crypto payment rails, the remote-work attack-surface expansion, and geopolitical drivers (Russian-based and state-sponsored activity).

I have low confidence this demonstrates AI caused the surge.

I mentioned that most evidence of “AI-powered cybercrime” is inferred through telemetry and adoption surveys, but there is one exception worth pulling out on its own, because it’s a controlled academic study. Indiana University Bloomington researchers catalogued 212 real “Mallas“ (malicious LLM-integrated services) for sale on underground marketplaces between April of 2023 and September 2024, and they catalogued 8 distinct backend LLMs powering these tools alongside 182 specific prompts used to jailbreak public LLM APIs. This gives us a much more tangible figure instead of an adoption-percentage figure.

The researchers also analyze the actual output quality, which lets us better tease apart the “force multiplier vs. novel capability” question. Two Mallas (DarkGPT and EscapeGPT) wrote code that successfully evaded detection by VirusTotal around 2/3rds of the time, while WolfGPT reliably generated phishing emails capable of getting past spam filters. Though I would still say the story is more like “competent output at commodity prices” and not superhuman hacking. These tools really just moved the cost and speed of access, which is what you’d expect if AI is mostly compressing an existing skill floor.

Assuming you can actually quantify how much damage/impact a particular LLM had, how much…

The operator behind WormGPT reportedly earned about $28,000 over two months, which isn’t nothing but nowhere near evidence of a transformed threat landscape. Subscriptions for these tools are generally in the $10–$200/month range, which means that they’re about as expensive as the previously discussed pre-AI phishing kits and RaaS toolkits. Again, we see AI tools entering a saturated, sophisticated market.

Finally, let’s remember there are incentives on both sides. Defensively, vendors push their own AI products (”fight fire with fire”), and AI companies make extravagant capability claims. On the criminal side, WormGPT and FraudGPT were marketed as bespoke criminal LLMs but were mostly scams or jailbroken wrappers around ChatGPT and Mistral; per reporting, WormGPT (GPT-J 6B–based) was probably the only genuinely custom criminal model, shut down in August 2023 after media attention.

The binding constraint (was code or lure quality ever the bottleneck?)

There’s an assumption that better code and better lures necessarily mean more, and more successful, cybercrime. It’s important to interrogate it, because it may not hold.

If the bottleneck isn’t code quality or speed but something downstream (initial access, monetization, cash-out, laundering, target hardening), then better coding doesn’t lead to much more harm. AI-powered tools might just deliver more of an input that was already abundant, right?

So the relevant question is: what fraction of attacks fail because the message wasn’t convincing enough, versus failing at a later step?

Initial access: Evidence suggests lure and code quality were never the primary bottleneck. Initial access (the first foothold in a victim’s network) has an entire specialized market of Initial Access Brokers, who eliminate the need for other criminals to find targets and break in, letting them focus on deploying worms and ransomware. The Israeli firm Kela reviewed roughly 1,000 access listings in a single year; a commercial bottleneck solved by specialization and not AI. And it’s cheap: corporate access generally runs $500–$3,000, with a 2024 median around $1,000.

Given how affordable and specialized initial access already is, that constrains how much AI can matter at this step. Even a competent autonomous break-in agent competes against a mature, dirt-cheap market, and without the unexpected failure modes AI agents bring. That pushes the bottleneck elsewhere.

Monetization / cash-out / laundering: Breaking in isn’t productive unless you can extract value, and that’s where much of the pipeline’s friction lives. Per Chainalysis, ransomware payments dropped more than a third in 2024, from the approx. $1.25B record in 2023 down to about $892M, driven by law-enforcement takedowns and victims refusing to pay.

That decline runs right through the period of fastest AI-tool proliferation. Numbers for 2025 are out now, Payments stayed low, expected to break around $900 million in 2025 when all counts are in, barely an increase over 2024 numbers. You would expect that if AI were dissolving the binding constraints, payments wouldn’t be falling or flat.

What counts as a cyberattack?

The biggest problem with trying to examine cybercrime trends is that there’s a large variety of different activities dubbed “AI cyberattack” or “AI-powered cybercrime”.

We might mean scammers using ChatGPT to translate their phishing emails into Portuguese or fix grammatical issues, but people could also mean using an LLM to draft sections of malware, summarize target reconnaissance or generate lure variants. The frontier, most technically sophisticated attacks include using autonomous agents to find vulnerabilities, write exploits for them and then chain them together to get access into a system. These activities require different capabilities and have different risk levels, but they’re all “AI cybercrime”.

There’s a real definitional conflict going on here.

And this conflict is how you can say things like “80% of ransomware is AI-powered” and have it be both technically defensible and misleading. Once more, the MIT/Safe Security paper arrived at that figure partly by having very loose definitions of what counts as AI. Claims about AI cybercrime should specify what on the continuum of AI usage they should count as “AI”, or else it’s arguably unfalsifiable…

Here’s another issue with the way AI-powered cybercrime is defined -- Almost all of the statistics around it track inputs and not outputs. Think “80% of RaaS operators promote AI features”, “malicious AI detected content”, “AI tools observed in X % of incidents”. This just describes the use of AI somewhere in the process, decoupled from outcomes. We care most about harm: the number of victims hurt, the systems breached, the number of dollars stolen. But it’s important to define the outputs because inputs and outputs can move independently.

As we just saw, even while adoption of AI by criminals is rising fast, ransomware payments fell in 2024 and then stayed flat in 2025 even while the actual attack volume hit record highs. Not only that, but the FBI’s count of actual losses attributable to AI puts them at about 4% of the total cybercrime losses in 2025…

My impression is that if AI use is surging -- while the harms attributable to AI sit in the low single digits + the revenue generated by ransomware is declining -- the input metrics aren’t correlated with output metrics in the way the alarmist framing assumes.

The issues I just discussed severely muddle the quality of the discourse and research around cybercrime, so for the rest of this post I will try to be explicit about the type of AI involvement we’re talking about, whether we’re measuring an input or output, and if the AI in question is doing something already cheap/abundant or something actually scarce.

That final distinction there -- if the AI is actually doing something relatively new and not already cheap/abundant -- is part of what helps us separate “AI helps hackers” from “AI is the hacker”.

“AI helps hackers” sees compelling uplift

I really set out to quantify just how much “AI helps hackers”, because that’s actually quite a broad claim… Unfortunately you can practically just call the evidence around this “AI helping phishers”, cause it’s basically just phishing that has a lot of high quality evidence surrounding it, far less so for other cybercrimes.

