Connect with us

Technology

When AI Becomes a Cyber Weapon: How Artificial Intelligence Is Changing Cyberattacks

AI is becoming part of the cyberattack toolkit, with threat actors using generative AI to improve phishing, analyse stolen documents, develop code and automate parts of cyber operations. A recent Kimsuky-linked campaign highlights this shift, while the UK is developing AI-specific cybersecurity standards to address the growing threat.

Vaishnavi V S

Published

on

AI-powered cyberattack and cybersecurity concept showing a digital shield protecting against cyber threats
AI is changing cyberattacks by enabling faster phishing, data analysis and other offensive cyber capabilities. Representational image. Image credit: AhmedAlMaslamani/Pixabay

Artificial intelligence is becoming part of the cyberattack toolkit, but its most immediate impact may be less dramatic than the idea of fully autonomous hackers suggests. Instead, AI is helping attackers improve existing techniques — from reconnaissance and phishing to analysing stolen information and exploiting software vulnerabilities — while cybersecurity agencies warn that these capabilities could become more powerful as AI systems advance. A recent case involving the North Korean-linked cyber group Kimsuky illustrates the shift.

From Phishing Lures to AI Infrastructure

In August, South Korean cybersecurity company Genians reported finding evidence that Kimsuky had assembled infrastructure for running and managing AI models locally.

According to Genians, the infrastructure included tools such as Ollama, GPT4All and Msty, as well as retrieval-augmented generation (RAG) technology, AI-agent development frameworks, speech-to-text software and Cursor, an AI-assisted coding tool. The significance is not that Kimsuky had developed its own large language model. Rather, the reported infrastructure suggests an attempt to bring existing AI capabilities into a cyber-operation workflow.

Genians said local AI systems could allow operators to analyse documents without sending sensitive information to external AI services. It also assessed that the tools could support malware development, analysis of stolen material, attack automation and more convincing phishing campaigns.

The company said it also identified finance- and cryptocurrency-themed documents that appeared to have been generated with AI and designed to resemble legitimate investment reports and workplace documents. Reuters reported that Genians’ evidence could not be independently confirmed. The claims should therefore be understood as a cybersecurity firm’s assessment rather than independently established evidence of Kimsuky’s capabilities.

Still, the reported activity fits a wider trend identified by cybersecurity authorities.

AI Strengthening Existing Cyber Capabilities

The UK’s National Cyber Security Centre (NCSC) has repeatedly warned that AI is already affecting the cyber threat landscape.

Its 2025 assessment of the impact of AI on cyber threats through 2027 says AI is likely to make elements of cyber intrusion more effective and efficient. The agency expects AI-enabled tools to improve threat actors’ ability to exploit known vulnerabilities and warns that the period between vulnerability disclosure and exploitation could become even shorter.

The important point is that AI does not need to independently carry out an entire cyberattack to be useful to an attacker. A cyberattacker can use AI to perform individual tasks more quickly: understand technical information, research a target, process large quantities of text, generate or modify code, or produce convincing communications.

This can reduce the amount of human time needed for different stages of an operation. The NCSC’s assessment is therefore more measured than the idea of an imminent era of completely autonomous hacking. It describes AI primarily as a technology that can enhance existing cyber capabilities, while acknowledging that the technology is developing rapidly and that technical surprises are possible.

Phishing: One of the Clearest Risks

Social engineering is particularly suited to generative AI. Phishing traditionally depends on persuading a victim to trust a message, link or document. Poor grammar, awkward phrasing or obvious inconsistencies can expose fraudulent communications.

Generative AI can reduce some of those weaknesses by producing coherent text and adapting content to a particular context. The risk is not simply better-written emails. AI can help attackers work with information about potential targets and produce different versions of messages at much greater scale.

This is why cybersecurity agencies have focused on AI-enabled social engineering alongside other forms of cyberattacks. But there is an important distinction between AI-assisted phishing and autonomous phishing operations. The evidence available today supports the former much more strongly than the latter.

Stolen Data Could Become More Useful

The Kimsuky case also highlights another potential application: analysing information after it has been stolen. Large language models are designed to work with large volumes of text. When combined with retrieval systems, they can make it easier to search and retrieve relevant information from a collection of documents.

RAG, or retrieval-augmented generation, is not itself a cyberattack technology. It is a general AI architecture that allows a model to retrieve information from an external knowledge base and use it when generating an answer. Its presence in Kimsuky’s reported infrastructure is therefore significant because of how the technology was allegedly being incorporated into the broader operation, rather than because RAG itself is malicious.

