Large Language Models in Cybersecurity: Threats, Exposure and Mitigation, an open-access Springer volume from Switzerland’s Cyber-Defence Campus, inventories how LLMs act as both attacker tools and new attack surfaces. Read in late 2026, it remains a strong 2024 practitioner map—and a thin playbook for agent frameworks and continuous model churn.
Most LLM-security writing still arrives as slides, blog posts, or single-paper surveys. Large Language Models in Cybersecurity: Threats, Exposure and Mitigation, edited by Andrei Kucharavy, Octave Plancherel, Valentin Mulder, Alain Mermoud, and Vincent Lenders and published open access by Springer Nature in 2024 under Creative Commons Attribution 4.0, is rarer: a multi-author campus volume that tries to inventory the field before it finishes forming. The ebook I examined runs 249 pages across 27 chapters. armasuisse Science and Technology’s Cyber-Defence Campus supported the open-access release. Contributors were assembled roughly from April to December 2023, with single-blind peer review by fellow authors and external experts.
That timing is the review’s spine. The book is strongest where 2023–early-2024 research already had receipts—generative models’ non-factuality, training-data leakage, LLM-scaled phishing, insecure code suggestions, prompt-driven execution-flow hijacking, red teaming, and the emerging standards stack. It is thinner where late-2026 practice now lives: multi-tool agent frameworks, tool-calling blast radius, retrieval-augmented systems in production, and the operational grind of continuous model and prompt churn. Treat it as a serious threat and mitigation map for practitioners and decision-makers. Do not mistake it for a finished field manual for agentic systems.
What the book argues
The editors’ preface states the aim without marketing fog. LLMs, thrust into public view by ChatGPT and made privately integrable by open families such as LLaMA, create both opportunity and cybersecurity risk. The volume’s four-part structure follows that diagnosis. Part I rebuilds enough LLM literacy for security readers—history, adaptation, model families, conversational agents, fundamental limitations, and evaluation tasks. Part II catalogues salient threats: private-information leakage; phishing and social engineering; vulnerabilities introduced through code suggestions; execution-flow hijacking when LLMs control business logic; influence operations; and deeper-web indexing. Part III forecasts exposure through adoption trends, investment flows, insurance, copyright risk, and research monitoring. Part IV gathers mitigations—awareness and education, privacy-preserving training, adversarial evasion, federated learning hardness, detectors, on-site deployment, red teaming, and standards—before two closing chapters on dual-use roles and safer integration.
The editorial voice is institutional rather than polemical. Forewords from Florian Schütz (then Switzerland’s Federal Office of Cybersecurity leadership) and Jan Kleijssen (formerly of the Council of Europe) frame the book as technology anticipation for government and industry, not as a vendor white paper. The preface is also candid about coverage gaps forced by peer-review stringency, including social impacts of computational tools and some LLM-augmented social-engineering and search-attack topics the editors wished they could include. That admission is useful: it tells you the book’s edges are deliberate, not invisible.
How it is built: a campus anthology
This is not a single-author monograph. It is a curated anthology from the Cyber-Defence Campus network and partners—IBM Research Zurich, Sophos AI, Kudelski Security, EPFL, HES-SO, ZHAW, Censys, Vijil / AI Risk and Vulnerability Alliance, and others. Chapter lengths vary. Some read as compact expert briefs (Beat Buesser on leakage; Terry Vogelsang on execution-flow hijacking). Others are denser surveys (Sebastiano Panichella on code-suggestion risk; Dragos Ruiu on red teaming; Subhabrata Majumdar on standards). The closing dual-role chapter by Ciarán Bryce and colleagues at HES-SO Geneva synthesizes threats and defenses; Majumdar and Vogelsang’s final chapter on safe integration sketches trust boundaries and least-privilege design.
The genre matters for judgment. Anthologies trade unified prose for breadth and specialist authorship. Readers get named practitioners on phishing (Sophos), prompt injection as business-logic hijack (Kudelski), and standards mapping (Majumdar), rather than one narrator’s smoothed paraphrase. The cost is uneven depth and occasional overlap—leakage appears in the limitations chapter, the dedicated leakage chapter, and again in the dual-role conclusion. For a first institutional map of LLM cyber risk, that redundancy is mostly a feature: key failure modes are hard to miss.
What it gets right
First, the limitations chapter refuses hype. Andrei Kucharavy’s Part I summary for practitioners is blunt: pure generative LLMs are non-factual in principle; even tool-enabled models need verification; non-public information should not be fed into generative training; reasoning cannot be trusted without checks; long-context persistence is weak; niche and recent topics are poor fits; unfiltered end-user exposure is unsafe; biased models must not drive decisions unaided. The chapter’s deeper claim—that likelihood-of-continuation is the model’s native objective, so factuality arrives only when the factual continuation is also the overwhelmingly likely one—is still the right mental model for security teams who keep hearing “the model knows.” Citing Facebook’s Galactica takedown as a cautionary case, Kucharavy also notes that as of late 2023 no secure-design principles had been shown to reliably and provably prevent private-information memorization and leakage. That sentence aged into a research program, not a solved engineering checklist.
