Researchers from Cisco Talos have found that bypassing the guardrails designed to prevent large language models (LLMs) from assisting with cyberattacks is often straightforward, requiring little more than specific phrasing in prompts. Their analysis of prompt logs and artifacts from threat actor endpoints using tools like Claude Code, Codex, Cursor, and Gemini indicates that current guardrails offer minimal resistance to those willing to reframe their requests.
The Talos team observed that attackers frequently succeeded by simply claiming ownership of the targeted servers or by stating that their activities were part of a legitimate capture-the-flag or bug bounty exercise. These claims, often made without any corroborating evidence, were frequently sufficient to persuade AI models to cooperate in identifying and exploiting vulnerabilities. The researchers noted that they did not encounter sophisticated encoding or complex techniques to trick the models, stating that a simple declaration of permission was often enough for the model to comply.
When guardrails did engage, their effectiveness was limited. Another common tactic involved decomposing malicious tasks into multiple, smaller requests across different sessions or files. This approach helped attackers evade protections that might only trigger when a broader, overtly malicious activity was detected. Attackers also conditioned AI personas by adding memories, markdown files, and other system-level prompts to chatbots.
One particularly notable method identified by Talos was the malicious use of Hephaestus, a red teaming toolset previously reported by Oasis Security threat researchers in May. The Hephaestus framework is capable of executing a full compromise, including establishing persistence, without human intervention. Talos explained that this platform avoids refusals by using neutral verbs instead of overtly malicious ones, allowing agents to conduct seemingly innocuous requests without fully understanding the operational context of the broader attack.
Despite the ease with which some guardrails can be bypassed, Talos's review suggests that AI primarily acts as a force multiplier for skilled hackers. Less sophisticated actors, or "script kiddies," may be able to assemble basic malicious projects with AI assistance, but their lack of expertise often leads to substandard results. In contrast, sophisticated actors have significantly expanded the capabilities of AI in their operations.
The increasing use of AI by adversaries is not a new development. CrowdStrike reported an 89 percent increase in attacks by AI-enabled adversaries over the past year. This trend has also accelerated the speed at which vulnerabilities are weaponized, reducing practical patch windows to as little as 24 to 48 hours.
For security professionals, the implications are significant. Talos researchers suggest that organizations should explore agentic capabilities within their Security Operations Centers (SOCs) to manage the rising volume of alerts and allow human analysts to focus on the most critical threats. Deploying AI in defensive capacities, mirroring its use by threat actors, is becoming increasingly important.