Typically, for phishing led intrusions, the pipeline goes like this: reconnaissance, social engineering (which includes phishing), payload, delivery. The further you move down this pipeline the harder high quality studies and research is to find. Where we can find decent evidence, the evidence generally points to AI models being a force multiplier and not creating novel capabilities and attack vectors.

Reconnaissance and target selection is the first part of the cybercrime pipeline. In my view, it’s understudied. LLMs can absolutely summarize open source intelligence, find patterns in breach data, translate and triage documents and assist in identifying high-value assets once a system has been compromised. These are plausible gains, but I couldn’t find any research on these tasks at the level of a controlled click-through trial.

Social engineering is the best-evidenced part of the pipeline, and it’s the one that arguably matters the most for actually harm in terms of monetary damages. **(It’s absolutely critical for many fraud and intrusion pathways, though its share of aggregate monetary harm varies by crime type and dataset)

This splits three ways: Phishing, voice scams, relationship/investing scams

Phishing is the best studied environment. The best piece of research I found on this topic was a controlled study done by Harvard’s Fred Heiding, who ran 101 participants through a series of tests around phishing emails. The fully-automated, AI-written phishing emails had a 54% click-through-rate (CTR), which is the exact same as the human expert level, and at parity with the human-in-the-loop setup, which was 56% CTR. The control condition had a 12% CTR. The AI generated each email for the equivalent of about four cents.

Other research done by IBM’s X-Force found that its own test subjects engaged with human written lures slightly more than AI written ones, with 14% CTR to 11% CTR respectively. The main uplift was that the AI emails were written in about 5 minutes and the human team took about 16 hours to write their emails.

I think you can fairly argue that AI reaches human-expert lure quality at a fraction of the cost/time investment. The uplift is real here (parity plus cheapness) and it’s notably not superhuman performance. This also tracks with where we established the bottleneck wasn’t. Lure quality is already pretty cheap, and AI making it somewhat cheaper doesn’t necessarily mean we’ll see a flood of successful scams going forward. Though it likely does nullify the legacy detection tools that relied on things like generic greetings and grammatical mistakes to catch scams, and it enables scamming in a variety of different languages.

Two things to keep in mind:

1. The finding that AI generated phishing emails are at parity results on just one controlled study.
2. Pretty much everything that unfolded across just added to the scale of the findings detailed above, not enhanced persuasion. Cofense has described a malicious email making it past gateways every 19 seconds, but this metric, alongside the number of phishing as a service kits and the “conversational AI lure” prevalence counts, those just measure how much AI phishing there is, not how convincing each message is. They don’t establish per-message persuasion for instance, or reliably quantify AI authorship.

Phishing itself might be losing importance. Microsoft reports that recently the “ClickFix” social-engineering technique overtook phishing as the top initial-access vector, and IBM’s incident-response data shows phishing displaced by valid-credential abuse in 2024 and by public-facing-application exploitation in 2025. Better lures are uplift on one step, one step whose importance is contested.

Voice scams (vishing) actually does have a decent body of evidence that just came out, and it’s likely the strongest case for AI genuinely removing a barrier that didn’t exist before. Familiar voices are shortcuts to gaining trust in a way that text just has never been online, as the nature of text only mediums makes impersonation easy.

The role exploitation of trust plays is real, but another study by Heidging et al found that people’s ability to detect a scam is quite variable. Even the best models using a “relative-in-distress” scheme only succeeded in getting people to say they “would or might comply” 36% of the time. The range of successful “detections” of AI voices started at 66% for Sesame and ranged up to 93.7%. Detection did vary a lot by model: the best AI voice (Sesame) was correctly flagged only 66.3% of the time (still above chance), and neither general AI familiarity nor voice-assistant usage improved detection at all.

…My takeaway is that voice scam detection is poor and doesn’t improve with familiarity. Emotionally charged situations also seem to short circuit people’s ability to discriminate. People often seem suspicious, but can’t reliably discriminate.

In terms of technical feasibility, it’s clear that it’s do-able. Earlier work on this topic had shown end-to-end automated vishing in controlled settings, and by the end of 2025 several assessments put voice cloning past the “indistinguishable” threshold, just from a few seconds of audio.

But while the trust mechanism and the technical feasibility are both real, the harm figures lack the same rigor. Vendor decks disagree wildly on the scale of the problem, with numbers between “442%,” “1,633%,” and “3,892%“ all being reported across different vendor decks for what is ostensibly the same problem. Meanwhile the big headline making losses (the roughly $25.6M Arup deepfake-call case) are just single anecdotes.

Relationship and investment scams (”pig-butchering”) are where most of the genuine harm comes from, where cybercriminals obtain the largest payouts. Cryptocurrency-related fraud drove over $11 billion of 2025 IC3 losses, which makes everything else in this post look small in comparison.

The contribution of AI here is mainly the language fluency we discussed above, as scammers can now produce culturally-fluent messages in languages they don’t speak). Although there are a few genuinely new developments including deepfake grooming, and the creation of entirely new AI-generated fake “brokerage” platforms complete with dashboards and market data and AI relationship-managers. This all collapses the price per victim and it’s a real efficiency shift. But this all comes from law-enforcement seizures and threat-intel, not controlled studies and even here the binding constraint isn’t lure quality. The bottleneck is the trafficked human labor in the compounds and the crypto cash-out, neither of which AI relieves.

In terms of Payload and malware, the evidence is much weaker and the findings less impressive. Feasibility studies pretty consistently find that LLMs struggle to produce functional novel malware from broad prompts. They succeed when the task is decomposed, but are most useful at modifying existing malware into polymorphic variants, and even so the output is often still detectable by normal security tools. At least one bit of research finds that malware detection rates are in the 50–75% range even after LLM-driven modification, that’s pretty comparable with traditional malware detection rates.

Part of the problem with the research in this area is that it’s mainly based on capability probes. These aren’t controlled human-subject baselines and a paper proposing a risk-assessment framework warns against assuming that these evaluations capture real-world risk. The capability probes imply some minor uplift and assistance, but AI tools generally aren’t producing novel malware packages.

A reasonable objection might be “the absence of evidence just reflects a measurement gap and not an effect gap”. The effectiveness of malware could just genuinely be harder to measure, because outcomes are harder to track. There’s no easy, simple equivalents to click-through-rates, and studying outcomes requires actual malware samples and testing for detection-evasion.

