Experts say AI speeds attacks without changing core techniques
Original title: How AI is changing the nature of cyberattacks
Cited cases include a 2025 Claude Code espionage campaign and JadePuffer ransomware via a Langflow flaw.
Security experts told CSO Online that AI raises the speed, scale, and cost of attacks but leaves objectives and techniques such as phishing, malware, and vulnerability exploitation unchanged. They point to Chinese state-sponsored abuse of Claude Code in the September 2025 GTG-1002 campaign and to JadePuffer, disclosed in July 2026, where an LLM agent automated much of an intrusion that began with CVE-2025-3248 in Langflow. Researchers also describe shorter dwell time and “agentic APT” workflows, while Checkmarx calls tying attacks to specific models speculative.
Unconfirmed: Claims that attacks are becoming fully autonomous, and which models attackers use, are expert assertions rather than confirmed findings.
- Black Duck’s Ronald Lewis says volume and velocity changed, not the attack chain.
- JadePuffer looted cloud credentials and API keys from internet-facing Langflow, then encrypted databases.
- UnderDefense says attackers favor GLM and Kimi 3 over more restricted Western models.
- Checkmarx’s Darren Meyer says public model attribution is usually thin speculation.
- Products
- LangflowClaude Code
- Malware
- JadePuffer
- Organizations
- Black DuckCheckmarxSysdigUnderDefense
- Countries
- China
From the original article
5 min read at csoonline.com
AI may be helping cyberattackers increase the speed and scale of their operations, but it is not yet changing their core objectives or the techniques they employ as part of their attack chains.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.