Artificial intelligence is changing cybersecurity from both sides of the fight.
In [How AI Is Changing Threat Detection in Cybersecurity], we looked at how security teams are using AI to process large amounts of security data, identify suspicious patterns, and detect threats faster.
Attackers are using the same technology for a very different purpose.
They are using AI to research targets, produce phishing and social engineering content, write and modify code, investigate vulnerabilities, analyze compromised environments, and automate parts of their operations.
But there is an important distinction here.
AI has not suddenly turned ordinary criminals into elite hackers. In most of the activity security researchers are observing, attackers are still making the important decisions themselves. AI is helping with the work around those decisions.
That might mean finding useful information about a target, explaining unfamiliar code, generating a message, analyzing data, or helping an attacker work through a technical problem.
The result is less dramatic than the idea of an autonomous machine launching attacks by itself, but potentially more important in practice.
AI is making parts of the attack process easier to repeat, faster to carry out, and less dependent on manual effort.
AI is becoming part of the attack process
A cyberattack is rarely one action.
An attacker may spend time researching an organization before attempting to gain access. Once inside, there may be more work involved in understanding the environment, identifying valuable systems, finding information, and deciding what to do next.
AI can now assist with several of those activities.
Microsoft Threat Intelligence has documented threat actors using generative AI for reconnaissance, social engineering, malware development, infrastructure development, and post-compromise activity. In many of these cases, the human attacker remains responsible for the objective and major operational decisions.
That distinction matters.
An AI-assisted attack is not automatically an autonomous attack.
For much of what is being observed today, AI is closer to an assistant working inside an attacker’s existing workflow. It can act as a researcher in one moment, a programmer in another, and an analyst somewhere else.
The attacker still decides what the operation is trying to achieve.
Attackers are using AI to research targets
Before an attacker tries to compromise an organization, there is usually information to collect.
Who works there? What technologies does the organization use? Which employees might have access to important systems? What public information reveals relationships between people, companies, technologies, and suppliers?
A surprising amount of this information is already available online.
The difficulty is putting it together.
MITRE ATT&CK now documents the use of publicly available AI services as an adversary technique. Its documentation describes how attackers can use AI services to synthesize and analyze information about people, organizations, technologies, business relationships, and other publicly available data.
Microsoft has also observed threat actors using AI to research vulnerabilities, identify useful tools and infrastructure, analyze job postings, and gather information that can support targeting.
That last part is easy to overlook.
A job advertisement can reveal the technologies a company uses. It can indicate what kind of infrastructure a team works with or what skills the organization considers important.
An attacker could previously find those details by searching through different sources and manually connecting them.
AI can help make that process much quicker.
The advantage is not necessarily that AI gives attackers secret information.
It is that information which was already scattered across the internet can be processed and connected with much less effort.
That makes reconnaissance less of a bottleneck.
Phishing gets easier when the writing can be automated
Phishing has been around for decades. AI did not invent it.
What has changed is how easily an attacker can produce and adapt the material used in a campaign.
Generative AI can help create messages, translate them, adjust their tone, summarize information about a target, and produce different versions of the same basic deception.
Microsoft has documented threat actors using AI to generate phishing lures, translate communications, create fraudulent identities, and maintain consistent communication with targets.
The significance is not that an AI-generated message will automatically fool someone.
It won’t.
Bad phishing is still bad phishing.
The difference is that an attacker no longer has to spend the same amount of time manually writing every variation. They can produce more attempts and adapt them more easily.
That matters because social engineering often depends on context.
A generic message is easy to dismiss. A message that appears to understand the recipient, their organization, their role, or something happening around them can be more convincing.
AI makes producing that kind of variation much easier.
And the same technology that helps an attacker write an email can help them write it in another language or maintain the same false identity across a longer conversation.
The underlying technique has not changed.
The economics of producing it have.
Sometimes the AI brand is the bait
There is another interesting development.
