The cyber threat intelligence assumptions adversary AI is already breaking

In August 2025, malware distributed via a compromised npm package used victims' own locally installed AI tools, including Claude and Gemini, to generate commands for stealing authentication credentials and cryptocurrency assets. The adversary brought no AI of their own. They used yours.

That single case illustrates why the standard framing of AI in security, focused almost entirely on how defenders can use AI to move faster, is missing half the picture. Adversaries have the same access, and documented 2025 activity shows they are already operationalising it across three distinct patterns.PROMPTFLUX, documented by Google's Threat Intelligence Group in November 2025, calls the Gemini API during execution to rewrite and re-obfuscate its own VBScript source code in real time, defeating static signature detection without any human involvement after deployment. 

UTA0388, a China-aligned actor documented by Volexity and confirmed by OpenAI's own October 2025 threat disruption report, used ChatGPT to generate multilingual spear phishing lures across five languages at a volume and tempo no human team could sustain. And the npm campaign documented by CrowdStrike represents a third category entirely: an adversary that skips deploying AI and instead recruits the defender's own installed tooling from inside the compromised environment.

Three actors. Three different uses of AI. And three sets of CTI assumptions that no longer hold in the way they did.

This session examines what those assumptions are, why they are breaking, and what analysts and detection engineers need to do differently. It also makes the case for what has not changed: behavioural detection, infrastructure analysis, and campaign-level correlation remain effective precisely because they do not depend on the artefacts AI erases. 

The analysts who adapt best will not be those who understand AI the most, but those who understand adversary tradecraft well enough to know which of their tools still work and which do not. AI is not a future threat. This session is for practitioners who want evidence, not commentary.