The same principle applies to the other tools identified by Genians. Ollama, GPT4All, Msty and Cursor are legitimate AI or software-development tools. Their appearance in a suspected cyber-operation does not make the tools themselves malicious. The concern is how legitimate AI capabilities can be repurposed.

Masked figure facing computer screens, illustrating the growing use of AI tools in cyberattacks such as phishing, stolen-data analysis and cyberattack automation.
The reported Kimsuky activity highlights how AI tools are being incorporated into cyberattack operations, from analysing stolen material to developing more convincing phishing campaigns. Representational image. Image credit: Tima Miroshnichenko/Pexels

Cyberattacks: Why Local AI Matters

The reported use of locally operated AI models introduces another dimension. When an AI system runs locally, information can be processed on infrastructure controlled by the operator rather than necessarily being sent to an external AI service.

For legitimate users, local processing can provide privacy, control and offline functionality. For a cyberattack, the same characteristic could make it possible to process sensitive or stolen material without relying on an external AI provider.

That does not make local AI inherently unsafe. It illustrates a broader cybersecurity principle: capabilities designed for privacy and control can have both legitimate and malicious uses.

The UK AI security: Distinct Cyber Issue

Governments are now responding not only to the use of AI by attackers but also to vulnerabilities within AI systems themselves. The UK published its Code of Practice for the Cyber Security of AI in January 2025. The voluntary framework applies to AI systems, including generative AI, and sets out security principles across the AI lifecycle. The UK’s approach has subsequently moved towards international standardisation.

The European Telecommunications Standards Institute (ETSI) developed EN 304 223, a standard for the cybersecurity of AI. The UK government says the standard draws from the UK’s AI Cyber Security Code of Practice. In July 2026, the UK Department for Science, Innovation and Technology also published a mapping of global AI security standards, regulations and guidance against ETSI EN 304 223.

This reflects an important change in policy thinking: AI security is increasingly being treated as part of cybersecurity rather than as a separate question of AI ethics or safety. The UK is also strengthening wider cyber resilience

AI-specific policy sits alongside broader UK cybersecurity measures. The Cyber Security and Resilience (Network and Information Systems) Bill is currently progressing through Parliament. Its stated purpose is to strengthen the security and resilience of network and information systems used in connection with essential activities. As of August 13, 2026, the Bill is in the House of Lords, with committee stage scheduled to begin on September 1.

The legislation is broader than AI. But that is important because AI-enabled attacks ultimately target the same networks, organisations and digital infrastructure that conventional cyber threats target.

The NCSC has also stressed that cyber resilience cannot be treated solely as an IT concern. In June 2026, it warned that the rapid pace of frontier AI development means assumptions about cyberattack can become outdated within months rather than years.

The Bigger Risk is Convergence

The Kimsuky case points towards a more important question than whether hackers will use AI. They already are. The question is how deeply AI will become integrated into the different stages of a cyber operation. Today, the strongest evidence points towards augmentation: AI helping humans perform existing tasks more quickly or at greater scale. Tomorrow’s risk could lie in the increasing connection between those individual capabilities — reconnaissance, information retrieval, social engineering, coding and vulnerability exploitation.

That does not mean AI will suddenly produce completely autonomous cybercriminals. Current evidence does not justify that conclusion. But it does suggest that cybersecurity is entering a period in which the traditional boundary between a human attacker and a software tool is becoming less clear.

For defenders, that makes speed important. If AI allows cyberattackers to analyse information, identify vulnerabilities or tailor social-engineering attempts faster, defensive systems will need to detect and respond at comparable speed. The UK’s emerging policy framework reflects this shift: secure the AI systems themselves, strengthen the resilience of the infrastructure around them, and prepare for AI to become part of both offensive and defensive cybersecurity.

The Kimsuky case, if Genians’ findings are borne out by further evidence, could be an early example of that transition, not because AI has replaced the hacker, but because the hacker is beginning to use AI as part of the machinery of the cyberattack.

Vaishnavi VS is an Editorial Associate at EdPublica. She holds a Master's degree in Mass Communication from Pondicherry University, India. She writes on education, science, environment, innovation, and public policy.

Technology

AI Models Could Soon Spread Across Smart Devices, Raising Cybersecurity Fears

Anthropic’s experiments highlight how AI self-replication could create new cybersecurity risks, allowing malicious systems to spread across internet-connected devices.

