In Bolivia, artificial intelligence has begun to find its way into political communication. Some political actors appear to use it to draft speeches, organize arguments, and produce social media content. At first glance, this seems like a relatively ordinary application of a new technology: a tool that helps people communicate faster and perhaps more effectively. But it raises a question that goes beyond campaign messaging: what happens when the same technology is incorporated into organizations with far greater resources, more complex objectives, and the ability to operate beyond the public eye?
Elsewhere, that question is no longer theoretical. Governments are developing cyber capabilities, criminal organizations are expanding their operations, and politically motivated groups are finding ways to turn digital access into real-world influence. Artificial intelligence did not create these actors or their ambitions. What it may be changing is how quickly and extensively they can pursue them.
The distinction is not necessarily the technology itself, but who uses it, what resources stand behind them, and what they intend to achieve. A tool that drafts an email may seem harmless until it is used to build a convincing false identity, prepare a social engineering campaign, or produce personalized messages for hundreds of targets. The technology does not need intentions of its own to become part of an operation. Sometimes, it is enough for someone to know exactly what they want and have a faster way to pursue it.
North Korea offers one of the clearest documented examples of this shift. For years, its cyber operations have been associated with espionage, financial fraud, identity impersonation, and large-scale cryptocurrency theft. In October 2026, Microsoft Threat Intelligence published an analysis describing how several North Korean threat actors have incorporated generative and agentic AI into their operations. The report identified different levels of adoption, with groups such as Jade Sleet, Coral Sleet, and Jasper Sleet integrating AI into routine operational workflows.
The findings go beyond using a chatbot to write more convincing messages. Microsoft documented AI-assisted reconnaissance, the creation of fraudulent digital identities, tailored social engineering campaigns, software development, and the automation of repetitive tasks. In one example, Jade Sleet conducted campaigns through three front companies within a single week. Onyx Sleet generated dozens of personalized lures in minutes. Other actors used AI-assisted development tools to create or modify code and support their operational infrastructure.
The most important detail is perhaps the one that receives the least attention: Microsoft assessed that these operations remain human-directed. The technology has not replaced the people deciding whom to target or what to accomplish. Instead, it is helping them perform more tasks, more quickly, and at greater scale. The distinction matters because it shifts the discussion away from the idea of machines independently choosing to attack and toward the organizations learning to use them as force multipliers.
The financial dimension makes this development harder to ignore. On October 29, 2026, more than $6 billion in virtual assets was stolen from the cryptocurrency exchange Binance. The FBI attributed the theft to North Korea and identified the activity as part of a campaign known as TraderTraitor. According to the FBI, the stolen assets were being converted primarily into Ethereum, with the intention of moving them through services that could make further tracing and recovery more difficult. The U.S. Department of Justice later announced that more than $1.2 billion in assets connected to the theft had been seized or restrained.
This case should not be confused with another North Korean operation announced by the Department of Justice in November: FaceStealer. That social engineering scheme used secretly recorded webcam footage and artificial deepfakes to impersonate victims during video calls. The FBI reported that it had resulted in more than $400 million in cryptocurrency theft over eighteen months and that investigators had seized more than 900 webcam videos. The two cases illustrate different aspects of North Korea's cyber activity: one demonstrates the financial scale of cryptocurrency theft, while the other shows how identity manipulation can be used to gain trust and access. They should not be treated as a single operation.
Together, these cases reveal something important about the relationship between technology and power. A cyber operation does not begin with artificial intelligence. It begins with an objective, an organization, access to resources, and people willing to carry it out. AI can become an additional advantage within that structure, reducing the effort required for certain tasks and allowing existing methods to be repeated on a much larger scale.
The Russian case offers a different perspective: the relationship between cyber groups and state interests. In December 2025, the U.S. Department of Justice announced indictments concerning Cyber Army of Russia Reborn, or CARR, and NoName057(16). According to the indictment, CARR was founded, funded, and directed by Russia's military intelligence agency, the GRU. The group claimed responsibility for attacks against targets around the world, including critical infrastructure. U.S. authorities also described operations involving industrial control systems, public water facilities, and other infrastructure.
