The generative AI boom has transformed cybersecurity, acting as a force multiplier for attackers. Anyone with access to LLMs now has a tireless black hat hacker on payroll, democratizing cybercrime. Attacks that once took weeks can now be completed in an afternoon, and criminals often run multiple AI sessions simultaneously. For instance, a February attack on Mexican government databases used outputs fed between Claude and ChatGPT.

Social engineering has been supercharged. AI eliminates grammar errors in phishing emails, and spear phishing becomes trivial as chatbots research victims and strike up pretextual correspondence. According to Brightside, 82% of phishing emails now use AI, with clickthrough rates jumping from 12% to 52%. Voice clone and deepfake attacks spiked by 442% and 680% respectively between 2023 and 2024.

AI also creates new attack surfaces. Prompt injection attacks hide malicious instructions in websites, tricking AI systems into leaking data or promoting products. In December 2025, Meta's AI support assistant allowed attackers to associate any email with an Instagram account, enabling easy hacks. OpenAI admitted that fully defending against prompt injection may be impossible, urging caution in tying sensitive systems to AI.

Defenders are deploying AI solutions, but cybersecurity remains asymmetrical—attackers only need one vulnerability. The proliferation of zero-day flaws, which AI excels at finding, underscores the urgent challenge. As AI evolves, the race between offense and defense grows ever more precarious.