Attackers do not always use AI to power the attack itself. Sometimes they use the popularity of AI products to make the attack more believable.
Microsoft has documented phishing and malvertising campaigns impersonating popular AI platforms including ChatGPT, Copilot, DeepSeek, and Claude. The company emphasized that these campaigns involved impersonation and abuse of the brands, not compromises of the AI companies themselves.
In one campaign detected in May 2026, Microsoft observed a ChatGPT-themed phishing operation that sent thousands of emails containing malicious links designed to collect personal and financial information.
The reason this works is fairly simple.
People trust things they recognize.
As AI tools become part of everyday work, a message claiming that an AI account needs an update or that a new AI feature is available can become another familiar reason to click.
The technology people are becoming comfortable with can therefore become part of the deception.
AI can help with malicious code too
AI’s usefulness to attackers is not limited to writing emails.
It can also assist with code.
Threat actors can use AI coding tools to explain unfamiliar programming concepts, troubleshoot errors, modify existing code, and build components of larger projects.
Microsoft describes this as an acceleration of human-guided malware development rather than a complete replacement of the attacker. Its research has found threat actors using AI to generate, debug, adapt, and reimplement malicious components.
This is where some of the popular discussion around AI and hacking becomes exaggerated.
The idea that someone with almost no technical knowledge can simply ask an AI model to create sophisticated malware and instantly become an elite cybercriminal makes for a good headline.
Real attacks are more complicated.
Code still has to work. Infrastructure still has to be prepared. Access still has to be obtained. The attacker still needs to understand what they are trying to accomplish and how the pieces of an operation fit together.
AI does not remove those problems.
It can make some of the technical work easier.
Someone who does not understand a particular programming concept may be able to ask an AI system to explain it. An experienced attacker may use the same system to troubleshoot something that would otherwise take much longer.
That difference is important.
AI does not need to replace technical expertise to make technical expertise more productive.
Vulnerability research is another area to watch
One of the more significant developments is the use of AI in vulnerability research.
Finding a vulnerability is only part of the problem. Understanding what it means, determining how it can be exploited, developing supporting code, and adapting that work to a particular environment can all require substantial technical knowledge.
AI can assist with portions of that process.
In May 2026, Google Threat Intelligence reported identifying a threat actor using a zero-day exploit that researchers believed had been developed with AI assistance. Google said the actor intended to use the vulnerability in a mass exploitation campaign, although proactive discovery may have prevented that operation.
Google has also reported growing interest among threat actors in using AI for vulnerability discovery and exploit development.
That does not mean AI has suddenly made zero-day vulnerabilities easy to discover.
It means AI is beginning to appear in an area where even small reductions in development time can matter.
Defenders depend heavily on time.
There is time between discovering a vulnerability and understanding its impact. There is time between understanding the problem and developing a fix. There is then the time required to deploy that fix across real systems.
If AI helps attackers compress parts of that process, the window available to defenders can become smaller.
The work continues after an attacker gets inside
It is easy to think of AI in terms of getting an attacker through the front door.
But gaining access is often only the beginning.
Once inside an environment, an attacker still needs to understand what they have found.
Which systems matter? Where is valuable information stored? Which accounts have useful access? What data is worth taking? What should happen next?
AI can help with that analysis.
Microsoft has observed threat actors using AI to support post-compromise activities such as data discovery, data summarization, asset prioritization, and tooling refinement.
This is a less dramatic use of AI than the idea of a machine independently taking over an entire network, but it may be closer to how the technology is actually being used.
An attacker does not need an AI system to run an entire intrusion independently.
If AI can help a human operator make sense of a large amount of information in minutes instead of hours, that can already change what the attacker is capable of doing.
The more important shift may be toward agentic attacks
Most of the examples so far involve a human directing AI.
The attacker asks a question. The model produces an answer. The attacker reviews it and decides what happens next.
Agentic AI changes that relationship.
