Hacking with AI: malicious tools are already sold openly in clandestine forums

AI-based hacking tools are already on sale in underground forums, ready for use by criminals without advanced technical knowledge. A report reverberated by Cybersecurity Dive exposes how language models are being adapted to automate attacks, create malware, and even manipulate AI agents with indirect prompt injections.

Cyber security with AI: How do hacking tools work?

Researchers identified offers that combine language models with malicious features ready for use. Instead of demanding that the attacker write code from scratch, these solutions do the hard work: generate phishing scripts, scan vulnerabilities and create malware variants. The goal is to reduce the entry barrier, allowing even beginners to run sophisticated campaigns.

Indirect prompt injection: the new threat to cybersecurity with AI

Indirect prompt injection is a technique that exploits AI agents — systems that read external data or interact with other applications. An announced service sells "poisonous promises" that, when processed by the agent, make him execute malicious commands as if they were legitimate instructions. This can mean stealing credentials, manipulating APIs or releasing sensitive data without the user noticing.

Cyber security with AI: impact for Brazilian companies

The facilitated access to this type of tool increases the attack surface for organizations of all sizes in Brazil. While security areas rush to adopt defensive AI, criminals take advantage of the same technology to scale their operations. On the defense side, initiatives such as AWS Launches IAM Role Manager: new tool simplifies access function management show how permission management can reduce risks, but no isolated solution eliminates the human factor: whoever uses AI agents needs to monitor the integrity of data that these tools consume.

Cyber security with AI: How to protect yourself against malicious agents?

Experts recommend combining continuous monitoring, validation of entries and minimum privilege policies. Companies that already use generative AI should test their own systems against prompt injection attacks, including reviewing integration between internal models and tools. Checking whether data from external sources is reliable is essential to mitigate this type of threat.

Frequently Asked Questions about cyber security with AI

AI hacking tools are cool?

Nope. The sale and use of these tools violate cyber crime laws and terms of use of AI platforms. Even so, the underground market continues to grow, which requires attention from the authorities and companies that provide language models.

How does indirect prompt injection act on AI agents?

It inserts hidden instructions into content that the agent processes, such as web pages, emails or documents. The model interprets the malicious command as a legitimate part of the entry and executes it and may exfiltrate data or perform unauthorized actions.

Are Brazilian companies at the target of these tools?

Yes, because the range is global and automation allows for scale attacks. Companies that use AI agents for service or process automation should treat these tools as a risk surface and adopt protective layers.