The Evolution of Adversarial AI: Tales from the Frontlines of Threat Intelligence

The integration of Generative AI into the cyber threat landscape is a story of gradual evolution rather than immediate revolution. Moving beyond speculative "super-malware" discourse, current intelligence reveals a nuanced reality: adversaries are maturing and experimenting in lockstep with the industry. This session dissects how state-sponsored APTs and financially motivated actors are professionalizing their operations, drawing from our direct, firsthand visibility into thousands of prompts observed on the frontlines.

We explore how actors leverage Large Language Models (LLMs) not to invent entirely novel attack vectors, but to refine the quality, scale, and efficiency of existing tactics like social engineering, reconnaissance, and malware development. To do this we share insights into firsthand observations of use cases "in the wild" from 2024 through 2026. These use-cases illustrate relevant trends such as the shift toward autonomous operations and the first attempts to develop malware with "just-in-time" code modification.

The presentation further examines the underground ecosystem, and the rise of tools to weaponize capabilities. We also address large-scale attacks against models, such as sophisticated prompt injections designed for guardrail bypasses. With this talk we expect to help equip defenders with baseline knowledge about how actors are factually using AI to support adversarial operations and to share some insights on what to do about it.