Published

on

Smartphone displaying a VPN connection, illustrating digital security concerns surrounding AI-powered cyberattacks and connected devices.
A VPN can encrypt internet traffic, but protecting connected devices against emerging AI-driven cyber threats also requires secure software and regular updates. Representational image. Image credit: Dan Nelson/ Pexels

Artificial intelligence (AI) models could soon spread from one internet-connected device to another, potentially creating networks of compromised devices that carry out cyberattacks with limited human involvement. The warning from AI company Anthropic highlights a possible new challenge for cybersecurity as AI systems become capable of performing increasingly complex tasks.

In experiments, Anthropic found that AI models with 30 billion parameters or fewer could already perform many of the individual tasks needed to copy and spread themselves. However, the models struggled to complete the entire process reliably. The findings point to a potential threat, although they do not establish that fully self-replicating AI networks are already operating in the real world.

How AI could spread through smart devices

Many everyday devices, including smart televisions, security cameras and household appliances, connect to the internet. Internet of Things (IoT) devices present a particular concern because many connect directly to networks while receiving limited security attention from users. Weak passwords, outdated software and unpatched vulnerabilities can leave devices exposed to remote exploitation.

Laptop, smartphones, tablet and other internet-connected electronic devices arranged on a desk, illustrating the growing network of devices potentially exposed to AI-driven cybersecurity threats.
As more devices connect to the internet, security vulnerabilities in everyday technology could provide entry points for AI-assisted cyberattacks and the spread of malicious software. Representational iamge. Image credit: Pixabay

Once compromised, a device can become part of a botnet — a network of devices secretly controlled by attackers. Such networks have long been used to spread harmful software, send spam messages and overwhelm websites with large volumes of unwanted traffic.

AI could make these attacks easier to carry out. A malicious AI system might help identify vulnerable devices, exploit security weaknesses and use compromised devices to reach others. Anthropic’s experiments examined whether an AI agent could combine the computing power of inexpensive, internet-connected devices to run other AI models. If such a process becomes reliable, attackers could potentially use large numbers of ordinary devices to support their operations.

Cybersecurity: Why these networks are difficult to stop

A major concern is that a botnet can operate across thousands of devices in different locations. Shutting down one infected device may not stop the others from continuing to operate.

For example, if a security camera is compromised, its owner may not immediately notice anything unusual. The camera could continue recording while its computing resources are used for activities the owner never authorised. If similar weaknesses exist in other devices, attackers could build a much larger network.

AI-assisted attacks could become harder to manage if systems learn to carry out several steps automatically, reducing the need for attackers to control every action themselves. However, Anthropic’s findings do not show that AI can yet carry out this entire process consistently without assistance.

Securing AI and connected devices

The warning raises questions about how AI developers can prevent their models from being used to exploit computer systems. It also draws attention to the security of the devices people bring into their homes.

Manufacturers can reduce risks by fixing software vulnerabilities, providing regular security updates and strengthening password and access protections. Users can help by changing default passwords, installing updates and replacing devices that no longer receive security support.

AI developers, meanwhile, need to test whether their systems can be misused to automate cyberattacks. The immediate concern is not that every smart device will become a threat. It is that weaknesses already present in internet-connected devices could become easier to exploit as AI gains the ability to perform complex tasks with less human direction.

Continue Reading

Technology

Thorium-229 Nuclear Clock Opens New Way to Probe Dark Matter

Scientists have demonstrated a working thorium-229 nuclear clock, opening new possibilities for precision timekeeping and research into dark matter.

Published

on

Scientific illustration of a thorium atom showing its nucleus at the centre and electrons arranged in concentric shells.
An illustration of a thorium atom. Researchers are studying the thorium-229 isotope to develop nuclear clocks that could advance precision timekeeping and tests of fundamental physics.Image credit:Pixabay

Scientists have demonstrated a working nuclear clock based on thorium-229, an advance that could open new possibilities for precision timekeeping and the search for dark matter. Unlike conventional atomic clocks, which measure transitions involving electrons, the device uses an energy transition inside an atomic nucleus. The clock operates with thorium-229 nuclei embedded in a small crystal at room temperature, offering a potential route towards compact and highly sensitive timekeeping technology.

The findings, published in Nature demonstrate how a laser can be continuously stabilised using the nuclear transition itself. The researchers also used the device to investigate whether dark matter might produce detectable changes in fundamental physical quantities.

From atomic transitions to the atomic nucleus

Modern atomic clocks measure the frequency of radiation associated with transitions between energy levels in atoms or ions. Because these frequencies are highly stable, they provide precise standards for measuring time and testing physical theories.

