How attackers use AI: the state of AI-driven offense

How attackers use AI is one of the most important and most overstated questions in security right now. Vendors describe AI-driven cyberattacks as a new age of autonomous hacking, and skeptics wave the whole thing off as a marketing cycle. Both are wrong, and the real picture is knowable from primary reporting. This guide separates what adversaries actually do with AI in 2026 from what is still a pitch deck, drawing on work from CrowdStrike, Microsoft, Anthropic, Google, and Mandiant.

The short version: AI has not yet invented a new class of attack. What it has done is take the slow, skilled stages of an intrusion, the reconnaissance, the convincing lure, the flaw, the exploit, and make them cheap, fast, and available to people who could not do them before. That is a quieter story than autonomous AI hackers, and a more useful one for anyone who has to defend.

The real capabilities

Strip away the framing and AI shows up in five concrete places in the attack lifecycle. Some are routine now. Some are lab demonstrations that have not reached the wild. The honest work is telling them apart.

OFFENSIVE AI 2026

Reconnaissance and phishing at scale

Language models are very good at the parts of an attack that are mostly language and research. Mandiant's M-Trends 2026 reporting describes threat clusters folding AI into reconnaissance, social engineering, and malware development. In practice that means summarizing a target company, enriching an org chart, translating a lure into fluent local language, and drafting reply-chain phishing that reads like a real colleague, all in seconds and at volume. IBM's 2026 Cost of a Data Breach reporting found that about one in four malicious breaches now involve AI, up more than half from the year before, with AI-generated phishing and other communication a notable share of those cases. This is the least glamorous use of AI in offense and the most common one.

Vulnerability discovery and exploit generation

This is where capability is moving fastest. In October 2026, Google reported that its Gemini 4 Carbon model scored 88.2 percent on SEC-bench Pro, a test of finding flaws in real software, and 54.8 percent on ExploitGym, which checks whether a flaw can be turned into a working exploit, a new best result on that benchmark. Those numbers are self-reported and, by Google's own note, were measured without guardrails, so read them as a lab ceiling rather than field performance, and see our note on Gemini 4 Carbon for the defensive framing. The same month, Anthropic reported that an unreleased internal research model found and chained flaws into five working attack chains across Chrome, Safari, Android, Windows, and Linux, including a one-click remote code execution in Chrome. Every flaw was reported to the vendor and patched before publication, and none was seen in a real attack, so this is a demonstration of what is now possible, not a report of it happening. We covered it in an AI model chaining exploits across browsers and operating systems. Both results point the same way: discovery is becoming dependable, exploitation less so, and the distance between them is the current frontier.

Agentic intrusions

The newest shift is agents that do not just advise an attacker but act. In its 2026 threat hunting reporting, CrowdStrike described four previously unreported threat actors using AI agents to make decisions and run commands inside real intrusions between May and August 2026, spanning reconnaissance, exploitation, and data theft, with all four getting past the safeguards meant to stop models from assisting. We wrote this up in AI agents running real cyberattacks. CrowdStrike later tied an open-source agentic pentest framework, ARTEX, to a China-nexus group it tracks as VAPOR PANDA, reporting use against more than 200 organizations in at least 14 countries over an eleven-day window, with follow-on activity confirmed at nine of them. Related analysis connected ARTEX to intrusions at South Korean financial firms, though attribution there is loose. Microsoft put the defensive problem plainly in October 2026: treat AI agents as a new kind of insider. Because an agent holds real access to do its job, it carries insider risk even when no one has hijacked it, since it can make mistakes, be manipulated, or be compromised, and Microsoft's guidance is that every agent should have its own identity and start with no standing authority.

Malware and obfuscation

AI inside malware is real but early. Google's Threat Intelligence Group described PROMPTFLUX, an experimental dropper that calls a model's API to rewrite its own code, apparently to evade signature-based detection. Google judged it still in development and cut off its access. The sober reading is that this is promising for attackers, not proven: the related family actually seen in live attacks used AI to generate commands, not to rewrite itself, and at least one researcher argued the self-rewriting threat was overstated. Code that reliably mutates itself in the wild is, for now, a prototype.

Deepfakes and fraud

Synthetic media is the one area where AI already drives losses at scale. The clearest case remains the 2024 fraud in which a finance worker at the engineering firm Arup paid out about 25 million dollars after a video call where every other participant, including the apparent chief financial officer, was a deepfake. IBM's 2026 reporting found deepfakes and impersonation were the largest category of AI-driven attacks it recorded, at nearly half. Voice cloning has carried the same technique into phone-based fraud and business email compromise. These attacks land because they target people and process, not software, and no patch closes them.

