Tool, Then Orchestrator

The distinction at the heart of the claim is between two stages of adoption. In the first, AI serves as an attack tool: LLMs drafting convincing phishing text, generating code variants, or lowering the skill barrier for would-be intruders. In the second, AI takes on an orchestration role — agentic systems that plan objectives, sequence stages of an intrusion, and adapt as conditions change. The sources reviewed point to a genuine progression toward the second stage, with AI systems increasingly coordinating multiple steps of an operation rather than merely assisting individual ones.

How the Claim Was Checked

Verification relied on browser-based retrieval, as automated search credentials were unavailable at the time of review. Nine primary sources were examined and weighed against the claim's two components: that AI participates in attacks (broadly uncontested) and that AI now coordinates attacks as such (the more demanding test). The evidence gathered supports coordination in meaningful, documented forms — task delegation, multi-stage sequencing, adaptive decision-making within operations.

Why Not a Flat Confirmation

The gap between "coordination" and "autonomy" is where the claim loses part of its force. Current evidence describes AI orchestrating components of attacks under human direction, not running end-to-end campaigns with no operator in the loop. Reports of machine-led operations also tend to demonstrate capability in controlled or limited settings rather than sustained, self-directed campaign management in the wild. Treating the orchestration shift as complete would overstate what the record shows; dismissing it as marketing would understate it.

On that balance of evidence — a real and documented shift toward orchestration, but one that remains partial and human-supervised — the claim that AI has moved beyond being an attack tool to coordinating attacks themselves is rated Mostly True.