Second, Part II’s threat chapters are concrete enough to brief non-research audiences. Buesser’s leakage chapter ties extraction attacks (Carlini et al. on GPT-2; Huang et al. on email memorization; fine-tuning-surface risks) to jailbreaking and transferable adversarial suffixes (Zou et al.), clarifying that generative leakage is not just classical membership inference with a new label. The Sophos-authored phishing chapter shows why LLMs change the economics: personalized spearphishing at scale for “mere pennies,” multimodal deepfakes, and proof-of-concept automation via AutoGPT-style self-querying agents that can fabricate storefronts, catalogs, and checkout flows—with the important empirical caveat that the team still needed templates and human scaffolding. The Shā Zhū Pán (“pig butchering”) case, where a romance/crypto scammer’s register suddenly shifted into fluent LLM prose, is the sort of incident detail security leaders can actually use in awareness briefings.
Third, the software chapters land the architectural point that generic “AI risk” slides often miss. Panichella argues that for code-generating models the dominant risk is not hallucinated non-compiling nonsense—compilers and interpreters catch much of that—but insecure patterns over-represented in older training corpora, plus the possibility of poisoning training sets with hard-to-spot vulnerable snippets. Vogelsang’s execution-flow chapter reframes prompt injection as the LLM-era cousin of classic injection flaws: when user text steers business logic, “Ignore previous instructions…” is not a parlor trick; it is control-plane abuse. The worked examples—forcing a DROP DATABASE script under an “educational” pretext, and leaking CRM-enriched verification facts via prompt leaking—are plain enough for application-security teams. Citing OWASP’s Top 10 for LLM Applications ranking prompt injection first, the chapter correctly refuses to treat filters as a complete answer and points forward to design-level blast-radius reduction.
Fourth, the mitigation and closing material is oriented toward operators, not only model researchers. Ruiu’s red-teaming chapter tracks the shift from manual malicious prompts to optimization-based and transferable jailbreaks, and catalogs failure modes across reliability, safety, fairness, and misuse. Majumdar’s standards chapter usefully bridges classical CVE/CWE/ATT&CK vocabulary to NIST’s AI Risk Management Framework (January 2023), the AI RMF Playbook, and OWASP’s LLM Top 10—exactly the translation layer enterprise security programs needed in 2024. Schillaci’s on-site deployment chapter, discussing consumer GPUs such as the RTX 4090 making ~7B-parameter local fine-tunes newly practical, frames the dual edge: lower barriers for attackers and clearer sovereignty options for banks and defense. The final integration chapter’s trust-boundary sketch (user/LLM boundary, server-side tools, private data stores) and least-privilege prescriptions remain good baseline architecture advice: do not put LLMs in critical paths you cannot afford to fail; validate inputs and outputs deterministically; treat the model as an untrusted user of your tools.
Where it stops short for late 2026
The book’s own calendar is the constraint. Research closed around December 2023; the PDF metadata shows production in May 2024. AutoGPT appears as a phishing-automation exhibit, not as the mature agent-framework ecosystem that followed—tool routers, persistent memory, multi-agent orchestration, browser and code interpreters wired into enterprise SaaS. Vogelsang and Majumdar discuss prompt injection and sandbox breakout conceptually, including remote code execution and data exfiltration across trust boundaries, but readers will not find a production playbook for tool-calling allowlists, capability tokens, session isolation for agents, or evaluation harnesses that regression-test agent trajectories after every model swap. Continuous model churn—weekly prompt edits, embedding refreshes, vendor model aliases that silently change behavior—is largely outside the volume’s scope. Insurance, copyright, and investment chapters forecast exposure at a macro level; they do not substitute for an SRE-style reliability program for LLM features.
Some chapters are also brief by anthology design. Leakage, phishing, and on-site deployment read as sharp briefs rather than exhaustive monographs. The dual-role conclusion usefully mentions offensive LLMs such as FraudGPT and WormGPT and defensive uses in detection, but it cannot deepen every earlier thread. Instructors and CISOs will still need primary papers, current OWASP/MITRE ATLAS materials, and vendor-neutral red-team reports as a second shelf. That is a fair price for an early institutional map; it is a real limit if someone expects a 2026 agent-security engineering handbook.
Who it is for
Assign or circulate this book if you need a shared vocabulary across security engineering, ML practitioners, and public-sector decision-makers—especially teams that must brief leadership on why LLMs are both a tool for adversaries and a new attack surface inside products. The open CC BY 4.0 license and Springer hosting make it unusually easy to share without paywall friction. Pair Part I’s limitations chapter with Part II’s threat briefs for onboarding; use Part IV’s standards and red-teaming chapters to connect research risk language to governance checklists.
Skip it as a sole reference if your immediate job is hardening a tool-using agent in production next quarter. You will get the right threat intuitions and design principles, not a complete control catalog, evaluation suite, or change-management process for model drift. For that work, treat the campus volume as orientation, then move to current agent-security guidance, application-security threat models specific to your tool graph, and continuous evaluation.
How it meets the moment
The moment is an industry that integrated chat interfaces faster than most organizations could threat-model them, then discovered that agents with tools turn prompt injection into remote influence over real systems. Large Language Models in Cybersecurity meets that moment as early, open, practitioner-facing inventory from a national cyber-defence research campus: sober about generative limits, specific on phishing and code and control-flow risks, and oriented toward red teaming and standards rather than vibes. It misses the moment as a complete answer to late-2026 agentic and continuously updated production stacks.
That is still a favorable verdict for what the book set out to be. A 2024 Springer open-access volume will not secure your agent fleet. It can keep practitioners and policymakers from rediscovering, in 2026, failure modes the Swiss campus network already named in 2023—so long as nobody confuses a threat map drawn before the agent era with the engineering campaign that era now requires.