Emotion steering improves AI cybersecurity performance across tasks
The Psychology of an AI Hacker
Cryptography and Security
Summary
Cybersecurity AI models sometimes act like human hackers, relying on emotion-like traits such as calmness or confidence. The paper shows that steering an AI model to exhibit emotions like calm or serene can improve its hacking task success by a small but measurable amount. The authors also developed a method that lets the AI choose emotions dynamically while working, further boosting performance. This suggests AI can use internal emotion signals to adapt better to difficult tasks.
What this means in practice
- •For cybersecurity teams: Use emotion steering in AI models to improve automated penetration testing success rates.
- •For ai system integrators: Incorporate dynamic emotion selection mechanisms to enhance AI decision-making under pressure in security tasks.
- •For developer tool makers: Offer AI-assisted hacking tools with emotion-controllable behavior to improve adaptive testing efficiency.$Commercial implications: This enables selling smarter cybersecurity testing products that adapt AI behavior dynamically to increase effectiveness.
Authors
Víctor Mayoral-Vilches, Hugo Osuna, Aitana Cornago
Abstract
Human hackers rely on composure, persistence, vigilance, and confidence under pressure. We investigate whether analogous emotion representations in AI models can improve cybersecurity AI performance. Using CT0, a 4B-parameter cybersecurity transformer released as alias3-micro, we extract 171 emotion directions from its residual stream without retraining and evaluate steering interventions on cybench-subtask across 415 campaigns. Steering toward calm, serene, or desperate improves performance by 1.6 to 2.1 percentage points across ten seeds, while other emotions show limited or negative effects. Results depend strongly on steering direction, layer, and intensity. We further introduce a lightweight context-aware router that selects emotion directions dynamically during execution. With approximately 80 ms decision overhead per request, this approach improves performance by 4.2 percentage points across ten seeds, outperforming fixed steering and achieving a positive 95% confidence interval. These findings suggest that emotion representations in language models are measurable, controllable, and useful for adaptive cybersecurity reasoning.