The Dual-Use Nature of Large Language Models in Cybersecurity: A Bibliometric Analysis and Critical Review

Abstract Large language models (LLMs) now occupy three positions in cybersecurity at once: they are systems that must be secured, capabilities that lower the cost of offence, and instruments that augment defence. Existing reviews typically examine one of these roles in isolation, which obscures how the roles interact and leaves the field without an evidence base for judging whether the interactions are being studied. This article addresses that gap by combining a VOSviewer-based bibliometric analysis with a critical literature review. We retrieved 13,756 records published between January 2023 and 19 October 2026 from OpenAlex and, after document-type, language, abstract, de-duplication and validated relevance screening (precision 84.0%, 95% CI 78.3–88.4%), analysed 7,369 documents through performance analysis, keyword co-occurrence and co-citation mapping in VOSviewer and a dictionary-based classification of each document's dual-use role. The co-occurrence map resolves into four thematic clusters: attacks on and alignment of LLMs; LLM-enabled detection and security operations; code and vulnerability analysis, including penetration testing; and socio-technical threats and governance. Research on LLMs as targets (42.8% of documents) and as defensive tools (35.3%) has grown largely in parallel: only 7.9% of documents address more than one role, and only 11.1% of defensive studies engage with attacks on the defending model itself, falling to 2.5% for vulnerability detection. The critical review explains why this matters: reported success rates of offensive LLM agents range from 0% to 90% depending on experimental design, few defences are evaluated against adaptive adversaries, and the security–utility trade-off is rarely quantified. We formalise these findings in a coupled dual-use framework with three testable propositions and derive eight research directions, prioritising adaptive evaluation, multilingual guardrail robustness, longitudinal measurement and the security of defensive LLM deployments.