For what it’s worth, independent researchers at Lyptus Research used METR’s time-horizon methodology and they applied it to offensive-cybersecurity related tasks. They compared the cybersec specific results against METR’s results for the same AI models. According to Lyptus’ findings, task horizons for cybersec tasks are about 4 times shorter than the software engineering task for the models like Claude Opus 4.6 and similar. So for instance Claude Opus 4.6 can maintain aptitude on a general software engineering task for 12 hours but only 3.2 for cyber offense related tasks.

According to Lyptus that’s “plausibly explained by AI labs investing heavily in reinforcement learning for software engineering tasks, which directly serves their commercial interests, while treating offensive cybersecurity primarily as a risk metric.” It could also be that cybersecurity tasks often require long, low-signal,and exploratory reasoning steps, whereas SWE tasks are straightforward, with clear signals about quality and verifiable outcomes.

A study done by LORIA/CNRS examined a corpus of threads from cybercrime forums from 2020 to 2025, looking at around 1 million posts. They specifically examined cypter-as-a-service (CaaS), which is done to help malware evade antivirus (AV) systems. The research team found that these tools are continuously maintained services, and often need daily renewal to sustain AV evasion capabilities. So they aren’t a one-time purchase and what’s more at least a quarter of the forum threads were still looking for the right crypters, their demands unmet.

This is instructive, as it’s kind of a revealed-preference test. If LLMs were genuinely solving the AV problem and making evasion quick and easy, you’d expect that the CaaS market to be shrinking. But as recently as mid-2025, the market was still going strong.

I’d take this as fairly compelling evidence that there’s a genuine gap between SWE performance and cybercrime malware performance for LLMs… Though how long this gap will exist is an open question.

AISI’s project doubling time for cyber capabilities, shrank from 8 months to 4.7 months by February of 2026, and Mythos represented an unexpected jump in capabilities. Though AISI does caution not to use single benchmarks as as precise capability measures (and their evals don’t yet include active defenses in the calculation), I’d say the gap is likely compressing, though how fast and how durably isn’t clear.

Finally, regarding delivery and scaling, there does seem to be some real uplift in terms of attack orchestration. Agentic tools can help automate the execution of attacks using known techniques at scale. We can see the FortiGate/DeepSeek event as the clearest instance of this; the AI didn’t create new exploits, it just ran old proven ones across 600 targets (though it was also used for reconnaissance attack planning). An improvement of the scale of attack, if not the means.

I think it’s worth stepping back and looking at the larger pattern. Where we see high quality evidence we generally see a force multiplier for cybercriminals, and very few incidents of new exploits or novel attack strategies. The Phishing RCTs and vishing controlled work show this. The feasibility studies for malware and the telemetry and anecdotes for recon + scaling show much less.

I’d say the one genuinely new capability is the collapse of the language barrier, and maybe the shrinkage of the cost per victim, though both of these are part of social engineering and as far as I can tell haven’t actually increased the amount of harm being done. At least not yet… though you wouldn’t know that if you only looked at the surge stats.

Everything covered thus far is about AI making cheap work quicker and easier, but let’s be clear -- AI may just end up doing the scare work instead.

“AI is the hacker” is the moving frontier

The story about AI helping hackers is a claim that AI will be doing the abundant, cheap work in a given cyberattack. Meanwhile, the story where AI becomes the hacker is, ultimately, a claim that AI will take over doing the scarce, high value work involved in an attack.

This high value work is roughly: reading an unfamiliar system, finding a potential vulnerability in it, writing an exploit for that vulnerability, and then chaining the exploit into genuine access, eliminating the human except for the occasional need to hit “Enter”.

I’ll be honest about my priors and say I didn’t think this would arrive for a couple of years yet, but I think recent events circa mid-2026 have proven me wrong.

You all know where this is going. In July 2026, during OpenAI’s eval of a GPT-5.6 Sol and an unreleased model, with safeguards deliberately lowered, its models discovered and exploited a novel zero-day to escape the established sandbox. The model then reasoned about who might have the answers to the test it was working on and self-selected Hugging Face as a target. It chained their way onto its production servers and after a bit of time, Hugging Face independently detected and contained it.

The incident reportedly started due to reward hacking caused by certain tasks being unsolvable in the ExploitGym benchmark question set, with the end result being that approximately 700 agents joined together in a weeks long effort to find information that would help them cheat the grading system itself. Hundreds of agents discovered a shared/leaky namespace that let them communicate covertly. This was exploitation of a specific bug, contingent on the architecture itself. There were attempts to tamper with logs and successful deception of overseers over the course of the event.

This is relevant insofar as it proves the possibility and capability of fully autonomous hacking, even if it wasn’t an incident of cybercrime as we traditionally think of it.

This satisfied a lot of the usual objections people would bring up against such events. It’s a novel, zero-day exploit. No description was provided and the target wasn’t selected in advance. There were no human operators responsible for correcting mistakes. And it was independently corroborated by the victim (HuggingFace) rather than coming from a single vendor.

In hindsight, the pieces for the eventual Hugging Face hack by OpenAI were all in place as of 2024. Kang et al showed that LLM agents could successfully exploit one-day vulnerabilities with an approximately 87% success rate… If they were handed the CVE description. It appeared that if you held the description back and forced the model to actually find the bug the success rate dropped substantially, but pretty soon that barrier was overcome. Big Sleep was able to find a genuine, previously unknown flaw in SQLite SQLite flaw. More recently, the UK’s AI Security Institute corroborated the capabilities of frontier model from the other direction, frontier and preview models have solved its 32-step enterprise-attack range end to end.

It can be quite challenging to distinguish genuine advances in this area from over-excitable claims and poor reporting. Not everything claimed about model capabilities is correct.

Anthropic’s own disclosure of the GTG-1002 incident is contested. Anthropic referred to it as first ever primarily autonomous AI-orchesterated cyber-espionage campaign, claiming A group affiliated with the Chinese state got Claude Code to do 90% of the work across approximately 30 targets with humans only intervening a handful of times.

Independent security researchers noted that there was an absence of published indicators of compromise and argued the 80–90% autonomy figure was likely overstated, arguing that the tooling involved was already catchable by existing detections. The success rate was pretty low, with only a “handful” of intrusions succeeded before detection. And indeed, Anthropic’s own report notes the quality of the work left a lot to be desired, saying Claude “frequently overstated findings and occasionally fabricated data during autonomous operations,” which is “an obstacle to fully autonomous cyberattacks.”