This example is relevant for a reason that goes beyond the technical details of the attacks. It shows how a group presenting itself as a hacktivist movement can operate within a structure connected to state interests. The label alone tells us very little about who provides the resources, who enables the operation, or who benefits from its results. At the same time, not every politically aligned group is controlled by a government. There are important differences between ideological sympathy, informal cooperation, material support, and direct operational control.
That distinction is essential when examining the wider cyber landscape. The internet has become a space where state operations, criminal activity, political movements, and loosely organized collectives can overlap. Their motivations and capabilities are not interchangeable. Nor should every attack be treated as evidence of a coordinated campaign. The challenge is to understand the structures behind each operation without turning every connection into proof of a larger design.
The consequences can also extend far beyond stolen information or money. In October 2026, France's national cybersecurity authorities documented an attack against refrigeration control systems at approximately 700 retail locations. The incident was attributed to the Shahid Kaveh unit, affiliated with Iran's Islamic Revolutionary Guard Corps. The report described changes to defrost settings that caused significant losses of goods and, in at least fifteen cases, fires. The incident demonstrated how unauthorized access to industrial systems can affect physical processes and everyday services.
It is a reminder that digital infrastructure is not separate from the material world. Food distribution, energy, water, transport, finance, and communications increasingly depend on interconnected systems. A disruption in one of these environments can have consequences that reach people who may never know how the intrusion began. The power of a cyber operation is therefore not measured only by the amount of data stolen or the number of computers affected, but also by what it can interrupt, damage, or place at risk.
This is where the idea of artificial intelligence as a catalyst becomes more useful than the familiar debate about whether machines will become autonomous. In The Fear Index, Robert Harris explores a system whose predictions and decisions become entangled with the financial world it is designed to interpret. The novel is fiction, but its central tension offers a useful lens: a system can influence the environment it analyzes, especially when people begin to trust its outputs and act on them. In real operations, AI does not need to control the entire process to have an impact. It can influence the speed, volume, and direction of decisions made by human operators.
A different question emerges from Ender's Game: the distance between those who design a strategy and those who carry it out. The novel is not about modern cyber operations, but its exploration of command, delegation, and responsibility becomes relevant when increasingly complex tasks are distributed across people and automated systems. If an organization can delegate reconnaissance, content generation, code development, and routine analysis to AI tools, the people directing the operation may be able to concentrate on objectives while the systems help execute the work.
And in The Circle, Dave Eggers examines the power that grows from collecting, connecting, and centralizing information. That concern has a direct counterpart in today's digital environment. Information is not simply something to possess. It can be used to construct identities, map relationships, identify vulnerabilities, influence behavior, and make people more predictable to those who study them. Artificial intelligence can make some of those processes faster and more accessible.
These books do not predict the events described here, nor do they provide evidence for any of the cases. Their value lies elsewhere: each approaches a different dimension of the relationship between information, automation, strategy, and control. Taken together, they help frame a question that is often lost in discussions about increasingly capable machines: who gains power when these systems become part of everyday decision-making?
That question brings us back to Bolivia. Using AI to prepare a political speech is not equivalent to using it to conduct a cyberattack, build a fraudulent identity, or compromise critical infrastructure. The objectives, consequences, and levels of risk are entirely different. But the underlying change deserves attention. We are becoming accustomed to delegating tasks to systems that can produce, analyze, organize, and persuade. The same general capabilities can be incorporated into very different structures, depending on the people and institutions using them.
The real issue, then, is not whether artificial intelligence will eventually become powerful. It is whether we are paying enough attention to the people and organizations whose power it can increase today. A technology that makes communication easier can also make manipulation cheaper. A tool that accelerates research can also accelerate the search for vulnerabilities. A system that helps one person work more efficiently can help an organization expand its reach without growing at the same rate.
The machine does not need to take control for power to change hands. Sometimes, it is enough for those who already hold power to learn how to use it first.
When cybercrime is backed by a government or another powerful entity, what lies ahead? And when that power gains tools capable of accelerating research, multiplying deception, and reducing the cost of certain operations, are we facing a new threat, or an old struggle that has found a new catalyst?
t474-r0b07
T474::AUTH
AI::ASSISTED
HUMAN::DIRECTED
ANTI_HYPE::018
Top comments (0)