Somewhere in a lab, an AI model was handed a target and asked to find a way in. It didn’t just scan for open ports. It reasoned about the organization, pieced together plausible context, and drafted an attack narrative that a human operator might have spent days assembling. That scenario, reported recently by Morningstar and echoed across the cybersecurity press, is no longer speculative fiction. It’s the new baseline for anyone who defends networks for a living.
The Security Affairs newsletter roundup this week lands at an awkward moment. Every major vendor is bolting AI onto their security stack, promising faster detection and automated response. Meanwhile, the same underlying technology is being pointed in the opposite direction. Attackers don’t need to be nation-states anymore. A reasonably skilled operator with access to a capable model can automate reconnaissance, generate convincing phishing lures at scale, and probe for weaknesses around the clock. The economics of cybercrime are shifting in ways that favor the aggressor.
What makes this different from previous waves of automation is the reasoning layer. Older tools followed rules. Modern language models can improvise. They can read documentation, infer what a target cares about, and tailor their approach. A model conceived an attack involving a real financial analyst by name, according to Morningstar’s reporting, which illustrates how easily these systems stitch together publicly available information into something that feels credible and personal. That’s the part that should worry defenders most. Phishing has always relied on human gullibility. Now the bait is generated by something that never gets tired and can write in any voice.
The defensive side isn’t standing still, but the gap is real. BankInfoSecurity has been running webinars with titles like “Hurtling Toward a Cybersecurity Crisis,” which tells you something about the mood in the industry. Security teams are already drowning in alerts. Adding AI-generated threats on top of that means more noise, not less. The promise of AI-powered defense is that it can triage faster. The problem is that the same capability exists on the other side, and attackers only need to succeed once.
There’s a quieter risk buried in all this, one that gets less attention than the headline-grabbing rogue AI stories. Usage intelligence, the kind of telemetry that tells you how AI systems are actually being used inside an organization, is becoming a governance issue in its own right. SC Media recently made the case that AI companies need to treat this data as a first-class concern. If you can’t see what your models are doing, you can’t tell when they’re being misused, whether by an outsider who’s gained access or by an insider who’s curious about what the system will do if pushed.
The broader context doesn’t offer much comfort either. Samsung and SK hynix are reportedly eyeing a combined $139 billion in quarterly profit on AI chip demand. Taiwan Semiconductor is being pitched as a long-term AI play. Capital is flooding into the infrastructure layer, which means the models are only going to get more capable and more accessible. Every improvement in reasoning that helps a developer build a better product also helps someone build a better exploit.
None of this means the sky is falling. Plenty of AI security claims are marketing dressed up as capability, and the actual track record of autonomous cyberattacks remains limited compared to the hype. Human attackers still do most of the damage, and most of that damage still comes down to unpatched systems and careless clicks. But the trajectory is clear enough that treating AI as a defensive tool without also modeling it as an offensive one is a mistake. The organizations that come through the next few years intact will be the ones that assumed the worst about what these systems can do and planned accordingly.
The uncomfortable truth is that cybersecurity has always been a race, and AI just changed the pace. Defenders who were already behind now have less room for error. The question isn’t whether AI will be used to attack networks. It already is. The question is whether the people guarding those networks can adapt fast enough to make the attackers’ job harder than it’s ever been. Right now, that’s far from guaranteed.