A more damning incident of unwarranted claims around cybercrime came from ESET’s PromptLock event. At the end of August, ESET announced discovery of “PromptLock,” calling it “the first known AI-powered ransomware”, and ensuing news coverage treated this as a real-world threat discovery. But then about a week later, ESET updated its own post…

It turns out that the suspected ransomware samples perfectly matched a research prototype from an NYU Tandon academic paper, this one: “Ransomware 3.0: Self-Composing and LLM-Orchestrated“. So what ESET found and mistook for ransomware was academic PoC misidentified as a live threat but never deployed in the wild. One of the NYU researchers said this shows these systems are “sophisticated enough to deceive security experts into thinking they’re real malware from attack groups”.

Combine this with the kind of dodgy statistics reporting we found above regarding that MIT Sloan 80% figure and you can see why you should be a bit skeptical about these sorts of claims. Particularly we should be skeptical about any “N× more effective” or “N% of breaches are AI” numbers, until we can trace them to a measurement instead of an estimate. ^[3]

Still as Horizon3 says, this might be arguing about the wrong variable, what’s relevant here is that there’s an apparent direction of travel. We’re moving towards lowering the barrier for nation-state-grade operations, regardless of the validity of any individual incident, the trend seems clear.

So this incident certainly demonstrates that the technical capability (from zero-day to RCE to lateral movement) chain for autonomous exploitation exists. But is it evidence that “autonomous exploitation of hardened targets by thread actors” is on the way?

When we hear something like “fully autonomous AI running end-to-end criminal campaigns at scale”, we should split this claim three ways.

As a capability, the Hugging Face incident makes a pretty compelling argument that it’s here now, real and present.

As criminal activity at scale, it’s maybe, partly real… but as automated n-day orchestration against soft targets (FortiGate). You shouldn’t be thinking “reliable novel-zero-day discovery”.

As robust autonomous compromise of hardened, defended targets, we still have yet to see this. Let’s not collapse these three different dimensions into one. ^[4]

But it’s worth saying outloud: “The capability half of the “AI is the hacker” scenario is here, solved.”

…But these models aren’t in the hands of criminals, right? As far as weaponization of frontier models by criminals, for now frontier models remain under guard by AI labs. But in general, open-weight models are trailing frontier models by about four months and can run a full attack simulation for roughly $1.19, and you may not even need to strip out the guardrails as assumed!

We know people have already used open weight models to orchestrate attacks. According to Amazon Threat Intelligence, a relatively unsophisticated actor used non-frontier models and agentic orchestration to compromise more than 600 firewalls across 55 countries over five weeks.

What’s unclear is how “hard” or “soft” a target has to be for these agents to be successful. Some argue that HuggingFace wasn’t a hard target… Most evaluations show that autonomous hackers are successful against weak-posture systems and less successful against hard posture systems.

In August, CISA warned that hackers were making us of AI genrated code to target critical infrastucture, via the targeting of internet-exposed Siemens PLCs (programmable logic controllers). Targets were hit across 12 different states. It’s suspected that Iran was behind the attack, though CISA didn’t state this directly. It’s my understanding that these systems are generally soft targets, often relatively undefended.

Independent benchmarks show that these agents are still pretty unreliable end-to-end, with many attempts needed to be successful. There’s a ton variance run to run, along with long-horizon failures,and warning signals under defensive pressure. Research done by Fudan University found that GPT-5.5 solved only about 16% of web exploitation tasks and 32% of post-exploitation tasks under their baseline, least information, test condition. Though if the target is a critical one, you may not need to be successful more than once to do some real damage.

At this point I’m comfortable saying the binding constraint is likely NOT model access, especially given that open weight models are only months behind the frontier, and that the true constraint is likely target-hardening.

Still, let’s keep in mind how the actual criminal case discussed above manifested. It wasn’t a truly novel discovery, a zero-day exploit. Instead it was just automated orchestration of already known vulnerabilities, executed at scale. This informs why we aren’t yet seeing major criminal uplift.

So if the capabilities required for autonomous cybercrime already exist, why aren’t we in a cybercrime apocalypse yet?

Capability isn’t criminal practice - The n-day economy

There’s likely something placing pressure on the sector, constraining the ability or desire for criminals to take full advantage of AI agents in their schemes.

My guess is that there’s an economic calculus happening, and it’s what makes the “scale, not superpower” framing still valid as of now.

As we’ve covered, cybercriminals rarely seem to bother hunting down zero-day exploits. There’s probably two reason:

1) Finding zero-day exploits is time and resource intensive, generally only done by states, enterprises, specialist researchers, and a limited set of sophisticated criminal actors.

2) It’s cheaper and more economical to use known exploits, which are typically sufficient and get the job done.

The OpenAI/HuggingFace incident implies that finding zero-days is going to get easier, but it doesn’t necessarily mean that using known exploits becomes less economical. Trackers of Common Vulnerabilities and Exposures (CVEs) found that of the nearly 48,000 CVEs reported in 2025, just about 1% of those disclosed in 2025 are actually exploited in the wild.

Separately, Google’s Threat Intelligence Group tracked 90 zero-day vulnerabilities exploited in the wild that year in 2025, down from 2023’s peak of 100 and only modestly above 2024’s 78, suggesting the overall zero-day count is stabilizing rather than exploding. There were apparently only nine zero-day flaw exploits attributed to financially-motivated actors, up from five the previous year. That’s at best a weak signal off of a tiny baseline. A noisy indicator that should be monitored but not freaked out over.

It could be that the first-order effect of AI agents in cybercrime is to reinforce the existing n-day (known exploit) paradigm instead of pushing people towards zero-day exploits. If that happens it’s likely because most of the ROI gained by using these models will come from compressing the time from vulnerability disclosure/patch release to exploit analysis, scanning, and operational deployment. The FortiGate event shows that pattern in the real world, the criminals used AI models to help them orchestrate existing n-day exploits.

I think it’s possible that n-day domination increases, not decreases, with the caveat that hardened, high-value targets that prove resilient to n-day exploits might prove to be tempting targets for novel, zero-day discover with agentic AI.

For high value targets that resist known techniques, the expected cost may justify higher zero-day costs… And these are already the sorts of enterprise environments where discovery costs are low and criminals are migrating towards.

Defenses and the offense–defense balance

Let’s take a step aback and zoom out from harm totals for a moment. There’s a bigger question: Does AI structurally favors attack or defense? The answer matters even more once the economics begin to shift.