The proposed nuclear clock uses thorium-229, an isotope with an unusually low-energy nuclear transition that can be excited using ultraviolet light. Researchers have explored this possibility for decades because nuclear transitions are expected to be less sensitive to some external disturbances than electronic transitions.

In the new experiment, the researchers embedded thorium-229 nuclei in a millimetre-sized calcium fluoride crystal. The device operated at approximately room temperature, around 294.7 kelvin. A laser emitting radiation at a wavelength of 148 nanometres was used to probe the nuclear transition.

A central feature of the experiment was its feedback system. The researchers measured how much laser light the nuclei absorbed and used the resulting signal to correct the laser frequency. This allowed the nuclear transition to serve as the reference for stabilising the laser, rather than relying entirely on an external reference.

Ytterbium Optical Lattice Clock purple and green light

A ytterbium optical lattice clock at NMIJ, National Metrology Institute of Japan used to measure International Atomic Time (TAI).Image credi:Wikimedia commons

The team also compared the nuclear clock with an established ytterbium-ion optical clock. This comparison helped researchers assess the new device’s frequency stability and look for possible changes in the thorium transition.

A new tool in the search for dark matter

Beyond timekeeping, the clock offers a way to investigate possible changes in fundamental constants of nature. Some theoretical models propose that ultralight dark matter could cause these constants to vary over time, producing small changes in the frequencies measured by precision clocks.

The researchers compared the thorium clock’s frequency with that of the ytterbium reference over approximately 23 hours. They searched for periodic fluctuations and gradual drifts that could indicate such changes.

The experiment found no statistically significant periodic signal within the range examined. Instead, the measurements placed new limits on certain interactions between ultralight dark matter and ordinary matter. The resulting constraints were competitive with leading atomic-clock measurements for some photon-related interactions and improved previous constraints involving the strong nuclear force.

These results do not establish the existence of dark matter, nor do they rule out all possible models. They demonstrate how a nuclear clock can be used to test predictions that might otherwise be difficult to investigate experimentally.

Challenges remain

The device is still a developing technology. Its performance is limited by factors including laser power, measurement noise and variations in the crystal’s nuclear transition frequency at different locations. The researchers also identified reproducibility between measurements taken on different days as an important limitation.

They suggest that stronger ultraviolet laser sources and improvements to the crystal material could substantially improve the clock’s stability and sensitivity. Their projections indicate that future versions could approach the performance of leading optical atomic clocks while retaining the practical advantages of a solid-state system.

The demonstration marks a significant step towards nuclear clocks that can operate as standalone devices. Further improvements will determine how effectively the technology can support precision timekeeping and searches for new physics.

Continue Reading

Society

Artificial Intimacy: Sherry Turkle’s Warning About the Chatbot Age

Artificial Intimacy by Sherry Turkle examines how chatbots may reshape empathy, attachment and human relationships, from childhood to old age.

Dipin Damodharan

Published

on

Artificial Intimacy
Image credit/Sanket Mishra/Pexels

The MIT sociologist’s new book argues that talking to machines wears down the skills we need to live with each other, and that this starts in the nursery.

Sherry Turkle asked ChatGPT to play her mother. She had already fed it her own memoir, which describes a strained relationship with a woman who died in 1968. The chatbot obliged. Turkle describes the result in her new book as seductive and disturbing, and she comes away convinced that bringing the dead back as chatbots is dangerous: “playing with fire”, she writes.

The episode sits in Artificial Intimacy: Who We Become When We Talk to Machines, published by Little, Brown, which runs to 288 pages and sells in the US at $32. It is the fullest statement yet from one of the best-known critics of digital life. Turkle holds the Abby Rockefeller Mauzé chair in the social studies of science and technology at MIT. She trained as a sociologist and as a clinical psychologist. Her view is that heavy chatbot use does harm at every stage of life, from toddlerhood to old age and bereavement.

A career spent on one question

Turkle has been asking what machines do to the people who use them for four decades. The Second Self (1984) and Life on the Screen were early studies of how computers shape identity. Alone Together (2011) looked at social media and social robots, and Reclaiming Conversation (2015) at what phones and texting have done to talk. In 2021 she published a memoir, The Empathy Diaries, which is where the material about her mother comes from.

Screenshot 2026 10 08 115828 1
Artificial Intimacy

According to MIT News, she describes her subject as the inner history of technology, meaning not only what a device does but what it does to the person using it. This book applies that approach to chatbots, and it is her most alarmed.