An AI agent can be connected to tools and workflows that allow it to plan tasks, perform actions, evaluate results, and continue working toward an objective with less continuous human prompting.
That opens the door to longer automated attack workflows.
And this is no longer something researchers are discussing only as a future possibility.
In September 2026, Google Threat Intelligence reported observing threat actors move from basic prompting toward agentic AI workflows and AI-enabled automation. In one case, attackers compromised a cloud resource and then planned, built, and executed an agent-enabled credential-harvesting campaign in less than six hours.
Google also reported adversaries using multi-agent frameworks to manage parts of operational workflows, including scanning and credential-harvesting activity.
At the same time, it would be a mistake to interpret this as evidence that fully autonomous AI hackers are already conducting most sophisticated attacks.
They are not.
Microsoft’s research describes agentic AI use by threat actors as an emerging area, with reliability, operational risk, and the need for human oversight still limiting wider adoption.
But the direction is worth watching.
The question is gradually changing from:
Can AI help an attacker perform this task?
to:
How many connected tasks can an AI system perform before a human needs to intervene?
That is a different problem for defenders.
AI is changing the economics of familiar attacks
None of these developments means that traditional cyberattacks have suddenly disappeared.
Reconnaissance is still reconnaissance.
Phishing is still phishing.
Malware is still malware.
Vulnerability exploitation is still vulnerability exploitation.
What is changing is the amount of effort required to carry out parts of these activities.
An attacker can process information faster. They can produce more variations of a message. They can get help with unfamiliar code. They can analyze large amounts of information after gaining access. And increasingly, they can connect several tasks into more automated workflows.
That accumulation is where the real significance lies.
The security industry does not necessarily need to prepare for one spectacular new form of “AI hacking.”
It needs to understand what happens when existing attack methods become easier to repeat and adapt.
AI does not make attacks invisible
There is another misconception worth addressing.
If attackers are using AI, does that mean traditional cybersecurity defenses are becoming useless?
No.
AI assistance does not automatically remove the signals generated by an attack.
Microsoft has documented AI-assisted phishing and malware campaigns that were detected and disrupted by security systems.
The problem is that attackers may now be able to produce more variations and adapt their behavior more quickly.
That makes it harder for defenders to depend entirely on fixed indicators or one recognizable pattern.
A suspicious login is still suspicious.
An unusual change in an account is still unusual.
Unexpected access to sensitive information still matters.
A system behaving differently from its normal pattern still deserves investigation.
The challenge is connecting those signals quickly enough.
That is where AI can also give defenders an advantage, as we explored in the first article of this series. Security teams can use AI to process large volumes of telemetry, correlate events, identify anomalies, and investigate suspicious activity more quickly.
The technology itself is not inherently on the attacker’s side or the defender’s side.
The advantage comes from how effectively it is used.
What this means for defenders
The evidence so far points to a fairly consistent picture.
Attackers are not waiting for some future version of AI that can conduct an entire intrusion without human involvement. They are already using the technology wherever it gives them a practical advantage.
Sometimes that means researching a target.
Sometimes it means producing a convincing message.
Sometimes it means working through unfamiliar code or investigating a vulnerability.
Sometimes it means making sense of a compromised environment.
And in the newer examples of agentic activity, it can mean connecting several of these tasks into a workflow that requires less continuous human involvement.
The important thing is not to overstate any of this.
AI has not made every attacker more capable of everything.
It has not made attacks impossible to detect.
And it has not eliminated the need for human expertise.
What it has done is remove friction from parts of the attack process.
That may sound less dramatic than the idea of an autonomous AI hacker.
It is also more closely aligned with the evidence we have today.
As AI becomes more capable, the distinction between an attacker using AI as a tool and an AI system carrying out part of an attack will become increasingly important.
And that leads to the next question in this series:
When does a cyberattack actually become “AI-powered”?
Because an attack that uses AI somewhere in the process is not necessarily the same thing as an attack that depends on AI to function.
That distinction is the subject of the next article.