Received wisdom in cybersecurity is that cyberspace generally favors attackers not defenders.

Although, this isn’t uncontested. Rebecca Slayton argued that it actually doesn’t make sense to speak of either side having advantageous and that the balance should be assessed with respect to specific organizational skills and technologies, as well as goals. For instance, just because Stuxnet was “successful”, it may have actually cost the attacker quite a bit more than the defender.

Andrew Lohn released a 71-page report that assessed 9 different offensive and 9 different defensive structure arguments from across the literature of cyberdefense strategy. He tried to assess the impact of AI on each argument individually, and ultimately concluded “the cyber domain is too multifaceted for a single answer to whether AI will enhance offense or defense broadly. AI will improve some aspects, hinder others, and leave some aspects unchanged.”

The best formal publication on this topic I could find was Garfinkel & Dafoe (2019). They argue that the situation is best assessed on a curve. When overall investment in a threat area is low, incremental investments will tend to benefit the attacker more than the defender. In contrast, when investment is high, more investment tends to benefit the defender. The logic they use to claim this is that defenders need to defend all vulnerabilities while an attacker needs to find just one…

But the number of vulnerabilities in a system is finite, so a high defense investment can potentially find all exploits. In other words, the question we want to explore is: “at what investment level is this organization operating, and does AI shift that curve?”

A 2025 paper by Murphy and Stone critiques the idea that finite vulnerabilities are actually the relevant variable that shifts the offense-defense balance. It accepts that exploits are finite, but argues that because the defender must work to find all vulnerabilities under conditions that prevent them from ever approaching actual discovery of all, or even most exploits. So “finite” doesn’t mean “findable”, unless perhaps, you can set up a number AI agents to hunt these bugs for you…

The theory that you can find all potential exploits in software relies on a few assumptions: bounded memory, bounded input length, not dependent on unbounded external interactions. If this is true, then you can theoretically just try different combinations, searching through a space of combinations exhaustively until all potential exploits of a class of exploits are found. It’s theoretically achievable. ^[5]

On the other hand it isn’t exactly true that all an attacker needs to do is find one vulnerability. You typically need to find multiple vulnerabilities and chain them together. Modern defense-in-depth architectures are built assuming that vulnerabilities will exist, designed to make it harder to get actual payloads with a single vulnerability.^[6]

But I think there are two things worth noting here:

1. Regarding the finite vulnerabilities argument above, speed of deployment and patching seems like the relevant consideration. If AI-driven defenses are used to find and fix vulnerabilities at scale before deployment, then it’s possible that even expert level AI attackers will fail to get access. On the other hand if AI tools enable attackers to leverage previously undiscovered vulnerabilities quicker than they can be patched, then the attacker benefits more.
2. There’s actually a difference between writing patches and deploying them. Even while AI could be used to accelerate currently slow tasks like searching for vulnerabilities and writing patches, it doesn’t necessarily touch the deployment of patches which is often the bottleneck.

Okay, but this all pretty theoretical, what behavior are we actually seeing in reality? What evidence? Investigation into this trade-off is ongoing. Some notable findings:

DARPA’s AIXCC was a two year long competition, offering 8.5 million dollars in prizes, explicitly created to test if an AI system could autonomously find and patch vulnerabilities in critical-infrastructure open-source code. While the competition used synthetic/curated targets, it’s probably the closest thing to a massive controlled experiment we’ll find…

In the final round, the best systems apparently found 86% of vulnerabilities and patched 68% of those. The finalists found 54 synthetic vulnerabilities and successfully patched 43 of them (depending on how you count them). Across all teams, 18 previously unknown, real-world flaws were discovered. The AIs genuinely performed way better than most humans, but it stops well short of 100% even under ideal purpose-built conditions.

As previously mentioned, Google’s Big Sleep program used LLMs to find real zero-day vulnerabilities in SQLite and patch it before release, which is at least one example of AI-driven cyberdefense strategies outperforming human equivalents.

Looking good for team Defense so far…

But of course, there has been research that finds notable incidents of attacker uplift. According to Murphy and Stone, a researcher was able to use Claude Winner 3.5 with only a CVE description and a commit history to take advantage of numerous high-severity CVEs in just hours. That’s notable because it implies only hours might elapse between a patch and an attack, so it looks like AI compressing the time between disclosure and exploits that typically protects organizations slow to patch. If I’m honest, this hits a different part of the cybercrime pipeline than lure/code quality, so it could undermine the thesis that the bottlenecks are downstream of exploit or lure writing.

That same paper also distinguishes between leading-edge and trailing-edge organizations. The authors argue that most discussion of the offense-defense balance assumes defenders invest in proportion to the threats they face, and maybe this is true for certain knowledgeable enterprises like Google, but it’s generally false for most orgs.

According to the authors, “the discussion of whether AI’s advancement will privilege attackers or defenders is largely immaterial”, and that most orgs have relied on three historical bottlenecks to protect them: human bandwidth to launch attacks, scarcity of skilled attackers, and deterrence from law enforcement. These are all eroding while the defensive benefits of AI accrue are seen mainly by the orgs able to invest in its integration.

They note that WannaCry just exploited a hole Microsoft had patched roughly two months before the attack; so it succeeded because of patch-deployment delay, a human-organizational failure. They also discuss the Equifax hack, which is the same pattern…

There’s one asymmetry that really favors defenders. Defenders scaling up their AI search techniques have a structural edge over attackers doing the same. This is because defenders get white-box access, full access and knowledge, while attackers are usually working black-box. The AIxCC’s results imply this asymmetry can be exploited at scale.

I’ll take this as some evidence for the “have thousands of AI agents bug-bash your own codebase” approach. It doesn’t get you zero remaining vulnerabilities, but it’s certainly good.

If this is correct and repeatable, it could be that defenders actually have a structural advantage if they act. Defenders typically deploy institutionally slower, and cede the window while the capability is diffusing, but this doesn’t have to be the case. It seems possible that leading-edge orgs could genuinely have an advantage over their attackers… If they actually exploit the window of opportunity.

Outstanding questions (and my best attempts to answer them)

As far as I see it, there’s a handful of questions that will prove extremely impactful on the future of AI and cybercrime. Here, I do my best to lay them out and answer them.

1. How fast do hardened targets become reliably exploited autonomously?
2. Does better lure quality and cheaper access proportionally become more harm/loss?
3. What catches up with the frontier faster: criminal capability transfer versus defensive deployment speed?
4. Does democratization actually create more total harm, or just redistribute it?

