Large Language Models (LLMs) and Generative AI in Cybersecurity and Privacy: A Survey of Dual-Use Risks, AI-Generated Malware, Explainability, and Defensive Strategies

This paper provides a comprehensive survey of how Large Language Models (LLMs) are reshaping the cybersecurity landscape. The authors argue that these models represent a double-edged sword: while they empower platform administrators and security teams to automate code scanning, threat detection, and vulnerability identification, they are equally accessible to attackers. Malicious actors are increasingly using generative AI to create phishing payloads, obfuscated code, and malware that can mutate to evade traditional signature-based detection systems.

A central focus of the paper is the rapid escalation of AI-assisted cyberattacks. The authors analyze data indicating that the proportion of detected malware involving LLM assistance has surged from approximately 2% in 2021 to a projected 50% by 2025. This shift highlights a transition from human-limited attack development to AI-augmented, industrial-scale threat generation. The paper notes that even amateur developers, when using LLMs to write code, often inadvertently introduce critical security vulnerabilities due to a lack of proper validation and security awareness.

To counter these threats, the authors highlight how major technology companies—including Google, Microsoft, and Amazon—are embedding LLMs into their security stacks. These defensive applications, such as Google’s Play Protect, use AI to perform real-time analysis of millions of applications, shifting security from reactive filtering to proactive, intelligent screening. However, the authors emphasize that these defensive systems are not without risks. They face significant challenges regarding algorithmic bias, the potential for overfitting, and the difficulty of maintaining privacy compliance under regulations like the GDPR.