Cybercriminals Fear AI Could Take Their Jobs Too

Concerns about automation disrupting livelihoods are no longer confined to legitimate industries. According to fresh analysis from Sophos Counter Threat Unit (CTU), cybercriminals themselves are now openly worrying that AI tools and large language models (LLMs) could render their own illicit skills obsolete.

Researchers monitored chatter across dark web marketplaces, cybercriminal discussion boards, and encrypted messaging apps to capture the divided sentiment surrounding the rise of AI. On one side, AI-powered hacking kits have become a hot commodity in underground bazaars. Sellers , both established and new , are marketing tools that promise to automate phishing campaigns, generate malware, build social engineering lures, and even execute actions within already compromised networks.

One user detailed using generative AI to overcome language barriers, distribute scam content at scale, and rapidly respond to victims who take the bait. Another described creating deepfake audio and video profiles to construct convincing personas for romance fraud. Multiple vendors now offer products claiming to automate malware coding with AI assistance.

But not everyone in the criminal underground is celebrating. Sophos found that many forum members and Telegram channel participants have voiced anxiety over how AI could reshape roles, pricing, and competitive dynamics within the criminal economy. Some explicitly fear that sellers of AI tools will steal work from those who manually write their own malware scripts and code. In a mirror of legitimate workplaces, hackers are asking whether AI is coming for their jobs.

The debate is far from settled. A significant spike in AI-related discussion occurred after the launch of Claude Mythos Preview, a frontier AI model that developers at Anthropic claim can rapidly identify security vulnerabilities. While some cybercriminals dismissed fears as overreaction by corporate executives, others warned that outsourcing coding to AI would degrade the quality of malicious products while simultaneously stealing revenue from manual developers.

Sophos CTU noted that the most vocal advocates and opponents dominate the conversation, but many threat actors likely remain quiet, choosing instead to privately explore AI’s practical limits and tradecraft implications.

For legitimate organizations, the research carries a clear message. “As AI tooling and capabilities evolve, organizations should continue to prioritize strong cyber hygiene such as timely patching, multifactor authentication (MFA), and passkey use to reduce exposure to established tradecraft and future AI-assisted acceleration,” Sophos CTU advised. “Defenders should also maintain visibility across their environment to identify and mitigate anomalous activity before attacks escalate.”