security · 28 Oct 2026

How AI-Powered Cyberattacks Are Changing Online Security

Polished phishing, cloned voices and tool-using AI are changing parts of the threat landscape. What documented evidence shows—and what US households and businesses can do without buying into the hype.

By Felix Albuerne Jr.

Editorial illustration of a laptop with branching message connections beside a phone and a physical security key. — Generated editorial illustration, not a screenshot of an attack or evidence of a specific incident.

An email arrives from what looks like a regular supplier. The wording is clean, the timing makes sense, and the message refers to a project your team actually works on. A follow-up call sounds reassuringly familiar. The request is simple: use new bank details for the next payment. None of those details establishes that the request is genuine.

That is the practical problem behind AI-powered cyberattacks. Generative AI can help criminals write persuasive messages, imitate voices, research targets and work through technical tasks. It can also create new weaknesses when businesses connect AI assistants to sensitive information or give them authority to take actions. The change is not that every scam has become sophisticated. It is that some of the work needed to make a scam convincing has become easier to reproduce.

The useful security response is to rely less on how authentic a message feels and more on whether the request can be independently verified. For American households, that means stronger account protection and a dependable way to check urgent requests. For businesses, it means controlling payments, identities, access and recovery—not simply buying a product with AI in its name.

This is an analysis of public threat reporting and security guidance, not an investigation of a new breach. Provider reports describe activity visible to those providers; government assessments also include forecasts. Neither is a census of all attacks, and this article does not offer a percentage of US cybercrime caused by AI.

What counts as an AI-powered cyberattack?

The label covers several different situations. In an AI-assisted attack, a person uses a model for tasks such as drafting a fraudulent message, translating a lure or explaining code. In a more agentic operation, software can carry out a sequence of steps with tools and feedback, while people may still choose the target, provide access or approve important actions. Separately, an attack against an AI system tries to exploit the model's access to data or tools.

Those categories should not be collapsed into a claim that an autonomous machine independently hacked an organization. A model writing a script is not proof that the script worked. An attempted intrusion is not a confirmed compromise. And using AI somewhere in a criminal workflow does not mean that AI caused the eventual loss.

The older routes into accounts remain relevant: stolen credentials, misleading login pages, unpatched software, unsafe configurations and social engineering. AI can help an attacker along those routes. It does not need to invent an entirely new vulnerability to matter.

1. Phishing no longer has to look badly written

A polished email used to be one small reason to feel less suspicious. It was never reliable authentication, and generative AI makes it less useful still. A criminal can ask a tool to rewrite a message in natural business English, adjust its tone or translate it for another audience. Public information about a company can supply plausible context.

The FBI's December 2024 public warning describes criminals using generative AI for fraud, including text that makes social-engineering messages more convincing. Google's January 2025 threat report also describes malicious actors using Gemini for activities such as research, translation and content generation. These are documented uses or agency warnings; they do not establish that every well-written phishing message was AI-generated.

For users, the actionable test is the request itself. Does it ask you to sign in through an unexpected link, send a verification code, change payment details or open an attachment you were not expecting? Open the service through its official app or a previously saved address. Contact the sender through a number or channel you already trust, not the contact details supplied in the suspicious message.

A colleague's real email account can also be compromised. A familiar address therefore does not settle a high-risk request. Businesses need a procedure for changes to bank details even when the email appears to come from a long-standing partner. Read our phishing guide for a broader message-checking routine.

2. A familiar voice is not proof of identity

The FBI warning also describes AI-generated audio used to impersonate people and make fraudulent requests. A caller can claim to be a relative in distress, a manager authorizing a payment or an employee seeking help from an IT desk. A convincing voice adds emotional pressure to a familiar scam structure.

That does not mean every voice clone is flawless or every attack needs one. Connection quality, available recordings and the circumstances of the conversation can affect plausibility. But the defense should not depend on a listener spotting a synthetic sound. A real person can also lie, and an authentic recording can be presented misleadingly.

For a supposed family emergency, hang up and call your relative using a known number. If you cannot reach them, contact another trusted person before sending money. A family verification phrase can be an extra check, but it should not replace independent contact, especially if the phrase might have been exposed.