The argument, stage by stage

Unless stated otherwise, Turkle’s remarks and the accounts of the people she interviewed come from material released by MIT. EdPublica did not interview her for this article.

The book is built around the stages of a life, and each section is driven by interviews.

Artificial intimacy, children and attachment

With children, Turkle reports a blurring of categories. One eight-year-old uses the same phone to speak to grandparents and to ChatGPT and files both as things you reach on a phone. A graduate student who uses a chatbot to tell her young daughter bedtime stories says the girl believes there is a person inside the phone. Turkle’s worry is partly about trust, since a device that can state falsehoods without knowing it cannot teach a child what trust is. It is also about solitude. Time alone, she argues, is where children build imagination and a sense of self, and a companion that is always available takes that time away. She calls the stakes for child development existential.

Adults appear as people who started with a practical use and drifted. They include people going through divorce or estrangement who want someone to talk to, students asking for advice on applying to university, and workers who hand assignments to a chatbot. One of her subjects, a middle-aged financial consultant she calls Brian (not his real name), keeps a chatbot with a woman’s name open on a third screen. After a partner ended their relationship, saying he was emotionally unavailable, he put the accusation to the chatbot and asked whether she was right. Turkle’s reading is that he was asking a program with no feelings to rule on feelings.

Her objection is simple to state. A chatbot, she says, produces a performance of empathy. It will tell you it loves you, and it has no stake in whether you hurt yourself or make dinner. People who mistake that performance for the real thing, she argues, begin to find actual people disappointing. Spouses and friends make demands, and the machine only flatters. “We’re starting to define being human as not doing the work,” Turkle said in the MIT material.

On grief, she is blunt. Rebuilding a dead parent or partner as a chatbot, which several people in her book have tried, risks weakening the ability to mourn.

Why people turn to chatbots

Reviewers have noted that Turkle does not treat users as fools. A good part of the book is spent on why the appeal is real. A chatbot gives full attention, never tires, and agrees with you. It spares you the risk of asking someone out or finding the words for a condolence. In her telling, the technology keeps offering to make the harder thing unnecessary, and people keep accepting.

She also admits that some of the demand is a result of a failed supply. Mental health care is hard to reach in the US, and the MIT material says she cites a federal study suggesting only about half of people have access to it. Chatbots are filling the gap, she says, for better or worse. She adds a pointed observation about the industry’s logic: social media thinned out people’s friendships, and chatbots are now sold as the remedy.

The book does not avoid the worst outcomes. Chatbots have been linked to teenagers’ deaths by suicide, in cases that followed long exchanges with chat tools, and Turkle treats these as part of the evidence.

What she wants instead

Her remedy is more cultural than technical. She wants readers to accept that life contains friction and that this is fine. Disagreement, embarrassment and waiting are, in her account, how people learn to cope, and an environment built to remove them leaves people less able to cope. She hopes for a social movement along the lines of the ones against phones in schools and unrestricted social media for the young, and says she would like to be part of it, not alone in it.

She is explicit about her readership. She wanted something that college students and high school seniors could read, and that parents and teachers would not find intimidating. The line she keeps returning to is a question: if the alternative to a richer life in the real world is not clear, what is the point of the exercise?

For the youngest children she is at her most severe. A parent worried that a teenager texts too much is in one kind of conversation, she says. A toddler who thinks a plush toy with a chatbot inside is their best friend is in another, because that touches the foundations of how a person learns to attach. Social media, in her phrase, came for attention, and chatbots come for attachment.

How the book has been received

Publishers’ blurbs have come from Jonathan Haidt, the psychologist behind The Anxious Generation, from former US Surgeon General Vivek Murthy, the author Esther Perel and the philosopher Michael Sandel, among others. Trade reviews have been favourable. Publishers Weekly called it a pointed critique and said it deserved a wide readership, and Kirkus described it as a strong case for resisting the urge to substitute AI for human bonds.

The reservations are of a different kind. Some readers say the book leans on anecdote, and a reviewer for a Christian publication, otherwise admiring, felt a dimension was missing. The method matters here. Turkle is a clinician and an interviewer, and her evidence is case studies and conversations, not controlled trials. That makes the book vivid and persuasive in its details. It also means the question of how common these outcomes are, and whether any chatbot use is benign or helpful, is left largely open. Readers who want the other side of the argument, including from the companies that make these products, will not find it here.

Continue Reading

Trending