For the past few years, cybercriminals have been adopting AI tools to enhance their malicious campaigns. However, one threat researcher has claimed that AI has not made any significant changes to the cyber threat landscape, and in many cases has made attacks less effective.
Based on her findings and analysis of recent campaigns where AI was used by cybercriminals, Selena Larson, principal threat researcher at Proofpoint, shared during the IRISSCON 2026 conference in Dublin, Ireland, on November 11 how AI has, in many, cases has made attacks less effective.
“We’ve all been told since 2023 that AI will make attackers better, faster and stronger. That they’ll have access to the same tools and resources as the best developers, security professionals and vulnerability researchers in the world, and will automatically become better at hacking. This is marketing nonsense, the data just doesn’t back up this assertion,” she noted.
AI “Slop” Enters the Attack Chain
While AI has enabled threat actors to increase the speed and scalability of campaigns, a number of groups have become overly reliant on these tools, leading to frequent errors – something Larson described as “AI slop.”
Proofpoint has found such errors in AI generated malware. “We frequently run into malware where the code doesn’t actually work, there’s comments which want to do one thing, but the malware is doing something completely different,” Larson said.
A similar scenario has occurred with phishing campaigns observed by Proofpoint over the past year. Larson highlighted the case of a threat actor tracked as TA4903, which specializes in business email compromise (BEC) and phishing campaigns.
Historically, the group has impersonated US government entities to target organizations across a range of sectors, using sophisticated lures.
However, Larson said that since the group started adopting AI tools in their attack chains, their lures have really gone downhill.
This is because the AI generated emails often do not match up with the subjects and attachment – sometimes leaving the body of the message blank.
In addition to AI-generated lures, the group now primarily creates phishing websites using AI coding tools. These vibe coded sites are often simplistic and take on a similar appearance in terms of colors and formatting, making them easier for targets to detect.
Larson also pointed out that the use of AI-generated phishing messages to ensure correct region-specific grammar and spelling, can even make lures less believable.
“Human beings often don’t know how to spell, they often are bad at grammar, people aren’t trying to be overly polished. So, I think that’s actually a bit of a detriment to some of these actors,” she added.
Even in vulnerability exploitation, where AI has been found to discover and exploit flaws rapidly, AI-generated exploits often have significant weaknesses over human-based activity.
Larson cited the example of the ‘BlueMoon’ exploit chain first observed in August 2026, which involved three Microsoft Chrome browser vulnerabilities chained together.
The threat actors used large language models (LLMs) to write exploits, using information given in patch release notes. However, the AI-generated exploit itself was highly flawed, often not behaving as intended and generating significant noise, making attempts easily identifiable for defenders.
No Change in Cyber Defense Priorities
Larson said it is important to emphasize that AI is a productivity tool and does not automatically increase the sophistication of threat actor campaigns.
“AI is only as good as its operator and this is, and it can lead to more sloppy mistakes,” she noted.
As a result, cyber defense remains fundamentally the same. The biggest shift is the fact that AI is making it faster and easier for attackers to exploit vulnerabilities that cybersecurity professionals have been aware of for a long time.
“Attacks are attacks and AI generally doesn’t really matter. Whatever you’re defending against, defense is going to remain the same,” Larson concluded.