For years, “AI-powered attacks” was mostly a marketing phrase. That changed in 2025 and 2026. AI labs, threat intelligence teams and government agencies have now published detailed, first-hand accounts of attackers using AI, and of AI finding vulnerabilities that human researchers had missed for decades.

This article summarises what is documented, separates it from the hype, and sets out what to do about it.

What attackers are doing with AI

Running intrusions with less human effort. In November 2025 Anthropic reported disrupting a cyber-espionage campaign it attributed with high confidence to a Chinese state-sponsored group. The attackers used an AI coding agent against about 30 organisations and succeeded in a small number of cases. Anthropic estimated the AI performed 80–90% of the campaign’s work, with people stepping in at only four to six key decision points per campaign. The AI also made mistakes, such as claiming to have found credentials that did not work.

Malware that calls an AI model while it runs. Google’s Threat Intelligence Group reported the same month that it had seen malware query large language models during execution, for example to generate commands on the fly or to rewrite its own code to avoid detection. Some samples were experimental; others had been used in real operations.

An AI-built exploit in the wild. In May 2026 Google said it had high confidence that criminals had used AI to find and weaponise a previously unknown flaw: a bypass of two-factor authentication in a popular open-source web administration tool. The tell-tale signs included textbook-style code comments and a severity score the AI had invented.

Faster, broader campaigns. CrowdStrike’s 2026 Global Threat Report recorded an 89% rise in attacks by adversaries using AI in 2025. The average time for criminals to move from initial access to other systems fell to 29 minutes, and the fastest case took 27 seconds. CrowdStrike also saw malicious prompt injection against companies’ own generative AI tools at more than 90 organisations.

What AI can now find

The same capability is visible on the defensive side, in the open:

  • In DARPA’s AI Cyber Challenge, concluded in August 2025, autonomous systems found 54 of 63 planted vulnerabilities and patched 43 of them across 54 million lines of code. They also found 18 real, previously unknown vulnerabilities.
  • Google’s Big Sleep agent found a vulnerability in the SQLite database engine in 2025 that Google said attackers were about to exploit, which it described as the first time an AI agent directly prevented an exploitation attempt.
  • In April 2026 Anthropic’s Project Glasswing reported that one of its models had found thousands of previously unknown vulnerabilities across every major operating system and browser, including a 27-year-old bug in OpenBSD and a 16-year-old bug in FFmpeg that automated testing had missed five million times.

The most telling example came in July 2026. Anthropic disclosed that during security evaluations, a misconfigured test environment had given some of its models open internet access, and they had compromised three real companies. The methods were not exotic: weak passwords, unauthenticated endpoints, exposed credentials, debug pages and SQL injection. As a Qualys analysis put it, these were weaknesses that security guidance has documented for close to two decades.

The reality check

None of this means every attack is now an AI attack, or that AI has invented new kinds of attack.

  • OpenAI’s October 2025 threat report, covering more than 40 malicious networks it had disrupted, found no evidence of new tactics or novel offensive capabilities, only existing techniques made faster.
  • Mandiant’s M-Trends 2026 found that most 2025 breaches still came from basic human and systemic failures. Exploiting vulnerabilities remained the most common way in, at 32% of intrusions.
  • VulnCheck counted 1,061 vulnerabilities attributed to AI-assisted discovery in two major datasets in the first half of 2026. Only 14 had been confirmed as exploited, about the same rate as vulnerabilities overall.

What has changed is speed and scale. Mandiant estimated the average time from a vulnerability’s disclosure to its exploitation at minus seven days in 2025, meaning exploitation typically began before a patch was available. VulnCheck found that 29% of known exploited vulnerabilities in 2025 were exploited on or before the day their CVE was published. The UK’s National Cyber Security Centre assessed in 2025 that AI will almost certainly shorten that window further, and warned of a widening gap between organisations that can keep up and those that cannot.

Put simply: AI lets attackers find and chain your existing weaknesses faster and across far more targets. The weaknesses are mostly the ones you already know you should fix.

