AI increasingly embedded in real-world hacking operations

Hackers are rapidly advancing the use of artificial intelligence (AI) in cyberattacks, transforming how digital threats are planned and executed, according to a new report from Google’s security researchers.

The findings, published by Google’s Threat Intelligence Group (GTIG), show that both state-backed and financially motivated cybercriminals are integrating AI tools into multiple stages of hacking operations from reconnaissance and phishing to malware development and vulnerability discovery.

Google says the trend does not yet represent a fully autonomous “AI hacking revolution,” but rather an accelerating evolution where AI is being used as a powerful support tool to improve efficiency and scale.

AI used across the entire attack chain

Researchers found that hackers are increasingly using AI models to assist in nearly every phase of a cyberattack, including:

• Identifying and profiling targets
• Writing phishing emails and social engineering messages
• Translating and localising content for victims
• Assisting in coding malicious tools
• Testing vulnerabilities in software systems
• Debugging malware when attacks fail

According to Google, this widespread use of AI has allowed threat actors to speed up the “attack lifecycle,” making operations more efficient even if they are not fundamentally changing hacking techniques.

State-backed groups among the most active users

The report highlights that advanced persistent threat (APT) groups linked to countries including China, Russia, Iran and North Korea are among the most active adopters of AI-enabled hacking methods.

These groups are using AI tools such as large language models to support intelligence gathering, automate phishing campaigns, and refine malware development workflows.

Google noted that in many cases, AI is not replacing human hackers but acting as a “force multiplier,” reducing the time needed for complex tasks and enabling attackers to scale operations more efficiently.

No “breakthrough” AI cyberweapon yet, but risks growing

Despite the growing adoption, Google stressed that it has not yet observed AI producing fully autonomous cyberattacks or breakthrough offensive capabilities that fundamentally change the cyber threat landscape.

Instead, most observed activity involves experimentation and gradual integration of AI into existing hacking workflows.

However, experts warn that this transitional phase could still significantly increase global cyber risk, especially as tools become more accessible and easier to misuse.

Concerns over future autonomous attacks

Security analysts say the biggest concern is not current use, but what comes next particularly the possibility of AI systems being used to independently discover vulnerabilities and deploy exploits without human intervention.

Recent incidents flagged by researchers suggest early signs of AI-assisted vulnerability discovery and automated attack planning, raising fears that cybercrime could become faster, more scalable and harder to detect in the future.

Governments and tech firms respond

In response to rising threats, major technology companies, including Google, have tightened safeguards around their AI systems and restricted access for known malicious actors.

At the same time, governments in the U.S. and Europe are increasing cooperation with AI firms to evaluate security risks before new models are released, as concerns grow over dual-use technologies being exploited for cybercrime.

A shifting cybersecurity landscape

The report concludes that AI has already become a standard tool in modern cybercrime operations, even if its full potential has not yet been realised.

As hackers continue to refine how they use AI, security experts warn that the gap between offensive and defensive capabilities could widen forcing governments and companies to adopt equally advanced AI-driven defence systems.

For now, the message from Google is clear: AI is not just reshaping innovation in technology it is also reshaping the future battlefield of cybersecurity.

________________________________________________________________________________________________________________