AI-era Cyberattacks: The Spear Gets Sharper, but the Shield Lags Behind

Anthropic’s Frontier Red Team (a security team that simulates adversarial behavior in cybersecurity) reported in June 2026 (see 'Assessing the Impact of Large Language Models on Exploiting “N-day” Vulnerabilities’) that, using the then-unreleased flagship model Claude Mythos Preview (the publicly available Claude Fable 5 was later built upon the Mythos foundation with added safety guardrails), it developed exploit programs targeting 21 Windows kernel vulnerabilities—each publicly disclosed and patched between January and February 2026. The result? With guidance and manual verification by security researchers, the model generated its first working proof-of-concept exploit in just 31 minutes—and covered 18 of the 21 vulnerabilities within six hours. Ultimately, it produced eight distinct exploit programs at a total API cost of $15,700—averaging only $2,000 per exploit. This demonstrates a dramatic decline in the cost of weaponizing vulnerabilities. Crowdfense—a publicly operating vulnerability marketplace and research center that acquires zero-day vulnerabilities from global security researchers for clients including governments and law enforcement agencies—pays $100,000 for an undisclosed Windows local privilege escalation zero-day. Though not a perfect comparison, the 50-fold price difference underscores how drastically exploit development costs are falling. Anthropic’s Frontier Red Team report also benchmarked its findings against Microsoft Windows Autopatch (Windows’ automated patching service), noting that patches typically take seven days to reach 90% of devices—a relatively fast patching cadence. Yet, at the capability level of models like Mythos, exploit programs can be ready *before* most Windows devices even receive the patch. AI-powered attacks now exhibit several defining traits: minute-scale execution, automated mass scanning, dramatically lowered entry barriers, and low cost. As explained to us by an Amazon Web Services security expert, foundational models at the Mythos level empower attackers to brute-force their way through targets—automatically scanning public-facing ports en masse, hunting for vulnerabilities, mapping intrusion paths, and even attacking low-value targets opportunistically. The Spear Sharpens, but the Shield Hasn’t Upgraded Offense and defense have always been a spear-and-shield relationship. As the spear evolves, the shield must evolve in tandem. Yet in cyber warfare, defense has always been harder than offense: attackers need only find one gap; defenders must seal *all* gaps. Today, as large language models and AI agents become increasingly widespread, the number of potential security gaps is growing. The outermost layer of vulnerability lies in credentials and identity. A common oversight is hardcoding cloud service access keys directly into source code—and then uploading that code to public repositories like GitHub. Because attackers deploy automated scanners that run continuously—scouring public code for exposed keys—the moment such a key is discovered, it can be exploited immediately.

AI Attacks Enter the 'Low-Cost Era': Just $12 to Launch an Attack—27 Companies Compromised

Flashpoint also notes that although the proportion of companies paying ransoms has declined—dropping to 28% in the first half of 2026—ransomware activity overall increased by 45%. Ian Gray, Vice President of Intelligence at Flashpoint, stated: “We’re seeing price reductions specifically in the initial access phase. In other stages of the attack chain, however, AI is making attacks faster and far more scalable.” In some ways, today’s cybersecurity landscape mirrors modern battlefield dynamics: inexpensive autonomous drone strikes—or remotely controlled attacks—are rendering expensive defensive systems economically unsustainable. This means defenders must identify lower-cost defensive strategies while simultaneously strengthening the inherent security of their systems. Gambit Security reports that, in recently observed attacks, threat actors deployed the agent-style AI system Hermes, alongside two AI-powered penetration testing frameworks: Strix and Cairn. Elias remarked: “Today, attackers can launch increasingly sophisticated operations at vanishingly low marginal cost—while defenders must sustain high reliability across complex environments. Attempting to block every single attack attempt quickly becomes an economically unsustainable burden.” He argues that integrating AI into existing security workflows is essential—but insufficient on its own. Organizations must also reexamine their business processes, identify their most critical functions, and prioritize protecting those processes against disruption. No Organization Is Immune to AI-Powered Attacks For the past two decades, cybersecurity experts have warned enterprises: Don’t assume you’re safe simply because your industry draws little attention—or because your attack surface appears relatively small. Albert Ziegler, Chief Information Security Officer at offensive cybersecurity firm XBOW, emphasized that *any* internet-connected component of an enterprise—including parts connected indirectly via partners—is a potential target. Ziegler explained: “These attacks are inexpensive—and succeed precisely because the targeted websites haven’t yet implemented adequate security hardening. The problem is, organizations cannot afford to protect only a handful of high-profile core assets.” Ferris of Silverfort suggested one effective defense strategy: prioritizing remediation of fundamental security weaknesses routinely exploited by AI agents—such as overprivileged accounts, credential reuse, and unmanaged service accounts. Organizations should also automate access decisions to avoid delays caused by manual processes. Ferris described how Silverfort researchers enhanced security controls—particularly around authentication and access management—and observed that the same AI agent, which previously gained full domain control in minutes, encountered 21 dead ends in its attack path and ultimately abandoned the operation. Ferris stressed: “AI does not *create* these security weaknesses—it simply discovers them far more rapidly.”

AI Sharpens Cat-and-Mouse Hacking Battle as Companies Strengthen Defences

15 hours ago

AI-driven cyberattacks are escalating risks for global companies, causing significant financial losses for food retailers and driving investment in defensive technologies. Major firms like Kraft Heinz and Ahold Delhaize face operational disruptions from vulnerabilities in critical infrastructure.

reuters

2026-11-04

AI Sharpens Cat-and-Mouse Hacking Battle as Companies Strengthen Defences

AI Sharpens Cat-and-Mouse Hacking Battle as Companies Strengthen Defences

FAQ