AI in Cyberattacks: Hype Meets Reality

The specter of artificial intelligence, a boundless digital entity, has long haunted the cybersecurity landscape.

For years, the narrative has been one of an inevitable surge, where autonomous AI agents, cloaked in virtual hoodies, would seamlessly orchestrate devastating cyberattacks with minimal human intervention.

This vision, often dubbed “vibe hacking,” is the dark mirror to the burgeoning phenomenon of “vibe coding,” where AI assists developers in crafting software with unprecedented efficiency.

Yet, as the dust settles on recent, rigorous investigations, the reality of AI’s weaponization appears far more nuanced, if no less concerning in the long run.

We’ve already witnessed the preliminary skirmishes of AI in cyber warfare.

AI-powered phone calls are now a common tool for scammers.

More than half of all reported spam is attributed to AI generation, and deepfakes have morphed from novelty to a genuine threat, eroding trust and manipulating perception.

These are potent, pervasive issues, undoubtedly, but they represent AI as a sophisticated tool in the hands of human adversaries, rather than a fully independent attacker.

The leap to “vibe hacking” – where AI autonomously discovers vulnerabilities, crafts exploits, and launches attacks with malicious intent – remains, for now, largely a theoretical construct.

The term “vibe coding” itself has been widely misinterpreted.

It’s not about AI conjuring functional applications from thin air, negating the need for human programmers.

Instead, it’s a symbiotic relationship: AI streamlines development, generating remarkably efficient code based on specified outcomes, but it still demands the guiding hand and profound understanding of a human developer.

It augments, it accelerates, it doesn’t replace.

The question then becomes, can this same transformative power be wielded by hackers to automate the entire cyberattack pipeline?

According to Michele Campobasso, a senior security researcher at Forescout, the answer, for now, is a resounding “not yet.” Despite the pervasive fear and the breathless headlines, Campobasso states unequivocally that there is “no clear evidence of real threat actors” engaging in true vibe hacking.

Instead, current reports indicate that Large Language Models (LLMs) are predominantly employed for tasks where language is paramount, not complex code execution.

This includes crafting highly convincing phishing emails, orchestrating sophisticated influence operations, providing context for known vulnerabilities, or generating boilerplate components for malware – essentially, enhancing the human element of an attack rather than replacing it.

Forescout’s comprehensive study, conducted between February and April 2025, put over 50 AI models through their paces, challenging them with four intricate test cases drawn from industry-standard datasets and cybersecurity wargames.

The results offer a sobering reality check to the hype.

Open-source LLMs, often lauded for their accessibility, performed abysmally across the board, proving “unsuitable even for basic vulnerability research.” The underground, criminal-focused LLMs fared only marginally better, plagued by practical limitations such as “usability issues, including limited access, unstable behavior, poor output formatting, and restricted context length.”

Unsurprisingly, commercial models delivered the most promising results.

Yet, even among the elite, only a mere three out of eighteen models managed to produce a working exploit for the most challenging test cases.

Critically, the research revealed a significant hurdle: LLMs found exploit development itself far more difficult than mere vulnerability research, with no single model successfully completing all the assigned tasks.

As Campobasso concisely puts it, “Attackers still cannot rely on one tool to cover the full exploitation pipeline.”

The models consistently produced inconsistent results, marked by high failure rates.

Even when they did complete exploit development tasks, they “required substantial user guidance.”

This reliance on human oversight, coupled with the models’ propensity for confidently delivering incorrect solutions, presents a unique danger.

An inexperienced attacker, misled by the AI’s authoritative tone, could waste critical time and resources pursuing flawed leads, potentially exposing themselves in the process.

It underscores a crucial point: AI, in its current iteration, is a force multiplier for the skilled attacker, not a substitute for skill itself.

The image of “AI in a hoodie” might still be a powerful one, but for now, it’s less about the AI being the hacker and more about the AI assisting the hacker, providing a powerful, albeit imperfect, co-pilot.

The age of true vibe hacking, where AI autonomously orchestrates complex attacks, is indeed approaching, but its arrival is not as imminent as the breathless pace of vibe coding might suggest.

This measured progress, however, should not breed complacency.

Defenders must recognize that the landscape is evolving, and while the core principles of cybersecurity remain steadfast, the nature of the threats will become increasingly sophisticated.

As Campobasso wisely concludes, “The fundamentals of cybersecurity remain unchanged: An AI-generated exploit is still just an exploit, and it can be detected, blocked, or mitigated by patching.”

The message is clear: panic is unwarranted, but preparation is paramount.

The current battle is not against sentient AI masterminds, but against human adversaries armed with increasingly potent AI tools.

The best defense, as ever, lies in robust patching, vigilant detection, and a clear understanding that while AI can amplify threats, it cannot, at least not yet, negate the enduring importance of human expertise and foundational cybersecurity practices.