Yup. Defense is mostly technical nuance. Attacks outside of academia often rely on the weakest links, distracted or scared humans. Chatgpt and LLMs like it can easily mass phish or otherwise thousands of targets in a matter of seconds. Can also be used for OSINT on human targets... Combine the two and ransomware will be a true cottage industry ran by script kiddies.

That said there are things they could do to prevent this. They won't do them, it'd be costly research... But they could.

We don’t seem to be quite there yet, but things are moving in that direction, unfortunately (see the Gorilla paper, for example). I still think to tailor the tool to each particular API requires human intelligence (and even that is hard), but a shotgun approach might be more “successful” even if it’s 5% effective.

That said, more traditional approaches (non-ML) are probably more effective still.