Cybercriminals Weigh Options for Using LLMs: Buy, Build, or Break?

**Executive Summary:** Attackers are increasingly weaponizing LLMs by using malicious front ends and uncensored/open-source models to bypass guardrails and automate tasks that improve phishing, reconnaissance, and other cyber-crime workflows; while highly sophisticated AI-generated malware remains challenging, the accessibility of unrestricted models and underground offerings amplifies risk. Defenders must prioritize adversarial testing, regular red-teaming of guardrails, and adaptive input/output filtering to mitigate this evolving AI-enabled threat landscape.