Policy Implications of State-backed APTs’ Use of AI in Cyberspace

Recent confirmations by Google and OpenAI reveal that state-backed APT groups are increasingly employing AI tools—such as Gemini and ChatGPT—to expedite reconnaissance, malware development, and influence operations. AI-tools have the capabilities to discover zero-days.

Current evidence indicates that several state-sponsored APT groups utilize AI-tools to enhance cyber espionage, phishing, and influence campaigns. Certain threat actors are reportedly employing generative AI for targeted reconnaissance on critical installations, scripting automated attacks, and establishing persistent post-compromise footholds. Similarly, some groups have been observed fabricating job applications to infiltrate organizations under false identities. In contrast, other adversaries, while exploring AI-enhanced malware modification and encryption techniques, appear to engage less with externally developed AI tools—likely due to heightened operational security considerations.

These trends underscore two critical implications. First, the integration of AI in cyberspace operations reduces the necessity for advanced coding skills, thereby lowering the technical threshold for adversaries and enabling rapid adaptation of malware. Second, the ongoing challenges of jailbreaking AI models—demonstrated in security assessments of certain systems—pose significant risks that warrant immediate attention.

Threat actors seeking to exploit AI tools to advance their strategic objectives should not come as a surprise to policymakers or technology leaders. While AI tools are likely to increase both the pace and sophistication of cyberattacks, it is imperative for policymakers to recognize that the rapid pace of technological change is compressing policy lifespans. Whereas policies once spanned five or ten years, today’s interconnected and AI-driven environment may require revisions every three years—or even more frequently.

The proactive threat intelligence sharing undertaken by companies such as Google and OpenAI represents a crucial first step toward situational awareness. By rapidly identifying and disclosing emerging threats, these initiatives inform more agile policy responses. This approach is essential where the window for effective policy intervention is shrinking, and traditional long-term policy frameworks may no longer suffice.

Photo by Midjourney.