Vulnerabilities in LLMs Impact Cyber Threat Intelligence Workflows

• •LLMs exhibit cognitive failures in cyber threat intelligence workflows.
• •Targeted defenses can significantly reduce failure rates in LLM performance.
• •Comparative evaluations show specialized models outperform general-purpose LLMs.

Researchers have identified vulnerabilities in large language models (LLMs) used for cyber threat intelligence (CTI). A study published on arXiv highlights three cognitive failures: spurious correlations, contradictory knowledge, and constrained generalization to emerging threats. These failures were validated through causal interventions, showing that targeted defenses can significantly reduce failure rates. The study also reviews evaluations across various benchmarks, comparing general-purpose models like GPT-5 and Claude-Sonnet-4 with cybersecurity-specialized models such as SecGPT. The findings suggest that LLMs are not fully reliable for CTI workflows, impacting organizations relying on these technologies for threat detection and response. The research emphasizes the need for specialized models and improved evaluation methods to enhance LLM performance in cybersecurity contexts.