The Importance of Being Human

Selena Larson opens by arguing that public talk about generative AI is muddled, and that the useful question is what has actually changed for attackers and defenders. Her focus is cybercrime, especially email as an initial access route. She says the most visible shift is in social engineering: language models let threat actors produce more natural lures in many languages, build personas for business email compromise, and generate scripts at volume. Some scripts still contain leftover LLM comments in mixed languages, which can hint at origin.

The middle of the talk looks at limits and continuity. One China-aligned group abruptly changed its tooling and sent sloppy lures, then returned to its established tradecraft. She walks through a ClickFix chain that delivers Xworm or SundownBot, the EtherHiding technique that stores command and control on a blockchain, and device code phishing that abuses the Microsoft 365 OAuth flow. Her argument is that defenses such as restricting PowerShell, blocking device code flow, watching blockchain endpoints and training users still apply regardless of how the content was produced.

She then shares two productivity examples: human-reviewed AI descriptions added to over 50,000 Emerging Threats rules, and a colleague's coding-assistant tool that parses large files for campaign clustering. Both needed domain knowledge, careful prompting and validation. The closing section turns to autonomous agents with broad system access, exposed data and malicious skills, along with social harms, environmental costs and the value of human creativity.