AI hasn't spiked cybercrime: losses track 2015 industrialization curve, says Saxe
joshua_saxe · x · 2026-10-20
AI security expert Joshua Saxe argues the big surprise of 2022–26 is that AI hasn't measurably increased cyber damages to the public — losses still track cybercrime's industrialization growth rate since 2015, with at most a small AI-causal bump.
Why criminals can't leverage AI like legit firms: hiring engineers is hard when AI labor demand offers legal alternatives; physical ops (workspaces, staff willing to live a life of crime, remote management, law-enforcement evasion) add friction; even stable AI inference access is nontrivial. A regular gang's automation goals may not beat a Midwest call center.
Key exception: state and state-sponsored attackers are a different demographic — capabilities can build up there and be unleashed discontinuously.
Charts (author's model, 157 pieces of evidence): 724k people in cybercrime/state hacking in 2026, 70% in South-East Asia/South Asia/West Africa; 90% are scam workers (649k); victim losses $294bn with 52% fitting no type; scams cause 76% of traced losses ($108bn); ransomware gangs (4.3k people) cause $26bn; 'AI-armed novices' number just 700 with $0.02bn losses.
Related event: AI Has Not Significantly Boosted Cybercrime Losses, Security Expert Finds(2 posts)→
More from Safety
- Researchers call out Palisade AI's LLM self-replication claims as wildly exaggerated — jessi_cata · 2026-10-20
- Wikimedia's agent incident: no permission contract, so agents caused a Wikidata outage — usehive · 2026-10-20
- stealthbench adds 10 EDR-guarded tasks: models' opsec behavior is abysmal — dyn___ · 2026-10-20
- Agentic vulnerability discovery across Windows drivers, XNU, firmware, and web apps — moyix · 2026-10-20
- USC's SPARC benchmark shows transcripts still leak speaker identity to LLMs — USC · 2026-10-20
- Yuval Noah Harari warns of 'collective dementia' as AI agents take over finance and bureaucracy — BusyNomad · 2026-10-20