What Should We Learn From How Attackers Leveraged AI in 2025?

What Should We Learn From How Attackers Leveraged AI in 2025? argues that the most effective attacks still rely on the same fundamentals as years past, but attackers now execute them with greater efficiency thanks to AI. The piece highlights the continued prominence of supply-chain abuse, citing the Shai Hulud NPM campaign as an example of how a single compromised package can cascade through thousands of downstream projects, and notes that some attacks may be carried out by lean, one-person operations.

It also points to phishing as a perennial weakness, with recent incidents showing large pools of downloads being poisoned before mitigations catch up. The article asserts that attackers have not abandoned their old playbooks; instead they have automated them and performed them with a fraction of the resources, roughly one-tenth, prompting defenders to prioritise basics over shiny new strategies.

According to OX, the recommended focus is to fix permissions models, harden supply chain verification, and make phishing-resistant authentication the default, emphasising that the fundamentals matter more now than ever.