Generative AI is fueling low-level cybercrime. Spam and scams are everywhere. But the sophisticated “superhackers” security experts warned about? They haven’t materialized. That’s according to a new study from Cambridge University.
Researchers analyzed nearly 100,000 underground forum threads. They found AI tools marketed for malicious hacking are mostly ineffective. Criminals are using the technology for mundane fraud at scale. Nothing groundbreaking.
The study’s titled “Stand-Alone Complex or Vibercrime?” It examined 97,895 forum threads from the CrimeBB dataset. Researchers manually inspected more than 3,200 posts after ChatGPT’s 2022 launch.
Only 1.9% of posts involved AI-related crime. Most focused on generating spam content. Phishing copy. Explicit images. Not advanced malware or exploits.
“Dark AI” products promised big things. WormGPT was supposed to help criminals bypass mainstream AI safety guardrails. It flopped. Hard.
Forum users complained constantly. These tools were ineffective marketing stunts. They offered no advantages over jailbroken versions of mainstream chatbots. Even skilled hackers who use AI coding assistants treat them like autocomplete tools. Think Stack Overflow replacements. Not revolutionary hacking aids.
“Rather than enabling autonomous cybercrime networks, AI currently boosts petty scams more than elite hacking,” the Cambridge study concluded.
AI does show impact at the bottom tier of online crime. Scammers use large language models to mass-produce SEO blog spam. Cheap eBooks. Romance scam scripts. Phishing messages. Image and voice generation tools support “eWhoring” operations. Services offer fake nude images of targets for roughly a dollar each.
These activities mirror older spam and fraud operations. But AI’s ability to generate high volumes of content changes the game. Cheaply. Quickly.
The research suggests AI guardrails are surprisingly effective. Major providers implemented them. Jailbreaks break quickly. Open-source models remain clunky for criminal purposes.
Low-skilled criminals still rely heavily on existing script libraries. Forum users warned that AI-generated code can be insecure. Overreliance erodes genuine programming skills.
The study does flag a longer-term concern. AI could displace legitimate software developers from the job market. Some may migrate to underground forums seeking income. That influx of technical expertise could gradually professionalize parts of the cybercrime economy.
Right now those operations work at low sophistication levels. Today’s petty scams could become tomorrow’s more capable operations. That’s the real risk.