The surviving frontier: How fast do hardened targets become reliably exploited autonomously?

Pretty much everything “soft” is already reachable by sophisticated cyber criminals. The amount of time that it will take for autonomous AI agents to reliably compromise hard targets is an open question, but an important one. As mentioned, criminals are pursuing larger, harder targets more often due to how much more valuable payouts can be, so if hard targets are quickly compromised we could see a genuine catastrophe emerge.

AISI’s dataset is longitudinal and methodologically consistent, and it tracks the frontier of AI models. According to AISI the length of time an AI can reliably operate (achieve 80% reliability) doubles approximately every 4.7 months, and the emergence of Claude Mythos Preview and GPT5.5 outperformed even by this trend. Meanwhile, in terms of software-engineering capability it doubles roughly every 4.2 months according to METR’s projects. In April of 2026, Mythos Preview also became the first model to complete AISI’s “The Last Ones” end-to-end cyber range (a complex simulated corporate-network attack chain).

While impressive, these are both evaluations against benchmarks. Cyber ranges are simulated networks that are different from real-world environments in several ways. AISI says once frontier models saturate current ranges, their next evaluations will add in active monitoring, EDR, and real-time incident responses. I take this as meaning today’s numbers overstate near-term real-world reliability against a genuinely defended target, as the evaluation hasn’t yet modeled a defender.

The previously mentioned GTG-1002 incident is probably one of the only real world, non-benchmark data point for us to look at. Anthropic estimated 80–90% of tactical work was executed by the AI, with only 4–6 human decision points per attack session. They also noted only “a small number” of the approx. 30 targets were actually compromised, and Claude “frequently overstated findings and occasionally fabricated data”, which is “an obstacle to fully autonomous cyberattacks.” At least for these reasons, we likely aren’t yet at the point where autonomous exploitation of hardened targets has arrived, it’s still unreliable.

An independent analysis makes a point worth incorporating regardless of where you land on the “was this overhyped” debate, the kill chain itself wasn’t novel. The same reconnaissance techniques, the same credential harvesting, the same lateral movement, and minimal reliance on proprietary tools or advanced exploit development occurred. There were also no zero-days, no sophisticated exploits. This looks like more evidence for AI being a force multiplier on existing capabilities, not evidence of novel capability against hardened defenses, as of yet…

…And anyway, more relevant to the “hardened” portion of the question is the Mythos/Project Glasswing.

Claude Mythos Preview was allegedly capable of autonomous zero-day discovery/exploitation across “every major operating system and web browser,” including a since-patched 27-year-old bug in OpenBSD, and a flaw in code “tested five million times without detection.”

AISI’s independent evaluation of Mythos Preview was more measured, saying it could exploit systems with weak security posture” when explicitly directed and given network access, meaning that the capability was demonstrated against undefended systems in a controlled setting, and not while combating active defenses. …That initially seems reassuring, but unfortunately, it seems like most orgs don’t patch that often, so defenses aren’t what we’d hope.

A TXOne Networks survey (n=150) found just 15% of OT organizations patch monthly or more often; citing limited personnel/expertise and downtime concerns as top barriers. This is real but pre-dates (and is independent of) AI capability growth. **Vendor survey, not actually a population estimate.

That’s evidence about defender readiness, not about AI offense specifically, and while we shouldn’t conflate it with “AI-caused” vulnerability, there are likely few targets that are as “hard” as we like them to be.

The monetization ceiling: Does better lure quality and cheaper access proportionally become harm/loss?

Earlier we mentioned that one of the binding constraints was the ability to actually cash out any ill-gotten gains. So does better lure quality and cheaper access mean proportional losses, or is cash-out still sort of a bottleneck?

This is understudied, but the data on this from 2024-2025 ransomware payment data suggests that there’s still a monetization ceiling. The Chainalysis 2026 Crypto Crime Report covers events in 2025, and it finds that in terms of on-chain ransomware payments losses actually declined from 2024 to 2025. 2025 saw approx $820 million in losses, which is down roughly 8% from the $892 million of losses in 2024.

That’s actually the second consecutive year of decline, coming down from a 2023 peak of $1.25 billion. That’s despite the number of victim counts and leaks increasing overall (attacks were up a claimed ~50% YoY to a record 7,874). One thing that might explain the decline is just more refusal to pay, only 20% of ransom attempt victims paid, which is an all time low, according to Coveware’s most recent quarter analysis.

If we dig deeper, we can split out the decline in 2024 into a few different events. Two major cybercrime groups were disrupted in 2024. Payments to the group LockBit apparently dropped roughly 80% in 2024, a result of Operation Cronos, a joint initiative by the UK NCA and the FBI.

The other event was that a major cybercrime group ALPHV essentially exited the market after a contentious attack, and possible exit scam, against a healthcare company, taking a substantial portion of the ransomware market service with them.

Notably, the market didn’t recover as expected. No similar sized successors arose to take their place, rather the market fragmented into many smaller, less capable newcomers, at least according to Coveware. Law enforcement crackdowns on mixing services (tools that blend illicit cryptocurrency with other funds), also reportedly drove the decline.

I flag all of this because at least some of the decline is probably due to better law enforcement, not a general economic ceiling from AI tool adoption. Were it due to the tooling itself, you’d expect a smoother, distributed decline and not a sudden decline towards specific groups and sectors.

Still, the decline happens even though cybercrime commodities are getting cheaper. ZeroFox claims that the average price for victim access dropped to below $500 in Q1 of 2026, down from $1427 in Q1 of 2023. The vendor attributes this to “industrialized access pipelines, AI-assisted tooling, and a proliferation of infostealer logs” creating oversupply.

That’s notable, because when you put it all together it seems like even though input costs are falling and attack volume is rising… Realized cybercrime losses are still down. Moreover, the probability of a given attack successfully converting to cash is at a record low.

All that said, apparently the size of payments conditional on actual payment is rising. According to the same Chainanalysis report described above, median on-chain payment jumped from $12,738 (2024) to $59,556 (2025), and according to Coverware, average payment among those who did pay is now $591,988, which was up 57% quarter-over-quarter for Q4 2025. You can argue that the market looks like it’s bifurcating into two distinct areas: An increasing number of low-yield/opportunistic attacks that fail to monetize at all, and a shrinking pool of high-leverage attacks against more valuable targets that extract more per success.

