How do attackers use AI?

Attackers mainly use AI to move faster and reach further: writing convincing phishing messages, researching targets, producing or modifying malicious code and sifting through stolen data. According to France’s national cybersecurity agency ANSSI, however, no AI system has yet carried out every stage of an attack on its own. AI speeds up known methods more than it invents new ones.

This article is part of our series on attack response in the age of AI. To see how defence is adapting, read What is machine-speed incident response?.

What public agencies say

Three recent assessments give a consistent picture:

• ANSSI (February 2026): the agency says it is not aware of cyber attacks against French organisations carried out with AI, nor of any AI system able to run a whole attack on its own. It considers it plausible that these technologies will significantly improve the level, volume and effectiveness of attacks, especially against poorly secured environments.
• UK NCSC (May 2025): AI will almost certainly make parts of intrusion operations more effective, but fully automated, end-to-end advanced attacks are unlikely before 2027.
• Microsoft (October 2026): threat actors are incorporating AI into reconnaissance, social engineering, malware and exploit development, and post-compromise activity; for now, most use focuses on specific parts of existing attack workflows.

Observed uses

Social engineering and reconnaissance

This is the most widespread use. ENISA’s Threat Landscape 2025 (October 2025), which compiles open-source data, reports that by early 2025 AI-supported phishing campaigns reportedly represented more than 80% of observed social engineering activity worldwide; the figure should be read with caution, as it depends on the sources ENISA aggregates. According to ENISA, AI is also used in voice phishing and impersonation fraud, with deepfakes. ANSSI cites groups that used generative AI to research targets, produce phishing content or create fake company and employee profiles on social networks.

The practical consequence: spelling mistakes are no longer a reliable clue. Attacks on email and cloud accounts benefit directly. See Microsoft 365 attacks MSPs do not see coming.

Malware development

ANSSI reports that in 2024 one group allegedly used a PowerShell script generated by a language model to compromise a German company. It also cites a ransomware prototype built by researchers that generates its scripts at run time, and malware that queries an AI model to rewrite its source code every hour to evade detection. The agency notes that such developments still require fairly sophisticated skills.

Sifting stolen data

According to ANSSI, citing a Ukrainian statement from February 2025, operators allegedly used generative AI to analyse large volumes of exfiltrated data and pick out useful information.

Jailbroken and malicious models

Attackers bypass the safeguards of mainstream models with carefully worded prompts, and jailbreak services are sold on forums. ANSSI also cites malicious models sold for around a hundred dollars a month. ENISA flags as a particular concern the emergence, since early 2025, of stand-alone malicious AI systems, going beyond simple misuse of existing models.

AI as a lure and as a target

ENISA reports fake websites impersonating popular AI tools to deliver malware. AI systems are targets too: model poisoning, flaws in the connectors between models and tools, malicious software packages published under names “invented” by coding assistants. ANSSI, citing a third-party source, reports that more than 100,000 ChatGPT accounts were reportedly compromised between 2022 and 2023 by infostealers. MITRE ATLAS catalogues these attack techniques against AI systems.

What AI does not do yet

ANSSI is clear: identifying a vulnerability and developing the related proof of concept still depend on human skills, and it knows of no confirmed case of a zero-day vulnerability discovered with a generative AI model being exploited. The NCSC warns, however, that the time between disclosure and exploitation, already down to days, will almost certainly shrink further.

What this means for defence

Nothing radically new, but everything faster:

1. Protect identities. Microsoft notes that most intrusions still start with a person or a credential, so multi-factor authentication and cloud sign-in monitoring remain priorities.
2. Patch quickly. If exploitation follows disclosure within days, patching cycles must keep up.
3. Detect behaviour. Code that changes shape escapes signatures, but not necessarily an EDR that judges behaviour.
4. Monitor continuously. A faster attack leaves less time between the first signal and the damage. See How do a SOC and a CERT respond to AI-powered attacks?.

Defenders use AI too. At Cyna, AI is used, among other things, to help design automation rules for its SOAR; analysts remain involved in every alert.

Cyna also ran a webinar on AI and cybercrime risks for MSPs.

Talk to an expert

Want to assess how exposed your clients are to these techniques? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

What is a "jailbroken" or malicious AI model?

A model whose safeguards have been bypassed or removed. ANSSI cites services such as WormGPT and FraudGPT, sold on criminal forums or Telegram channels for around a hundred dollars a month.

Are deepfakes already used against businesses?

Yes, mainly for impersonation. ENISA notes AI use in voice phishing and impersonation fraud involving deepfakes, and ANSSI mentions deepfake services available for a few tens of dollars.

Can AI help attackers find unknown vulnerabilities?

Not at scale yet, according to ANSSI: finding a vulnerability and building the proof of concept still depend on human skills. The NCSC, however, expects AI to shorten the time between disclosure and exploitation even further.

How should staff be trained against these scams?

Focus on procedures rather than how messages look: always call back on a known number before any payment or change of bank details, however convincing the email or voice.