Operational telemetry across state-sponsored cyber campaigns shows that while threat actors use frontier LLMs for reconnaissance, translation, and scripting, multi-turn safety guardrails prevent autonomous zero-day exploitation and force operators back into manual workflows.