AI Is Helping Hackers, But Blocking Cybersecurity Experts

Summary

The interview with cybersecurity researcher Marcus Hutchins focuses on how AI affects both attackers and defenders, and challenges several common cybersecurity warnings.

AI and cybersecurity

• Hutchins says an AI model helped a North Korean hacking group create malware-related tools, including a password stealer, while refusing to help him deobfuscate the same malware for analysis. He argues that AI guardrails can be easier to bypass when creating malicious tools than when doing defensive research.
• He says AI is useful for specific tasks, such as deobfuscating code, but is not universally capable. He recommends learning technical skills first so practitioners can judge when AI output is useful or wrong.
• Hutchins views broad restrictions on powerful or open-weight security models as risky: legitimate developers may lose access, while criminals ignore the restrictions. He sees AI-assisted vulnerability discovery as potentially useful, especially for small development teams, if access is handled responsibly.
• He criticizes OpenAI’s public messaging about a hacking-related investigation, arguing that its systems were not truly air-gapped and that the company emphasized marketing rather than the security failures. He contrasts this with Anthropic’s handling of a separate disclosed incident.
• He also warns that AI-generated “slop” can erode trust online. In his view, authentic, technically grounded content and a real audience are more valuable than generic AI-generated engagement.

Malware and endpoint protection

Hutchins describes ransomware actors exploiting vulnerabilities in legitimate, digitally signed drivers to gain kernel-level access and disable endpoint detection and response (EDR) software.

Because attackers can rotate through a stockpile of EDR-disabling tools, he says blocking one tool may not be enough. The underlying risk is that signed drivers can still contain exploitable vulnerabilities.

VPNs, public Wi-Fi, and privacy

Hutchins disputes the claim that people will routinely be hacked merely for using public Wi-Fi without a VPN. Most modern web traffic is encrypted, so network observers generally cannot read sensitive data, though domain names may still be visible depending on TLS and server settings.

He explains that VPNs do not make users anonymous: they shift trust to the VPN provider, and advertising identifiers, apps, device identifiers, and other tracking methods can still link activity to a person.

He considers VPNs useful for some purposes, such as bypassing website restrictions or age-verification requirements and changing apparent location. However, he cautions that VPNs do not solve every privacy or security problem.

On public Wi-Fi captive portals, he says an attacker who compromises the portal provider can replace the login page with a malicious one, such as a “ClickFix” prompt that tricks users into running malware. A VPN cannot protect users from the portal itself because they must access it before connecting to the VPN. He advises treating captive portals as untrusted and not running commands they provide.

He also notes that DNS manipulation may be possible on affected networks, but says this is distinct from the main captive-portal attack.

Juice jacking and malicious cables

Hutchins calls routine warnings about airport or hotel USB charging ports overstated. Modern phones generally require user approval or a change to data-transfer mode before USB file access is enabled; charging alone does not normally expose files.

He distinguishes “OMG cables,” which can act as keyboards. In the scenario he describes, the phone would need to be unlocked, the cable connected, and the user’s activity would be visible. He considers opportunistic attacks on random travelers unlikely.

He recounts a journalist’s inquiry to an FBI field office: according to Hutchins, the office said it had not seen cases and that the warning originated from a YouTube video. He uses this anecdote to caution against treating an official warning as proof that an attack is common.

Business and technology work

Hutchins says building software is only part of launching a successful product; marketing, sales, and customer acquisition are critical. He describes a technically capable cybersecurity product that failed because the team could not sell it and because it identified breaches without offering remediation.

He argues that AI-assisted coding does not eliminate the need for software engineering skills or business fundamentals.

Sponsor segment

The video’s sponsor, ThreatLocker, is presented as a tool for discovering and auditing applications in an organization, then restricting what is allowed to run. Its stated approach is “deny by default,” while also limiting legitimate applications to their intended actions. This is a sponsored segment, not an independent product review.

Guides, explainers, and referenced videos

• Hutchins discusses a separate video explaining why most public Wi-Fi traffic is encrypted and why routine man-in-the-middle fears are often exaggerated.
• He also refers to a video critiquing OpenAI’s account of a hacking-related incident.
• The conversation mentions his posts about AI-generated content and altered Google Maps and Earth imagery, but does not provide a step-by-step tutorial or formal product review.

Main speakers and sources

• David Bombal — interviewer and host
• Marcus Hutchins — cybersecurity researcher and interview guest
• ThreatLocker — sponsor, featured in a promotional segment