Proofpoint Researcher Says AI Can Weaken Cyber-Attacks

Proofpoint principal threat researcher Selena Larson said at IRISSCON 2026 in Dublin on 11 November that AI has not substantially changed the cyber threat landscape and can make attacks less effective when criminals rely on it too heavily. Proofpoint has found AI-generated malware with code that fails to work as intended, or comments that describe actions the malware does not perform.

Larson cited phishing campaigns by TA4903, a group known for business email compromise and impersonating US government entities. Since adopting AI tools, its email lures have often mismatched their subject lines and attachments, or had blank message bodies. AI-built phishing websites have also tended to be simple and similar in appearance, making them easier to spot. Larson said polished, region-specific language can make messages less convincing because real people often make spelling and grammar mistakes.

AI-generated exploits can also be flawed, she said. In the BlueMoon exploit chain, first observed in August 2026, threat actors used large language models and information from patch notes to write exploits targeting three Microsoft Chrome browser vulnerabilities. The exploits often behaved unpredictably and generated noise that made attempts easier for defenders to identify.

Larson said AI can speed up attackers’ work, including exploiting known vulnerabilities, but does not automatically make their campaigns more sophisticated; she said core cyber defence remains unchanged.