How artificial intelligence changed the very nature of cyber threats
In January 2024, a single video conference cost a large British engineering company $25 million. A finance manager received an invitation to an urgent online call. On the screen were familiar faces: the chief financial officer and several senior executives. They looked and sounded like real colleagues.
The subject was a confidential deal. Time was short. He was asked to carry out a series of transactions. The money went to several accounts in Hong Kong.
A week later it emerged that none of the real executives had been on the call. Everyone on the screen turned out to be a deepfake — a synthetic likeness created with artificial intelligence.
It was not an experiment or a technology demo. It was a real attack, carefully planned and executed.
When attacks stopped being expensive
For a long time, cyberattacks fell into two types.
The first were primitive: phishing, malicious attachments, publicly available scripts. The second were complex and costly operations that took months of work and a team of experienced specialists.
Artificial intelligence broke down that division.
In one research experiment, an autonomous AI agent was fed hundreds of public vulnerability descriptions from the CVE database. Working exploits were produced for more than half of them with no human involvement. The average cost of generating one exploit was less than three dollars.
The barrier to entry into cybercrime has disappeared. At the same time, the quality of attacks has grown many times over.
Deepfakes as a tool for exploiting trust
The British company’s case is no exception. According to industry reports, the number of deepfake attacks has grown by more than 2,000% in recent years.
In April 2023, a businessman in the Chinese city of Baotou transferred 4.3 million yuan, more than $600,000, after a video call with a man he took for a friend. The caller’s face had been swapped using AI. The bank managed to freeze most of the money.
In the US, an 82-year-old pensioner lost almost $700,000 of his savings after seeing an advert featuring “Elon Musk”, supposedly offering an exclusive investment opportunity. The video looked convincing. The money could not be recovered.
These cases have one thing in common: the victims did not doubt that what was happening was genuine. A deepfake works not by hacking systems but by hacking trust.
Money is not the main target
It is dangerous to think that such attacks only threaten people who control large sums. Access is far more valuable to attackers.
Developers, administrators and DevOps engineers hold the keys to production systems, cloud consoles, databases, APIs and source code. The attack scenarios look mundane: an urgent call from the “CTO”, a message from the “team lead”, a video call with a “DevOps colleague” asking you to grant access temporarily or to change credentials urgently.
Stolen access is sold on underground markets, and access to a large company can fetch tens of thousands of dollars or more. But its real value lies in the consequences: encrypted infrastructure, leaked customer databases, stolen intellectual property, a business brought to a halt.
Autonomous attacks: no human required
Modern AI systems can automate almost the entire attack cycle. Such agents independently choose targets, analyse public data about companies, probe infrastructure, find vulnerabilities, and generate and adapt exploits.
In September 2025, Anthropic uncovered a campaign in which an AI agent carried out 80–90% of the tactical work. A human intervened only at certain points. There were around 30 targets: large technology companies, financial institutions, chemical manufacturers and government agencies in various countries. Only a few of the intrusions succeeded.
Research projects have already demonstrated ransomware that uses local language models to decide in real time which files to search for, copy or encrypt. This is not theory — these are working prototypes.
A new vector: attacks on AI systems themselves
The widespread adoption of language models has created a new class of vulnerabilities. Prompt injection, role-play manipulation and logic traps make it possible to force a model to perform actions it was not designed for.
In one study, hidden instructions embedded in medical images led the model to wrong conclusions in a significant share of cases. In medicine, mistakes like that can cost lives.
If a model is fine-tuned on user data, attackers can gradually change its behaviour by injecting “poisoned” examples.
The real consequences of a single mistake
The history of cybersecurity already shows where ignoring basic principles leads:
- the Mirai botnet, which exploited the default passwords of IoT devices, took down the DNS provider Dyn in 2016, leaving Twitter, Netflix and other major services unreachable in the US for several hours;
- a backdoor that an attacker spent years planting in the XZ library could, in 2024, have opened remote access to millions of Linux servers, and it was discovered by chance;
- a lack of separation of duties allowed employees to steal millions of dollars from financial institutions;
- errors in access-rights checks led to leaks of hundreds of millions of confidential documents.
In all these cases, the attack started with something small.
Why “bolting on security later” no longer works
The traditional approach, in which security is added after development, is no longer viable. Artificial intelligence generates exploits faster than teams can release patches. One person with an autonomous agent can attack thousands of targets at once.
On top of that, AI finds non-obvious chains of vulnerabilities — combinations of small problems that look harmless on their own but together give full control over a system.
Security by Design as the new norm
The only sustainable answer is security built into a system’s architecture from the very start.
Least privilege, defence in depth, failing securely, simplicity, separation of duties and secure defaults are not theoretical principles but practical measures proven by real incidents.
Security can no longer be a separate stage. It has to be the default state of the system.
The world after trust
We live in a reality where a working exploit costs less than a cup of coffee, where a deepfake cannot be told apart from a real person, and where autonomous agents attack infrastructure around the clock.
Under these conditions, trust stops being a basic assumption. Any urgent request for access, data or money needs to be verified through an alternative channel. This is not paranoia — it is the new operational reality.
Cybersecurity is no longer the job of a separate team. It starts with architecture, continues in the code and ends in the everyday decisions of every person who works with critical systems.
Useful articles and discussion here (chat in Russian)
Basic protection for a team
The minimum that reduces risk: separate access rights, multi-factor authentication, backups and a rule against pasting secrets into public models. For AI tools, add an activity log and a procedure for revoking access.
