We’ve been spending a lot of time discussing artificial intelligence on The Security Box lately. Sometimes we’re talking about useful tools. Sometimes we’re talking about what happens when organizations trust an AI system too much. And sometimes we’re talking about criminals using those same tools to do their dirty work.
Here’s the question I keep coming back to: AI may make cybercrime easier, but is it making the criminals any smarter?
I don’t think those are the same thing.
You don’t have to know everything anymore
There was a time when carrying out a sophisticated intrusion required a fair amount of technical knowledge, or at least access to somebody who had it. Criminals could buy tools and stolen credentials, of course, but there were still obstacles.
AI can lower some of those obstacles. It can help write scripts, explain error messages, summarize technical documentation, translate messages and produce convincing phishing text. An attacker who doesn’t fully understand the code can sometimes ask a model to explain or revise it.
That’s not a guarantee the attack will work. AI systems make mistakes, invent details and produce insecure or nonfunctional code. But a criminal may be able to try more things, more quickly, with less personal expertise.
And that means defenders may face more attempts, not necessarily more brilliant adversaries.
The bank hacker who may have left a résumé
One of the stories in the October 13, 2026 SANS NewsBites newsletter caught my attention. CrowdStrike reportedly investigated AI-assisted attacks involving South Korean financial institutions. According to the report, exposed AI session logs included a request to prepare a résumé, potentially giving investigators information that could help identify the attacker.
Now, I don’t know whether investigators have identified that person. I don’t know whether the résumé details were real. And I certainly don’t know whether anybody will be charged. Those are important distinctions.
But the possibility is remarkable. Someone allegedly uses AI in connection with attacks on banks, and the AI interaction itself may leave behind a clue about who was doing it.
That’s the sort of thing that makes you ask, as Steve Gibson likes to do: what could possibly go wrong?
It also raises a bigger point. AI tools can produce artifacts: prompts, outputs, logs, saved conversations, files and records of how they were used. Depending on the system, those artifacts may be retained or exposed. An attacker who treats AI like an invisible accomplice may discover that it is anything but invisible.
I think that story deserves its own Stupid Fuck Award discussion, provided we keep the facts and the unanswered questions straight.
Automation is not judgment
Here’s something that gets lost in the excitement about AI: doing something faster is not the same as doing it wisely.
An AI system can generate ten phishing emails while a person writes one. That doesn’t mean the ten are believable. It can suggest an exploit, but that doesn’t mean the exploit applies to the target. It can draft malicious code, but that doesn’t mean the operator understands what the code does or what evidence it leaves behind.
And criminals who blindly trust their tools may make the same kinds of mistakes as businesses that blindly trust AI-generated answers.
The difference is that we hope the criminals make those mistakes. We don’t want our hospitals, banks, schools and transit agencies making them.
The defender has a problem too
I don’t want to pretend this is all good news for defenders. Even clumsy attacks can succeed when an organization hasn’t patched a known vulnerability, uses weak authentication, or gives a compromised account more access than it needs.
If AI makes it cheaper to generate attacks, defenders may have to handle more suspicious messages, more scanning and more attempts to exploit familiar weaknesses. A security team can’t simply assume that an attacker is harmless because the attacker doesn’t understand the tools being used.
Organizations still need the basics: patching, multifactor authentication that resists phishing, sensible access controls, network segmentation, useful logging, and people who know what to do when something goes wrong.
AI may help defenders analyze activity and respond, too. But somebody still has to verify its conclusions.
The real question
So is AI making cybercriminals smarter? In some cases, it may help knowledgeable attackers work more efficiently or explore new techniques. In other cases, it may simply give inexperienced people more ways to cause trouble.
Neither outcome means the person behind the keyboard has acquired good judgment.
I keep coming back to the same conclusion: artificial intelligence can amplify capability, but it doesn’t automatically supply common sense.
And if the South Korean banking investigation eventually confirms that somebody left identifying information in an exposed AI session, we’ll have an especially memorable illustration.
Until then, I’ll keep watching the developments, and we’ll keep discussing them on The Security Box.
Because if there’s one thing this technology is doing, it’s giving us plenty to talk about.
Related reading
Related
Discover more from Jared's Technology podcast network
Subscribe to get the latest posts sent to your email.
AI Is Making Cybercrime Easier, but Is It Making Criminals Any Smarter?
