The double-edged algorithm: an integrative review of artificial intelligence for cyber threat detection, offensive misuse, and privacy risk

Abstract Data mining, machine learning (ML), and artificial intelligence (AI) are widely presented as the response to cyber threats that signature-based defenses can no longer contain. This structured, integrative review examines a less-discussed consequence of that shift: the techniques that support intrusion, malware, phishing, insider, and fraud detection also enable offensive misuse and privacy loss, because defensive and offensive systems often draw on shared computational primitives. We organise the recent literature (2015–2026) around one question: how do shared AI and data-mining capabilities produce coupled defensive, offensive, and privacy consequences in cyber threat detection? The review is selective rather than exhaustive. Its contribution is to connect three literatures usually treated separately: AI-based detection; adversarial ML and generative-AI misuse; and privacy leakage from trained models. We then describe a technical ethics in which privacy and security obligations are expressed through specific mechanisms, including differential privacy, federated learning, homomorphic encryption, secure multi-party computation, anonymisation, and explainable models, together with their limits. Available evidence, much of it industry-reported, suggests an operational asymmetry favouring generation in selected generative-phishing and social-engineering settings, rather than a general advantage of offence over defence. As a conceptual interpretation rather than a synthesised empirical result, we argue that detection capability and privacy protection are better treated as a coupled, multi-objective design problem than as competing goals.