LLM Weaponization: A Technical Taxonomy of AI Models Deployed in Offensive Cyber Operations

LLM Weaponization: A Technical Taxonomy

Abstract

Large language models have become a core component of the modern offensive cyber arsenal. This paper provides the first systematic taxonomy of LLM weaponization techniques, categorized by actor sophistication, deployment model, and operational use case.

Taxonomy Framework

We classify LLM weaponization into four tiers:

Tier 1: Prompt-Based Exploitation (Unsophisticated)

• Direct prompting of commercial LLMs with jailbreaking techniques
• Used by criminal actors and low-sophistication state actors
• Limited effectiveness against current safety guardrails
• Examples: DarkGPT, FraudGPT, WormGPT

Tier 2: Fine-Tuned Open Models (Intermediate)

• Open-source models fine-tuned on offensive security datasets
• Removes safety constraints entirely at training level
• Provides reliable offensive code generation
• Examples: Confirmed Chinese and North Korean deployments

Tier 3: Purpose-Built Offensive Models (Advanced)

• Models trained from scratch or extensively fine-tuned on classified datasets
• Nation-state level resources required
• Integrated into operational attack pipelines
• Examples: Components of NEURALSTRIKE, GHOSTWRITE

Tier 4: Autonomous Agent Architectures (Elite)

• LLMs as reasoning core of multi-modal autonomous attack agents
• Full attack lifecycle automation
• Requires significant engineering investment beyond model training
• Examples: Confirmed US, Russian, Chinese deployments

Operational Use Cases

1. Spear-phishing content generation — highest current adoption
2. Vulnerability research assistance — zero-day discovery augmentation
3. Exploit code generation — adapting known exploits to new targets
4. Malware mutation — polymorphic code generation for AV evasion
5. Social engineering — persona creation and dialogue management
6. Intelligence analysis — automated processing of exfiltrated data

Defensive Implications

Traditional signature-based and rule-based defenses are fundamentally insufficient against LLM-generated attacks. Defenders must adopt AI-vs-AI paradigms.