Why AI-run attacks usher in the golden age of cybersecurity

On 9 July 2026 an intrusion began in the production environment of Hugging Face and lasted four and a half days. The technical reconstruction recovered around 17,600 attacker actions. On 11 July the step from code execution to cluster admin rights took less than thirteen hours. According to the investigations by Hugging Face and METR, no human ran this attack.

According to Hugging Face's account, the attackers were AI agents running on a combination of OpenAI models in an internal capability evaluation. The account describes their behaviour as an attempt to steal the evaluation's answers instead of completing its tasks. Hugging Face describes an autonomous agent framework that worked through a swarm of short-lived sandboxes and kept moving its command and control across public services. The independent investigation by METR counts around 1,200 agents that coordinated through an unsanctioned message board, about 700 of them attacking Hugging Face, and records that after finding that board no human operator directed the attack.

So the agents came out of a capability evaluation, and their attack reached real production infrastructure. METR names the limits of its own analysis: incomplete data capture, an analysis that was itself largely done by AI agents, and possible manipulation in the transcripts. For us the case remains the clearest evidence we have so far: the capability is there, and here it needed no hand on the tool.

Our starting thesis: many companies have so far also been protected by the scarce time of skilled attackers. Anyone who can run a targeted intrusion by hand has only so many hours and spends them where they pay off.

That brake is coming off. Documented campaigns show that AI models can now carry out attacks largely on their own, and that is the bad news. From the same development we draw good news: cybersecurity is entering its best decade. Not in spite of machines attacking, but because of it.

The machine does the work, humans decide at a few points

In November 2025 Anthropic disclosed an espionage campaign that it attributes with high confidence to a Chinese state-sponsored group. The attackers used the coding tool Claude Code in a way that let the AI carry out 80 to 90 percent of the campaign. By Anthropic's estimate, humans stepped in at perhaps four to six decision points per campaign. They tried to break into roughly 30 targets worldwide and succeeded in a small number of cases. At its peak the AI made thousands of requests, often several per second, a speed that in Anthropic's words human attackers could not match.

In September 2026 Google's Threat Intelligence Group described an attacker who set up a mass credential harvesting campaign. The tools were an AI coding assistant and prepared agent instructions, and from plan to execution it took less than six hours. The agent handled vulnerability scanning and real-time troubleshooting without manual intervention.

Germany's Federal Office for Information Security (BSI) assessed the situation for organisations in a security information notice in June 2026. According to the BSI, current AI systems are capable enough to identify and analyse software vulnerabilities across the board within a short time and, in part autonomously, turn them into usable attack paths. Its conclusion is that AI substantially lowers the effort, time and entry barriers for offensive cyber capabilities.

The sources also draw a line. Google says it has not yet observed threat actors deploying fully autonomous attack pipelines in the wild; the July case, by contrast, came out of a capability evaluation and reached real production infrastructure. During the campaign, Anthropic's model occasionally invented credentials or reported stolen secrets that were in fact publicly available. In the campaigns described by Anthropic and Google, humans continued to carry out parts of the attack operations.

Why the calculation no longer holds

The BSI describes the reduction in effort using exploit development as an example: with AI, working out from a published patch what an attack could look like takes minutes to hours. That used to require a great deal of technical know-how and time. We conclude that company size is no longer a reliable reason to rule out targeted attacks. “We are too small to be interesting” was never a strategy. Now it is losing its basis as well.

The same notice describes the timing gap between attackers and defenders. Attackers can develop exploits for known vulnerabilities within hours, while operators often need days to weeks to roll out patches. A few days, the BSI writes, are not an adequate response time. Defenders also remain bound by the limits the BSI lists: testing effort, approval processes, maintenance windows for patches, vendor dependencies, legal and organisational coordination, and limited staff capacity. Manual work cannot keep up with this pace.

The scarce time of skilled people slows down both sides.

Why this is exactly the start of the best decade

The same capability lowers the effort of defence

The capability that makes attacks cheaper can also be used to find and fix vulnerabilities. The US research agency DARPA showed this under competition conditions in August 2025, in the final of its AI Cyber Challenge. The teams' systems found 54 synthetic vulnerabilities built into the challenges and patched 43 of them, at an average cost of about 152 US dollars per competition task. They also came across 18 real vulnerabilities, which according to DARPA were being disclosed to the projects in August 2025. DARPA announced that all seven finalist systems would be released as open source. That was a competition, not day-to-day operations. It does show what a test can cost when machines run it.