We’ve been spending a lot of time discussing artificial intelligence on The Security Box lately. Sometimes we’re talking about useful tools. Sometimes we’re talking about what happens when organizations trust an AI system too much. And sometimes we’re talking about criminals using those same tools to do their dirty work.
Here’s the question I keep coming back to: AI may make cybercrime easier, but is it making the criminals any smarter?
I don’t think those are the same thing.
You don’t have to know everything anymore
There was a time when carrying out a sophisticated intrusion required a fair amount of technical knowledge, or at least access to somebody who had it. Criminals could buy tools and stolen credentials, of course, but there were still obstacles.
AI can lower some of those obstacles. It can help write scripts, explain error messages, summarize technical documentation, translate messages and produce convincing phishing text. An attacker who doesn’t fully understand the code can sometimes ask a model to explain or revise it.
That’s not a guarantee the attack will work. AI systems make mistakes, invent details and produce insecure or nonfunctional code. But a criminal may be able to try more things, more quickly, with less personal expertise.
And that means defenders may face more attempts, not necessarily more brilliant adversaries.
The bank hacker who may have left a résumé
One of the stories in the October 13, 2026 SANS NewsBites newsletter caught my attention. CrowdStrike reportedly investigated AI-assisted attacks involving South Korean financial institutions. According to the report, exposed AI session logs included a request to prepare a résumé, potentially giving investigators information that could help identify the attacker.
Now, I don’t know whether investigators have identified that person. I don’t know whether the résumé details were real. And I certainly don’t know whether anybody will be charged. Those are important distinctions.
But the possibility is remarkable. Someone allegedly uses AI in connection with attacks on banks, and the AI interaction itself may leave behind a clue about who was doing it.
That’s the sort of thing that makes you ask, as Steve Gibson likes to do: what could possibly go wrong?
It also raises a bigger point. AI tools can produce artifacts: prompts, outputs, logs, saved conversations, files and records of how they were used. Depending on the system, those artifacts may be retained or exposed. An attacker who treats AI like an invisible accomplice may discover that it is anything but invisible.
I think that story deserves its own Stupid Fuck Award discussion, provided we keep the facts and the unanswered questions straight.
Automation is not judgment
Here’s something that gets lost in the excitement about AI: doing something faster is not the same as doing it wisely.
An AI system can generate ten phishing emails while a person writes one. That doesn’t mean the ten are believable. It can suggest an exploit, but that doesn’t mean the exploit applies to the target. It can draft malicious code, but that doesn’t mean the operator understands what the code does or what evidence it leaves behind.
And criminals who blindly trust their tools may make the same kinds of mistakes as businesses that blindly trust AI-generated answers.
The difference is that we hope the criminals make those mistakes. We don’t want our hospitals, banks, schools and transit agencies making them.
The defender has a problem too
I don’t want to pretend this is all good news for defenders. Even clumsy attacks can succeed when an organization hasn’t patched a known vulnerability, uses weak authentication, or gives a compromised account more access than it needs.
If AI makes it cheaper to generate attacks, defenders may have to handle more suspicious messages, more scanning and more attempts to exploit familiar weaknesses. A security team can’t simply assume that an attacker is harmless because the attacker doesn’t understand the tools being used.
Organizations still need the basics: patching, multifactor authentication that resists phishing, sensible access controls, network segmentation, useful logging, and people who know what to do when something goes wrong.
AI may help defenders analyze activity and respond, too. But somebody still has to verify its conclusions.
The real question
So is AI making cybercriminals smarter? In some cases, it may help knowledgeable attackers work more efficiently or explore new techniques. In other cases, it may simply give inexperienced people more ways to cause trouble.
Neither outcome means the person behind the keyboard has acquired good judgment.
I keep coming back to the same conclusion: artificial intelligence can amplify capability, but it doesn’t automatically supply common sense.
And if the South Korean banking investigation eventually confirms that somebody left identifying information in an exposed AI session, we’ll have an especially memorable illustration.
Until then, I’ll keep watching the developments, and we’ll keep discussing them on The Security Box.
Because if there’s one thing this technology is doing, it’s giving us plenty to talk about.
Related reading
Share this:
Like this:
Related
Discover more from Jared's Technology podcast network
Subscribe to get the latest posts sent to your email.
Published in article commentary, musings and security news and commentary