For work, an unexpected call or video meeting must not override payment rules. Require a second approver and a separate verified channel for a new recipient or changed account. IT support should not reset a privileged account solely because a caller sounds like the employee. The goal is a process that still works when imitation is good.

3. Attackers can use AI as a research and coding assistant

Not all misuse is visible to the victim. Models can help interpret technical documentation, summarize information, draft code or troubleshoot errors. Google's threat reporting and Microsoft and OpenAI's February 2024 account of state-affiliated actors describe this kind of operational assistance.

There is an important boundary between making a task easier and demonstrating a successful end-to-end attack. OpenAI's February 2024 report, produced with Microsoft, characterized the models' contribution to malicious cyber tasks as limited and incremental. Google's January 2025 report similarly did not find the new capabilities that its examined actors appeared to be seeking. Those findings apply to the periods and services examined; they are not a guarantee about every model or future operation.

The UK National Cyber Security Centre's January 2024 assessment warned that AI would likely increase the volume and impact of cyberattacks over the following two years, including by lowering barriers for some activities. That was a forward-looking assessment, not a measured increase attributable to AI. Its relevance is the direction of the risk: routine work can become cheaper even when the underlying intrusion method is familiar.

For defenders, the implications are practical. Keep internet-facing systems inventoried and updated, remove unused access, and watch for account behavior that does not fit the user's role. The attacker does not need perfect AI if an abandoned administrator account or an exposed service already supplies the opening.

What a reported extortion case adds to the picture

In its August 2025 misuse report, Anthropic described a data-extortion operation in which an actor used Claude Code to assist offensive work. The company also reported cases involving fraudulent employment activity and ransomware development. These accounts go beyond a general warning: they describe misuse the provider says it investigated.

The attribution matters. These are Anthropic's findings, not a PrimetimeGeek forensic investigation or an independently audited measurement of autonomous attack success. They do not show that every step ran without a person, that all attempted actions succeeded, or that comparable outcomes were impossible without AI. They do show why defenders should evaluate the actions an attacker can automate, rather than assume misuse stops at writing emails.

A useful incident report should identify the initial access route, what the model actually did, what a person supplied, the outcome and the defensive controls that failed. Without those details, the word “agent” can make an ordinary intrusion sound more autonomous than the evidence supports.

4. AI assistants introduce a separate security boundary

An organization can face AI-related risk even if the attacker never uses a model. Consider an assistant that reads external web pages or email and can also search internal documents. Untrusted material may contain instructions designed to redirect the assistant: disclose information, ignore the user's request or call a tool in an unintended way. This is the core concern behind prompt injection.

OWASP identifies prompt injection as a major risk for applications using large language models. The difficulty is that the system processes both instructions and outside content through language. A malicious instruction embedded in material the assistant reads can be mistaken for something to obey. A warning in the prompt is not, by itself, a dependable security boundary.

The consequences depend on what the assistant can reach. A tool that only summarizes public text has a different risk profile from one that can read confidential files, send messages, change records or initiate payments. Restricting those capabilities outside the model—through permissions and application controls—limits the damage when the model makes a bad decision.

Treat external content as untrusted data, keep sensitive credentials out of model-visible material, and require human approval for consequential actions. An approval screen should show the actual recipient, amount or record change, not merely ask whether the user trusts the assistant. Our AI-agent evaluation guide explains why a small pilot and controlled access matter more than an impressive demonstration.

What Americans should change first

Protect the accounts that can unlock other accounts. Email deserves early attention because password-reset messages often arrive there. Use a unique password from a password manager where passkeys are unavailable, and enable the strongest supported second factor. CISA calls phishing-resistant multifactor authentication the gold standard; passkeys and appropriately deployed security keys can avoid sending a reusable secret to an impostor website.

That protection is not universal insurance. Account recovery, already stolen sessions, compromised devices and an authorized user's mistaken action can still create risk. Keep recovery information current and store backup codes securely. If a service only supports a weaker second factor, using it is generally better than leaving the account protected by a password alone.

Make a verification rule before an emergency. Unexpected requests for money, credentials, security codes or remote access should trigger an independent check. The rule needs to work when you are tired, worried or rushed. A known number, an official app and another trusted person are more dependable than analyzing every word of a convincing message.

