How AI is changing cybersecurity, explained: faster attacks, faster fixes, and the race between them
In one month, AI helped turn decade-old PHP bugs into a working exploit, an AI-driven attacker breached a government network, and AI labs launched free bug scanning and mathematical proofs of safe code. Here's what's going on.
By ScoviAI Team
Key points
- AI cuts the time and skill needed to turn a known bug into a working attack
- Attackers are already using AI agents after breaking in, according to Palo Alto Networks' Unit 42
- Defenders are using AI too: free scans for open-source code and machine-checked proofs that code can't crash
- Anthropic expects AI to favor defenders within about two years, but not necessarily before then
For decades, the hardest part of hacking wasn't finding a bug. It was turning it into an attack that actually works. October 2026 showed that AI is changing that, on both sides.
What changed for attackers
Take PHP2Shell, the set of flaws in PHP that affects a huge share of websites. The bugs had been in the code for more than a decade. What kept them safe was complexity: exploiting them meant chaining several bugs and adjusting to each server's memory. Wiz Research says frontier AI models made that practical "in hours." Read the full story in PHP2Shell: patch now.
AI is also showing up after the break-in. Palo Alto Networks' Unit 42 described attackers who breached a European government entity and reached password hashes and two-factor secrets within two hours. Their commands were formatted so that, in Unit 42's words, they produced "machine-parseable output for an AI model to read," a sign of an AI agent at work.
The short version: the time between "a bug exists" and "a bug is being used against you" is shrinking.
What changed for defenders
The same tools work for the other side:
| Approach | Example | What it does |
|---|---|---|
| AI bug scanning | Anthropic's OSS Scanner | Free, regular AI scans of open-source projects, with a suggested fix in each report |
| Help for critical systems | Anthropic's Critical Infrastructure Defense Program | Claude and engineers for firms that protect power, water and transport systems |
| Mathematical proofs | Claude's formal verification of 123 libraries | Proves code can't crash under defined conditions, instead of just testing it |
| Safety containers | NVIDIA OpenShell, Windows' execution containers | Limits what AI agents can touch and stops them if they step out of bounds |
The catch: finding is fast, fixing is slow
Anthropic summed up the problem when it launched its Cyber Mission: it's easier than ever to find vulnerabilities, but "verifying, prioritizing, and fixing these findings remains challenging." In its earlier work, months often passed between finding a bug and fixing it. On industrial equipment that can't be switched off, a fix can wait years.
Anthropic's forecast is that in about two years AI will favor defense, because it will be easier to catch bugs before they ship and to write secure code from scratch. In the near term, it warns, that may not be true.
What it means for you
You don't need to be a security expert to benefit. Three habits matter more than ever:
- Install updates promptly, on your phone, computer, router and website. The gap between disclosure and attack is now days or hours.
- Use a password manager and two-factor authentication, so a leaked password alone isn't enough.
- Be careful what you give AI agents access to. If an agent can log in for you, tools like 1Password for Agents keep the actual password out of its hands.
Sources
ScoviAI Team is the ScoviAI newsroom. We write every article ourselves from the original announcements and link our sources. Spotted a mistake? Tell us and we'll fix it.
ADVERTISEMENT
