AI tools enable automated cyberattacks and rapid vulnerability exploitation

The end of the security era

The multibillion-dollar cybersecurity industry is facing a major disruption as AI tools begin to automate the process of hacking. According to Alex Stamos, chief security officer at Cognition, the industry is entering a 'dark age' where the previous rules of defense no longer apply. This shift is driven by the ability of AI to handle the heavy lifting of finding and exploiting software flaws.

In the past, cybersecurity relied on a hierarchy of skills where only a few 'god tier' researchers could perform complex tasks like reverse engineering patches. These experts would spend months researching a single piece of software to find a vulnerability before writing a way to exploit it. Now, that process is being compressed into real-time actions by automated systems.

This change effectively breaks the established economy of cyber defense. Previously, it was often economically smart to hire experts to protect systems because the barrier to entry for high-level attacks was so high. With AI, that barrier is collapsing, making it much easier for a wider range of actors to launch sophisticated strikes.

Inverting the kill chain

To understand this shift, it helps to look at the 'kill chain,' a term borrowed from the military to describe the steps taken to achieve an effect on a target. In cybersecurity, this involves researching software, finding a bug, writing an exploit, and then deploying it against a target. Traditionally, this was a linear process where research happened long before any actual attack took place.

AI is inverting this process by allowing systems to look at targets and find bugs in real time while simultaneously writing the exploits. Instead of a human researcher doing the manual work, an AI system can go 'hog wild' to identify and strike multiple organizations at once. This allows for a level of speed and scale that was previously impossible for most hackers.

One example of this is a Chinese open-source tool called ARTEX. When powered by certain open-weight models, it can be used to break into a shocking number of organizations. Stamos noted that this tool recently hit about 200 companies in a single week after initially targeting three South Korean banks.

The rise of the script kiddie

The democratization of these tools means that 'script kiddies'—people with little to no specialized skills—now have access to the capabilities of elite researchers. A person can now use a standard desktop computer and an open-weight model to reverse engineer a Microsoft patch and write stable exploit code. This removes the need for a massive R&D component within a criminal organization.

Because these tools are open-source or open-weight, they do not have the same protections or logs that law enforcement can monitor. Attackers no longer have to use 'frontier models' that might flag their behavior or provide a paper trail for authorities. This allows them to operate in a way that feels like the 'Wild West' of the early internet.

This shift also changes who is capable of carrying out large-scale attacks. While state actors like Russia and North Korea still have significant capabilities, smaller groups can now use banks of computers to run agents that perform attacks all day. This creates a situation where even mid-size companies with small IT teams are 'toast' against automated threats.

A state of continuous breach

The current landscape is characterized by a sense of 'permanent continuous breach' across the tech industry. Stamos highlighted a recent incident where a hack on a prominent AI service provider led to the theft of API keys. These keys allowed attackers to break into another company, where they pushed a malicious plugin to 5,000 different companies.

This type of chained hacking shows how quickly a single vulnerability can snowball into thousands of potential breaches. It creates a high-stress environment for security professionals who feel they are constantly in a state of emergency. Many in the industry have expressed exhaustion because they are effectively dealing with a non-stop wave of incidents.

The ultimate result is a world where companies are never truly safe because vulnerabilities have always existed. The difference now is that the tools to find and use those vulnerabilities are being deployed at a scale and speed that makes traditional defense strategies feel like a fantasy. We are moving toward a reality where the goal is no longer to be perfectly secure, but to manage a constant state of compromise.