Take all of the this together -- The bifurcation (falling payment rates/and conditional payments rising), the falling price per-victim for initial access alongside decreasing losses, and probable market saturation with decreasing marginal returns -- And I do still take this as some evidence that there’s an actual monetization ceiling, regardless of lower input costs and AI-assisted attacks.

The diffusion race: What catches up with the frontier faster — criminal capability transfer or defensive deployment speed?

What catches up with the frontier faster: criminal capability transfer versus defensive deployment speed?

So the offense side of the equation is fairly well measured in terms of capabilities.

AISI’s open-vs-closed tracking finds that open-weight models like GLM-5.2 and DeepSeek V4-Pro (open-weight releases for mid-2026) perform comparably to closed frontier models released 4–7 months earlier, with variation by model and task type. That’s slightly narrower than the 6–10 month gap AISI measured through most of 2025. AISI themselves frame this gap explicitly in security terms, the gap represents the “preparation time” that defenders with access to the best closed systems can use to prepare before models with the equivalent capabilities and without the same safeguards are released. Meanwhile, the recently released Kimi is about 6 months behind the frontier. **Ryan Greenblatt estimates more like 8 months. That window is measured and is potentially shrinking.

The defensive side of the equation, is by comparison, unknown. I couldn’t find real non-vendor sources quantifying defensive AI deployment speeds that you could actually compare against AISI’s offense-side standards. There’s some vendor marketing that tracks adoption, but no formal stats I could find on deployment speed.

That lack of coverage is probably structural in nature. Offense-side diffusion is measurable because it can be benchmarked against something observable (a model whose weights are released on a known date), but for “operationalizing AI in a defensive context”, that’s a distributed process. There is no central registry of deployment dates, no benchmark that captures “operational use”. Indeed, there are actually strong incentives against disclosure.

The best we can do is look at capabilities in contexts where we know frontier AI systems are used, like the previously mentioned DARPA AIxCC, and as a reminder the finalists found 54 synthetic vulnerabilities and patched 43, along with 18 previously unknown flaws in challenge projects … Although independent analysis by SoK shows the scores overstate real-world readiness, as there is “a persistent gap between technique capability and system reliability.”

Survey data is another thing we can look at although it’s imperfect as it measures adoption state and not diffusion speed. Nonetheless, the SANS 2026 AI Survey surveyed 536 practitioners and 57 leaders CISOs, and it found that AI use in cybersecurity rose from 50% (2025) to 78% in 2026. Although, much of this is still nascent.

According to the report only 27% of practitioners call their deployment mature production, most are still just piloting AI or using it as support, and 63% reported significant AI shortcomings in threat detection/response (up from 45% in 2025). AI use in red-teaming rose from 33% in 2025 to 61% in 2026.

In terms of deployment outcomes, Microsoft has a paper that’s observational and tries to estimate the causal effect of the use of Security Copilot, using difference-in-differences. It shows that users of Security Copilot showed a 30.13% reduction in mean time to resolution for a given incident three months post-adoption vs. control (the research team used telemetry from 150+ organizations; including data on 95,522 total incidents, the fixed effects ranged from 22.60% to 31.84%). The authors explicitly note “unobserved confounders inhibit causal identification.”

Now obviously this is Microsoft authors studying Microsoft’s own product, but it’s also the most rigorous deployment-outcome study I could find. It also measures a productivity effect, and not diffusion speed.

Let’s remember that there’s often a pretty notable patch-lag/time-to-exploit (15% of OT organizations patch monthly or more often), and you could use that as the operational-speed proxy. If you then take into account the SANS/ISC2 adoption-maturity data (only 27% mature production AI deployment in 2026; 40% using AI un-operationalized), it becomes clear that most organizations probably aren’t seeing that %30 reduction in resolution time. Those 6 months between frontier and open source releases are going to be pretty critical for organizations hoping to harden their defenses with AI tools.

I would like to see more formal research into this topic, like an academic longitudinal survey with dated deployment of models across a representative sample of organizations. If something like AIxCC could recur with benchmarks run against production-constrained budgets that would also be pretty informative. A federal deployment registry with timestamps would also be helpful in assessing the gap.

Without better evidence, I’d say this is unanswerable. Open-weight diffusion might be accelerating a little bit, and AI adoption by defenders is likely also accelerating a bit, but beyond that it’s hard to say.

Aggregate versus redistributed harm: Does democratization actually create more total harm, or just redistribute it?

So as AI tools become open source and democratized, does it increase the total amount of harm overall, or just shift it around? It’s plausible that the damage from cybercriminals could just be shifted, redistributed amongst currently low-skill criminals who go after the same kinds of hardened targets we’ve looked at already.

Cambridge Cybercrime Centre put out a pre-print in March 2026, evocatively titled “Stand-Alone Complex or Vibercrime?” Hughes et al analyzed data from more than 97k forum threads from underground or dark-web forums, all posted after ChatGPT launched in November of 2022.

They manually read through over 3200 of them and did topic-modeling. They sketch out two scenarios, Stand-Alone Complex is the high-end scenario where existing CaaS arrangements are completely automated, while at the low end they propose “Vibercrime”, where vibe-coding tools just lower the barrier to entry without meaningfully shifting the economics.

Per their own findings, the current reality is more prosaic than either extreme, with early adopters of AI in the cybercrime world mainly found in large-scale, low-profit passive income schemes and small-time fraud schemes.

There isn’t, currently, a ton of evidence for widespread disruption of the dominant economic structure in cybercrime. In other words, so far it isn’t widely used as a skill multiplier or disruptive innovation tool. They also found that low-skill cybercriminals actually see relatively little utility from vibe-coding tools compared to the pre-made scripts they were already using. LLM-coding tools are mainly replacing code-pasting/error-checking/cheatsheet-consultation for actors that are already quite skilled. This makes sense, I suppose, on reflection. Script kiddies were already just running scripts.

Another interesting finding was that the role of jailbroken LLMs as hacking instructors is likely overstated, due partly to the sense of community underground hackers find in each other. New entrants to underground communities value the social connections, subculture, and community identity of the initiation process as much as the technical knowledge itself, and they don’t just run to LLMs for all their skill-acquisition.

One piece of literature that bears on this question is Anderson et al., “Silicon Den: Cybercrime is Entrepreneurship“. This is a theoretical scaffolding lens, and it pre-dates widespread LLM usage. But it makes an economic argument about why you’d expect a market to saturate rather than see proportional aggregate growth as any technology lowers entry costs. There’s decreasing marginal returns as the easy (and valuable) targets are exhausted first.