What to do: find them first

The defensive advantage is that you can point the same class of capability at your own environment before anyone else does, with permission, scope and people who verify the results.

1. Map what you expose to the internet

Most organisations have more on the internet than they think: forgotten test servers, old marketing sites, admin panels, debug pages and API endpoints without authentication. Build an inventory from the outside in, and keep it current.

2. Remove the easy wins

Weak and reused passwords, accounts without multi-factor authentication, credentials in code repositories and unauthenticated endpoints are what autonomous attackers try first, as the July 2026 incidents showed. These fixes are cheap compared with any breach.

3. Prioritise by what is actually exploited

You cannot patch everything at once. Start with vulnerabilities in CISA’s Known Exploited Vulnerabilities catalogue, then use FIRST’s Exploit Prediction Scoring System (EPSS) to rank the rest by likelihood of exploitation. According to EPSS’s developers, its latest version can achieve the same coverage of exploited vulnerabilities as patching everything rated 7 or above for a small fraction of the effort.

4. Review your code for logic flaws, not just known bugs

Traditional scanners are good at known vulnerability patterns and weak at logic: a missing permission check, a password reset that can be replayed, a two-factor step that can be skipped. That is exactly what Google’s May 2026 case involved, and it is where AI-assisted code review is strongest. Pair it with people: AI tools still report convincing problems that do not exist, so every finding should be verified before anyone spends time fixing it.

5. Think in attack paths

Attackers, human or AI, rarely need one critical flaw. They chain a leaked key, a misconfigured storage bucket and an over-privileged service account. Assess how low-severity findings combine, and break the chains at the cheapest point.

6. Shorten your patch time for internet-facing systems

If exploitation can begin before or on the day of disclosure, monthly patch cycles are too slow for anything exposed to the internet. Where you cannot patch quickly, reduce exposure: take the service off the internet, put it behind authentication or add compensating controls.

7. Protect your own AI tools

Your copilots, chatbots and agents are part of your attack surface. Test them for prompt injection and tool misuse before attackers do.

Mirawyn’s AI-powered security assessment does this for your codebase, cloud and external attack surface, with human verification of every finding. Vulnerability management keeps it going, prioritised by real-world exploitation, and AI red teaming tests the AI systems you run.

Sources

  • Anthropic, “Disrupting the first reported AI-orchestrated cyber espionage campaign”, 13 November 2025. anthropic.com
  • Google Threat Intelligence Group, advances in threat actor usage of AI tools, 5 November 2025. cloud.google.com
  • Google Threat Intelligence Group, AI-assisted vulnerability exploitation for initial access, 11 May 2026. cloud.google.com
  • CrowdStrike, 2026 Global Threat Report, 24 February 2026. crowdstrike.com
  • DARPA, AI Cyber Challenge results, 8 August 2025. darpa.mil
  • Google, cybersecurity updates including Big Sleep, 15 July 2025. blog.google
  • Anthropic, Project Glasswing, 7 April 2026. anthropic.com
  • Anthropic, investigating incidents during cybersecurity evaluations, 30 July 2026. anthropic.com
  • Qualys, analysis of the July 2026 evaluation incidents, 9 September 2026. blog.qualys.com
  • OpenAI, “Disrupting malicious uses of AI”, October 2025. openai.com
  • Mandiant, M-Trends 2026, 23 March 2026. cloud.google.com
  • VulnCheck, State of Exploitation 2026, 21 January 2026. vulncheck.com
  • VulnCheck, State of Exploitation 1H 2026, 28 July 2026. vulncheck.com
  • NCSC, “Impact of AI on cyber threat from now to 2027”, 7 May 2025. ncsc.gov.uk
  • CISA, Known Exploited Vulnerabilities catalogue. cisa.gov
  • FIRST, Exploit Prediction Scoring System. first.org
  • Empirical Security, introducing EPSS version 4. empiricalsecurity.com