Keep devices updated and keep recoverable copies of important data. AI does not make patching or backups obsolete. It makes neglecting those controls harder to justify. A backup should include a copy that an attacker who controls your everyday account cannot simply erase; test restoring a few files before you need them in a crisis.

Do not treat an AI detector as an identity check. A tool's judgment that a message or recording is synthetic does not establish who sent it; a judgment that it is authentic does not establish that the request is safe. Use content analysis as one input, not permission to transfer money or surrender access.

A practical checklist for US small businesses

Small companies do not need to predict the next model release to improve their position. Start with the places where a plausible request could produce an irreversible result.

1. Map consequential actions. Identify who can approve payments, change payroll details, reset accounts, export customer records and grant administrator access. Name a backup owner for each process.

2. Put independent checks around money and identity. Verify new bank details using a previously established contact, and require a separate approver for sensitive changes. Define a help-desk identity check that cannot be satisfied by voice familiarity alone.

3. Strengthen sign-in and recovery. Prioritize phishing-resistant authentication for administrators, email and finance accounts. Review recovery methods and remove access promptly when people leave.

4. Limit what AI tools can do. Approve tools before connecting them to company information. Start with read-only access where possible; restrict data and actions by role. A model should not receive more authority simply because it handles natural language.

5. Maintain the ordinary controls. Track devices and software, apply updates, preserve useful logs and test restoration. External security providers can help, but responsibilities and escalation contacts should be explicit.

6. Practice reporting without blame. Staff should know where to report a suspicious message and whom to contact after a mistaken click. Reward early reporting rather than making employees hide a problem because the email looked convincing.

7. Test the process, not only employee suspicion. Run a tabletop scenario involving changed payment details, a fake executive call or an AI assistant encountering hostile content. Check whether approval and access controls stop the action even when someone initially believes the request.

These are editorial priorities informed by the cited guidance, not a certification checklist or a promise that a company implementing them cannot be breached.

What to do if the attack has already started

If you sent money, contact your bank or payment provider immediately using its official fraud channel and explain what happened. Ask about available recall or reversal options; recovery is not guaranteed. Report suspected internet crime to the FBI's Internet Crime Complaint Center at IC3.gov, and use the FTC's ReportFraud.ftc.gov for applicable consumer fraud reporting.

If you entered a password on a suspicious site, go directly to the real service, change the password, review recovery details and revoke unfamiliar sessions or app access where the service allows it. Change reused passwords elsewhere. For a work account, notify the security or IT team immediately so it can investigate activity beyond the one account.

If you installed unexpected software or granted remote access, stop using that device for sensitive transactions and seek trusted technical help. In a workplace incident, follow the response plan and preserve evidence. Do not improvise a wholesale deletion that might destroy the information responders need. Save the message, relevant timestamps and transaction details without spreading sensitive information further.

What the evidence does not establish

Public reports are incomplete. Security vendors see activity on their own services and customer networks; criminals may move to other tools or conceal how they worked. Government warnings describe risks and reported patterns but do not always provide a denominator that would let readers measure prevalence.

An increase in fraud losses cannot automatically be attributed to generative AI. Funding for an AI-security startup does not prove its product catches these attacks. And a laboratory demonstration of an agent completing technical steps does not show how reliably it will compromise a real, defended organization.

The defensible conclusion is narrower and still important: AI can assist deception and technical work, while AI-enabled applications create additional access-control problems. The exact contribution to overall losses, the reliability of autonomous attacks and the effectiveness of specific defensive products require evidence beyond a dramatic example.

The bottom line: trust a verified process, not a convincing performance

AI is changing online security by making some forms of persuasion and preparation easier to produce, and by placing new software intermediaries between people and valuable information. It does not remove the need for a target, an opening or a consequential action.

That gives defenders useful leverage. A polished email cannot approve its own payment. A cloned voice should not reset its own account. An assistant reading a hostile page should not inherit unrestricted authority over company systems. Strong sign-in, independent verification, limited permissions and tested recovery remain the controls that matter when the imitation becomes harder to notice.