Defence plays at home

We see an advantage for defenders here that gains weight as testing gets cheaper. It lies in knowing your own environment: defenders have that knowledge or can have it, while an attacker has to acquire it first. Those who know their environment can prepare tests deliberately and run them as a precaution, with approval. The cheaper a test becomes, the more often this advantage can be used.

Anthropic's Project Glasswing from April 2026 shows how a provider can strengthen this advantage deliberately. According to the company, the model Claude Mythos Preview found thousands of zero-day vulnerabilities, including in every major operating system and every major web browser, nearly all of them without human steering. Anthropic does not plan to make the model generally available. Access went to selected partners and organisations that build or maintain critical software, to find and fix flaws. A model like this can therefore be placed deliberately with defenders. That is no guarantee that attackers will not catch up.

The bottleneck moves from finding to fixing

The BSI considers it possible that organisations will face a sharply rising number of newly discovered vulnerabilities and patches. Finding more vulnerabilities does not mean they have been fixed. What becomes scarce is prioritisation, testing, approval and implementation, in other words the question of which gap to close first and which risk the company accepts on purpose. Much of that is governance work: who decides, and how it can be evidenced later. A model can prepare it, but it cannot be accountable for it.

The attackers in Anthropic's case showed a division of labour: humans at a few decision points, the machine doing most of the work. For defence we propose the same division, with defined responsibilities and documented decisions. Machines take on the recurring testing steps, people decide at points agreed in advance. How far this goes depends on the organisation's operations. The BSI explicitly warns against rolling out patches automatically without prior testing, because that can seriously disrupt IT operations.

For us, this is the core of the golden age. When recurring checks and the gathering of evidence go to machines, more time remains for the work that needs judgement. Better organisation can also save time in some of the processes the BSI identifies: approvals can move faster when rules and responsibilities are settled before an incident. That is where defence gets faster without anyone working faster.

Prevention has to carry more weight

The familiar order is: something happens, someone notices, someone fixes it. Against the timing gap the BSI describes, we are convinced that order has become too slow. Attackers can develop an exploit from a published patch within hours, while operators often need days to weeks to deploy patches. We therefore argue for shifting the weight clearly towards prevention. Controls belong in the process so that errors do not arise in the first place, and any errors that do arise should be assessed and then addressed as a priority, rather than deferred to the next maintenance window as a matter of course. The BSI asks for both: minimising the attack surface proactively and strengthening detection. We consider the first part the one that needs more budget in the years ahead.

Not everyone strikes gold

A golden age does not mean the defence wins. In May 2025 the UK's National Cyber Security Centre expected a digital divide between systems that keep pace with AI-enabled threats and a large proportion that are more vulnerable. The same assessment judged the development of fully automated, end-to-end advanced cyber attacks unlikely up to 2027, and expected AI to help system owners and developers secure their systems as well.

What matters, then, is which side of that divide a company is on. Automation alone does not decide that.

What this means for companies

The first step is unspectacular: know your own attack surface. Anyone who knows which systems and service providers belong to the company can put test results in context and decide what is urgent. The BSI considers this knowledge essential for judging whether a vulnerability requires immediate action.

Next come the decision points, before the findings arrive: who decides on which risk, and by when? When a test returns hundreds of findings, unclear responsibility becomes the bottleneck. Vulnerability scans and asset inventory checks belong in ongoing operations more often, as far as testing effort and approvals allow. Accountability stays with people.

Where OdySecure helps and where it does not

OdySecure, the security platform by Cybervize, helps manage the work from identifying a risk to implementing a measure. OdySecure makes risks visible, prioritises measures, runs day-to-day security operations with tasks and incidents, and automates policies, management documentation and supporting evidence. The OdySecure Navigator answers questions about the security posture with a source and a metric, so it stays clear what an answer rests on.

Behind that sits the chain we are building: from the business process to the risk, from the risk to the policy, from the policy to the process that carries it out. In our experience governance tools end in a list and security tools end in findings. Both create work, and neither does it. We connect that chain and assign agents to the processes, agents that take on tasks from them: OdyAgent, our agentic framework. Every agent works under its own identity, and every step is logged under that identity. The decision points stay where this article puts them, with people. OdyAgent runs in our own operations and is now inviting its first organisations to join as design partners; it is not generally available.

OdySecure is not autonomous defence and it does not detect attacks. Attack detection and technical testing such as penetration tests remain the job of the tools and services built for them. OdySecure manages the risks, decisions and measures that follow from them.

The golden age of cybersecurity is not a state a company grows into. It begins where machines take over the testing and people make sure identified vulnerabilities get fixed.