Hackers' Overreliance on AI Can Result in Weaker Cyber

* Selena Larson, principal threat researcher at Proofpoint, shared findings at IRISSCON 2026 in Dublin, Ireland.
* AI has not made significant changes to the cyber threat landscape; it has made attacks less effective in many cases.
* Threat actors become overly reliant on AI tools, leading to errors described as "AI slop."
* Proofpoint found errors in AI-generated malware where code does not work or performs unintended actions.
* In phishing campaigns, an actor tracked as TA4903 adopted AI tools.
* TA4903's phishing lures became degraded due to AI generation often resulting in mismatched subjects/attachments or blank message bodies.
* The group now uses AI coding tools to create phishing websites that are simplistic and visually similar, aiding detection.
* AI-generated phishing messages incorporating incorrect grammar and spelling can reduce believability.
* AI-generated exploits, such as the 'BlueMoon' chain involving three Chrome vulnerabilities, often have significant weaknesses over human activity.
* Larson stated AI is only as good as its operator and can lead to sloppy mistakes.

The narrative presented suggests a critical divergence between the promise of AI as an amplifier of capability and its reality as a source of systemic noise and fragility within offensive operations. The core tension lies in the distinction between computational speed and operational quality. Threat actors, driven by a desire for efficiency, are substituting genuine security expertise with automated generation, which introduces artifacts—the "AI slop"—that act as measurable weaknesses rather than purely novel attack vectors. This suggests that AI functions less as an agent of radical innovation and more as a highly efficient, yet inherently flawed, mechanism for executing known methodologies at scale. The observation that grammatical errors degrade lures and poorly written exploits generate noise points to the unstated assumption that the sophistication of the tool dictates the quality of the outcome, which is demonstrably false in this context.
The implication for defense is paradoxical: attackers are using AI to automate the exploitation of weaknesses defenders already understand, meaning the defensive priority remains focused on patching and recognizing known flaws. The shift is not in the *what* of defense (which remains rooted in risk management), but the *how*—it is now faster and easier to deploy attacks that exploit pre-existing knowledge. This dynamic forces a re-evaluation of where the true security advantage lies: whether it is in blocking the attack mechanism entirely, or in mitigating the inherent sloppiness introduced by automated processes. The pattern suggests that technological advancement, when decoupled from foundational skill, introduces systemic entropy into the adversarial environment.
Bridge Questions: If AI primarily exacerbates existing errors rather than creating novel threats, where should defense investment pivot to maximize resilience against this type of incremental degradation? What specific mitigation strategies can effectively counter the "AI slop" introduced across different attack vectors (malware, phishing, exploits)? How does the increased speed provided by AI change the necessary timeline for human-led threat intelligence cycles?