A sober response to AI hacking headlines is to focus on resilience

In short: AI is making common cyberattacks faster and easier, so organizations should treat scary headlines as a cue to improve basic defenses.

What's going on

Many recent stories about “AI hacks” sound like something totally new, but the reality is more ordinary. Attackers are mostly using AI to speed up steps they already did before, like finding weak spots in systems, writing convincing phishing emails, and changing malware so it is harder to spot.

Phishing is a good example. AI can write messages that look professional and personal, with fewer obvious mistakes. That raises the odds that someone clicks a link or shares a password, even if they have had basic training.

Another example is “polymorphic malware”, which is harmful software that keeps changing its appearance while doing the same bad job (like a thief who keeps changing outfits). This can make older security tools less effective because those tools often look for known patterns.

AI also lowers the barrier for less skilled attackers. Some AI models can be run on a person’s own computer, which can help them plan and run an attack with simple written instructions.

What to watch

A practical “so what?” response is to plan for this as the new normal, not as a one off shock. That means faster patching of software updates, better checks for money transfers and account changes, and training that assumes phishing emails can look perfect. It also means protecting AI tools themselves from “prompt injection”, which is when someone writes input designed to trick an AI into ignoring rules (like slipping bad instructions into a request). Tools and data access should be limited so an AI system cannot do more than it needs.

Source: NYTimes