Cybercriminals Are Pushing Back Against AI-Generated Slop on Underground Forums
A study analyzing 97,895 AI-related conversations on cybercrime forums from ChatGPT's launch in 2022 through end of 2024 reveals growing resentment toward generative AI content. Researchers from the University of Edinburgh, University of Cambridge, and University of Strathclyde observed pushback on forums like Hack Forums, where users complained about members posting 'bullet-pointed explainers' of basic security concepts and generic AI-generated replies.
Key Findings
- Social disruption: Ben Collier, security researcher at University of Edinburgh, notes these forums are 'essentially social spaces' where users build reputations. AI posts undermine claims to skill and disrupt friendship-building.
- Direct complaints: Quotes include 'I see a lot of members using AI for making their threads/posts and it pisses me off' and 'Stop posting AI shit.' One user wrote: 'If I wanted to talk to an AI chatbot, there are many websites for me to do so … I come here for human interaction.'
- Quality vs. quantity: Low-level cybercriminals are dumping AI-generated content, flooding forums with 'low quality posts' and automated explainers, annoying established members.
- Reputation gaming: Newcomers use AI to inflate their reputation by posting polished but shallow content, exposing them to distrust from experienced users.
- Elite skepticism: Flashpoint VP Ian Gray says sophisticated threat actors are 'cautious of AI-generated projects in forums or marketplaces' and are aware of weaknesses in commercial models' guardrails and potential infrastructure exposure.
Context
While some organized fraudsters use AI for realistic face-swapping, translation, and code generation, the lower-tier hacking community views AI slop as a threat to forum culture. The study also notes concerns that Google's AI search overviews are reducing forum traffic. As one anonymous commenter put it: 'No-one is asking for this—we want you to improve the site, stop charging for new features.'
📖 Read the full source: HN AI Agents
👀 See Also
Three open-source alternatives to litellm after PyPI supply chain attack
litellm versions 1.82.7 and 1.82.8 on PyPI were compromised with credential-stealing malware. Three open-source alternatives include Bifrost (Go-based, ~50x faster P99 latency), Kosong (agent-oriented from Kimi), and Helicone (AI gateway with analytics).
Malwar: A Vulnerability Scanner for SKILL.md Files Built with Claude Code
A developer has released Malwar, a free tool that scans SKILL.md files for malicious instructions using a 4-layer pipeline including a rule engine, URL crawler, LLM analysis, and threat intel. The tool was built entirely with Claude Code after the developer found concerning patterns like Base64 blobs and instructions to pipe curl output to bash in existing skills.
Cisco source code stolen via Trivy supply chain attack
Cisco's internal development environment was breached using stolen credentials from the Trivy supply chain attack, resulting in the theft of source code from over 300 GitHub repositories including AI-powered products and customer code.
Fake Claude Code site served trojan — detected by Windows Defender as Trojan:Win32/Kepavll!rfn
A typosquatting or ad-based site mimicking the official Claude Code website delivered a trojan detected as Trojan:Win32/Kepavll!rfn by Windows Defender. Reddit user warns others to verify URLs before running PowerShell install commands.