Cybersecurity experts argue AI hype overshadows real threat landscape

Despite recent high-profile incidents, such as the hacking of six Korean banks involving the open-source AI tool Artex and various LLMs, cybersecurity professionals caution against excessive alarm regarding AI-powered attacks. Adam Meyers, head of counter-adversary operations at CrowdStrike, noted that while AI increases speed and volume, it has not introduced fundamentally new exploit paths, suggesting the panic is misplaced. Ciaran Martin, former head of the U.K.’s National Cyber Security Centre, contends that AI developers have focused too much on theoretical capabilities, failing to grasp the motivations and sociology of actual threat actors. Eerke Boiten, a cybersecurity professor at De Montfort University, observes that while AI accelerates vulnerability discovery, exploitation capabilities are not advancing at the same rate, straining security teams. Meyers also criticized the industry's over-reliance on the Common Vulnerability Scoring System (CVSS), citing the PHP2Shell vulnerabilities (rated 9.2) as an example where exploitation was complex. He advocates for prioritizing evidence of active exploitation over severity scores. Furthermore, Meyers suggested that frontier AI companies may be intentionally stoking fear to benefit their commercial and regulatory interests.