AI Hasn't Boosted Cybercrime Losses: 90% of Attackers Do Scams, Not Hacking

joshua_saxe · x · 2026-10-20

AI security researcher Joshua Saxe analyzes a big surprise of the 2022–26 era: AI doesn't appear to have significantly increased cyber damages to the public — losses remain on-trend with the industrialization-of-cybercrime growth rates observed since 2015, with perhaps a small AI bump.

Core explanation (80%): the AI criminal economy isn't different from the rest of the economy — since we haven't seen an overall AI labor-productivity bump, the flat cybercrime result is unsurprising.

Path-dependent demographics make automation harder: building a cybercrime business means finding engineers willing to live a life of crime amid booming legitimate AI labor demand, renting workspace, managing honor among thieves remotely, evading law enforcement, and accessing AI inference reliably. Attackers are not a bunch of MIT grads eager to absorb automation.

Chart data (author's model, 2026 estimates):

724k people in cybercrime/state hacking worldwide; 90% do scams; 70% in South-East Asia, South Asia, or West Africa
$294bn in victim losses, with scams at 76% of traced losses; half of all losses fit no type

Policy implication: if attackers can't yet exploit AI at scale, we should diffuse AI capabilities to the public faster, even if attackers benefit too. State actors are the exception — capabilities there can be built up and unleashed discontinuously.

Original post →

AI Hasn't Boosted Cybercrime Losses: 90% of Attackers Do Scams, Not Hacking

More from AGI Musings