Proofpoint researcher says AI overreliance produces weaker cyber attacks

Proofpoint threat researcher Selena Larson said at IRISSCON 2026 in Dublin, Ireland, on November 11, 2026, that AI has not significantly altered the cyber threat landscape and has often made attacks less effective. She described AI as a productivity tool that alone does not make threat actor campaigns more sophisticated.

Cybercriminals have adopted AI tools for malicious campaigns over the past few years, Larson said. The technology lets threat actors increase the speed and scale of campaigns, but overreliance causes frequent errors that she described as AI slop. Proofpoint has found AI-generated malware that contains nonworking code, along with comments describing behavior unlike what the code actually does.notes: F3/F4/F5, all attributed to Larson/Proofpoint via Infosecurity Magazine.

Proofpoint tracks TA4903, a group behind business email compromise and phishing campaigns, according to Larson. Before turning to AI, the group pretended to be U.S. government bodies while targeting organizations in several sectors with sophisticated lures. Lure quality has fallen since the group started using AI tools, she said. AI-written e-mails observed by Proofpoint over the past year sometimes have a subject line that does not match the attachment, and message bodies are occasionally blank.notes: F6/F7/F8/S1; each fact stated once, source named once per paragraph.

TA4903 mainly constructs phishing websites with AI coding tools now, Larson said. The sites tend to be simple, with matching colors and formatting that makes them easier to spot. She said using AI to fix grammar and spelling for particular regions can make phishing lures less convincing.notes: F10/F11/S1.

She said AI can find and exploit vulnerabilities quickly, but exploits written by AI often have major weaknesses compared with human-driven work. She cited the BlueMoon exploit chain, first seen in August 2026, which links three vulnerabilities in the Microsoft Chrome browser. The BlueMoon exploits were written with large language models, AI systems that generate text, using details from patch release notes, she said. Defenders could easily identify the resulting code: it was deeply flawed, acted unpredictably, and created noticeable noise.notes: F13/F14/F15/S1; LLM given a plain-language explanation on first use.

She said the main change is that AI lets attackers take advantage of known vulnerabilities faster and more easily. Cyber defense stays fundamentally unchanged, she said.notes: F19/S1; defense impact addressed without speculation.

IRISSCON 2026 is an annual cybercrime conference organized by IRISSCERT, and it was held at Dublin’s Aviva Stadium on November 11, 2026. At the event, Proofpoint threat researcher Selena Larson discussed generative AI use in email-borne attacks.notes: F20/S3; conference context supports where Larson spoke.