AI in the underground: Curiosity, claims, and concerns

CTU researchers analyzed underground forums and marketplaces where threat actors are increasingly discussing and monetizing AI capabilities—selling brokered API access, recruiting prompt engineers, advertising AI-enabled social engineering (voice bots, synthetic personas) and malware/tooling (Leak Bazaar data marketplace, Apex AI, Metatron, PolyEngine, Cobalt Strike integrations). The report highlights observed claims (not all validated), examples of AI-assisted tradecraft, and community skepticism, and recommends continued good cyber hygiene and monitoring as AI adoption evolves.