This is rooted in both technical factors and human factors. Technically, there’s a wide spread of different, relatively rare system configurations that get harder and harder to hit with automated tools. Meanwhile, human factors like culture, victim language, and even attitudes and values get harder to convert into pay outs, even if lure-generation and translation becomes cheaper.

That’s notable because if this framework is correct, you’d expect a rising attack volume but flat or downward trending aggregate losses, and indeed that’s what we see in the Q2 ransomware bifurcation noted above.

The empirical study implies we aren’t on track for a huge revolution in cybercrime, in terms of increases in aggregate harm. The theoretical piece provides a plausible explanation for why, and the Chainanalysis data in Q2 (though it’s just one sub-section of total damage; on-chain ransomware payments) is some evidence that it’s playing out as expected. That’s three separate lines of evidence converging, and so I find it fairly plausible we’re not on track for a massive surge of cybercrime-related.

I’d still like to see better research into this topic. Ideally there’d be a study directly testing attacker success/failure rates against a pool of hardened targets and stratified by skill level, but that would require access to victim/incident data likely only in possession of ransomware operators themselves or law enforcement, and not publicly available, so we’re not likely to get that anytime soon. Beyond that, we could use realistic evaluations of autonomous-exploitation against hardened and actively-defended targets with undisclosed vulnerabilities.

I hope we can at least get a study tracking the success rate of low skill actors over time, using different configurations of attacker tools. A bias-corrected meta-analysis across vendor telemetry reporting actual dollar losses (and not just click rates) would also be good. It’s an open gap in the research.

I think there’s a genuinely compelling story here that the economics and the general advantage defenders have in white-box systems are combining to place a kind of ceiling on AI-driven payouts and economic damages from cybercrime, and that we likely aren’t going to see a massive explosion in cybercrime damages soon …although I’m not overly confident in it.

Multipliers Everywhere, Saturation Too

The impact of AI across cybercrime looks like multipliers on scale, speed, and cost-effectiveness rather than new capabilities or superpowers outright. I base this conclusion on a few facts:

1. The cybercrime sector was generally saturated and already commoditized prior to the arrival of LLMs
2. Even when LLMs did start to become widely available we didn’t see much uplift for a few years
3. Bottlenecks are often things like initial access and cash out, which LLMs don’t obviously help with
4. Aggregate losses due to ransomware haven’t seen much growth
5. The sector was already trending towards hardened, larger, more valuable targets (and these will be the ones best able to defend against AI-enhanced criminals)

What is new is certainly nameable: Automated orchestration of n-day exploits at scale, and autonomous robust exploitation of hardened targets. The former is here, the latter is not.

Capabilities certainly crossed a threshold this year, but the criminal reality is still governed by basic economics that seem less likely to shift. The economic calculus behind n-day exploits looks unlikely to change for the near-term, and the unpredictable nature of frontier LLMs might actually incentivize cybercriminals to stick with orchestration rather than attempt autonomous exploitation.

Defenders may have structural advantages due to a white box environment and initial access to advanced LLM tools through initiatives like Project Glasswing, letting them harden defenses, assuming they can effectively exploit the previously 4 - 6 month gap between frontier and open source.

The discourse around this topic, on both sides of the debate, often makes the same error: confusing a demonstrated capability with a criminal outcome, and an input with harm. This happens because the incentives all promote collapsing the distinction. Vendors hype up both threat and the cure, labs demonstrating the ceiling, and the current ecosystem of metrics essentially just counts inputs and then lets you imagine the outputs.

While it seems plausible to me that we should harden our defenses around critical infrastructure due to the risk involved with not doing so, the activity levels and economic damage of cybercrime itself doesn’t look to be on track for a major upheaval. Those looking to make an impact in the AI safety area should consider this when choosing a focus area. Their time might be better spent on alignment or governance work

1. ^{^}

   In fairness, the FBI suspects that IC3’s “4% of losses attributable to AI” is likely an undercount of the real volume of losses. The main effect of AI is somewhat invisible to actual victims, likely not logged at the point of complaint. It’s really only relevant to attackers and enterprise scale defenders. A victim who ends up getting phished by a fluent, AI-translated lure likely just says “I was scammed,” not “I was scammed by AI”. So we should interpret this 4% figure as “harm where AI involvement was independently identified and volunteered”... but even if we assume it’s several-fold higher, that’s still likely an order of magnitude away from “80% of ransomware is AI.” I think that’s still a meaningful signal, just a narrower and more downward-biased category of harm.

2. ^{^}

   Meanwhile, a competing report from the vendor ReliaQuest looked at roughly the same period and it put the figure at 80% by including both “automation” and AI in that category… two different categories of tooling for one metric. This got interpreted by others as “AI-powered capabilities” full stop. Cybersecurity Dive described that as 50% of groups offering ‘AI-powered capabilities,’ but that is not how ReliaQuest’s underlying breakdown is framed.

3. ^{^}

   Bloomberg reports that attack volume from Chinese hackers has doubled, but once more that’s purely an activity/input metric from a vendor source. And according to Palo Alto’s Unit 42 analysis, while there was a DeepSeek agent that carried out an attack and tried to identify potential exploitable code, it never got in. The confirmed successful intrusions were all human driven, as described by Implicator: “Across more than 460 attempted targets, every confirmed impact came from manual work: data exfiltration from three Citrix NetScaler targets and command execution on 11 Marimo notebook instances.”

4. ^{^}

   Another instance where capability demonstrated isn’t the same thing as criminal practice against hardened real-world targets. In order to replicate this specific setup, it’d require the same kind of setup and execution involving a covert channel, days of unseen activity, and convergence of the agent swarm on a single target. I am definitely concerned about the potential for collusion between multiple AI agents and the deception of overseers, but this is more of an alignment and agent safety concern in my opinion. Worth worrying about, but not necessarily relevant to cybercrime economics.

5. ^{^}

   According to people who know more about this than me, most software actually has things like unbounded loops, arbitrary-length inputs, and interaction with an open environment and there’s no algorithm (no matter how much compute or how many AI agents you throw at it) that’s guaranteed to correctly determine, for arbitrary code, whether a given exploitable condition exists. All possible exploits, found with certainty” is theoretically unattainable, even with infinite time.

6. ^{^}

   Many real-world vulnerabilities come from business-logic flaws (the code does exactly what was written, but what was written is exploitable), social engineering, credential/process failures, supply-chain compromises. Exhaustive code search doesn’t solve them.