Low-level cybercriminals voice frustration over AI-generated content on underground forums
While automated posts are degrading community reputation systems, the study finds established criminal business models remain largely intact despite the influx of low-quality content.
Researchers from the University of Edinburgh, the University of Cambridge and the University of Strathclyde have published a study revealing that low-level cybercriminals are increasingly vocal about their dissatisfaction with the proliferation of low-quality, AI-generated content on underground hacking forums. The analysis, which examined nearly 98,000 AI-related conversations on these platforms between the launch of ChatGPT in 2022 and the end of last year, identifies a distinct friction within these communities. While sophisticated threat actors continue to leverage generative technology for code generation and social engineering, grassroots users argue that the resulting "AI slop" undermines the human interaction that defines these social spaces.
The core complaint from these forum users centres on the degradation of community reputation systems. For decades, cybercrime message boards have served as essential social spaces where scammers trade stolen data and build reputations for reliability. However, the influx of automated posts, often consisting of basic "bullet-pointed explainers" of cybersecurity concepts, is viewed as a threat to this ecosystem. Ben Collier, a security researcher at the University of Edinburgh, notes that many users feel their claim to be skilled individuals is undermined when they are forced to interact with chatbots rather than engaging with other humans seeking advice.
Specific grievances highlighted in the research include concerns that Google's AI search overviews are driving traffic away from these forums, alongside irritation at members who refuse to write even simple sentences. One anonymous poster noted the frustration of seeing members use AI to generate entire threads, stating, "Stop posting AI shit." The sentiment is that if users wish to converse with an artificial intelligence, they can do so on dedicated websites, but they visit these forums specifically for human connection and peer-to-peer discussion.
Despite the annoyance expressed by the community, the study indicates that established criminal business models have not been significantly disrupted. The research suggests that AI has not lowered the skill barrier to entry for low-level actors, nor has it caused serious disruptions to existing practices. Instead, the technology's primary impact has been felt in highly automated sectors such as SEO fraud, social media bots, and certain forms of romance scams, where efficiency is paramount over community engagement.
Sophisticated threat actors remain a separate category, with experts like Ian Gray of Flashpoint observing that they are well aware of commercial model guardrails and employ techniques to bypass them. While some discussions have emerged around building "AI-enhanced" markets to facilitate the buying and selling of stolen data, there is significant resistance to this concept among practitioners. Some hackers have dismissed the idea as stupid, wary of the vulnerabilities that AI-generated projects might expose in the underlying infrastructure.
The findings underscore a complex dynamic within the underground economy where the utility of AI for crime is acknowledged but its social implementation is rejected by the grassroots level. As the technology continues to evolve, the tension between the desire for automation and the need for human validation within these illicit communities appears set to persist.