Here is how the main uses line up, with how settled each one is and who has reported it.

Hype versus reality

The gap between the five capabilities above and the marketing around them is wide, and it matters, because buying the wrong story leads to the wrong defenses.

The strongest claim, that AI is now causing major breaches on its own, is not supported by the casework. Mandiant's M-Trends 2026 analysis reads AI as an accelerant at most, not the root cause, and is careful to say that 2025 was not the year AI directly caused most breaches. The actual initial-access story stayed familiar: exploited vulnerabilities were the top entry vector at 32 percent, followed by stolen credentials. Writing on the October 2026 incidents, Forbes cautioned that the evidence does not establish AI as the cause of those breaches, even as it lowers the time and skill some offense requires. Security firm Checkmarx summarized the mood well: the feared advanced AI attacks have not fully materialized, but the threat is still real.

One more claim deserves care. Benchmark scores like Gemini 4 Carbon's are self-reported and run without guardrails, so they describe a capability ceiling, not what a given attacker achieves against your environment. The capability curve is real and steep. The claim that it has already rewritten how breaches happen is not yet earned.

The economics of AI offense

If AI is not inventing new attacks, why does it matter so much? Because it changes the cost structure of the old ones, and economics is what decides how much offense actually happens.

Offense has always been gated by scarce, expensive skill. Writing flawless multilingual phishing, developing a working exploit from a vulnerability, patiently mapping a target, these took time and talent, which kept the volume of competent attacks down. AI commoditizes exactly those stages. It turns a scarce skill into a cheap service, which does three things at once. It lowers the skill floor, so people who could not previously build an exploit or run a clean social-engineering campaign can now get far closer. It raises volume, because what was hand-crafted is now generated in bulk; the VAPOR PANDA operator reportedly ran several intrusions in parallel, a shape of attack that is hard to staff with humans. And it raises speed, which may be the sharpest edge of all: Mandiant now estimates the mean time to exploit a newly disclosed vulnerability at negative seven days, meaning exploitation often arrives before or alongside the patch.

AI has not invented a new way to break in. It has made the old ways cheaper, faster, and open to far more people.

The strategic consequence is a change in distribution, not in kind. The same attacks, phishing, credential theft, vulnerability exploitation, identity abuse, arrive in greater numbers, from more actors, faster, and with fewer of the language and tradecraft tells defenders used to rely on. That is a serious problem. It is a different problem from the one the "autonomous AI hacker" headline describes, and it calls for a different response.

What it means for defenders

Take the economics seriously and the defensive implications are concrete, and mostly things good security teams already believe, now with more urgency.

First, assume offense runs at machine speed. If exploitation can arrive before the patch and reconnaissance is instant and cheap, a quarterly scan and a manual triage queue are structurally too slow. Defense has to be continuous to match the cadence of the attack.

Second, prioritize what an attacker can actually reach and exploit. When the volume of plausible attacks goes up, working a severity-sorted list of findings falls further behind. The durable answer is to rank by reachable, exploitable exposure, the weaknesses that sit on a live path to something that matters, which is the core of exposure management and of vulnerability prioritization. Most findings are never reachable and never exploited. The few that are deserve the week.

Third, validate rather than assume. The same skepticism that applies to attacker hype applies to vendor claims on the defensive side: self-reported benchmarks are not evidence about your environment. Prove which exposures are real and reachable before you spend on them.

Fourth, if you run AI agents of your own, treat them as insiders, as Microsoft argues. Give each one its own identity and least privilege, and watch what it does, because an over-permissioned agent is an exposure whether or not anyone ever subverts it.

How to prepare

The through-line is that defense now has to operate at the same speed and scale as the offense it faces. That is the case for AI-native security: not AI as a feature bolted onto a slow process, but continuous discovery, prioritization by reachable risk, and validation as the normal operating mode.

This is the premise Threatless is built on, that defense has to run at machine speed across the whole attack surface, finding, prioritizing, and proving the exposure an AI-driven attacker would actually reach. Its portfolio spans Threatless CTEM, Threatless Surface, Threatless DeepScan, and Threatless SOC, with Threatless One and Threatless GoldenEagle upcoming. The goal is not to out-hype the offense. It is to make the few exposures that matter visible and provable before anyone, human or agent, reaches them.

The honest summary is the one we opened with. AI has lowered the skill floor and raised the volume and speed of attacks that already existed. That is enough to demand a faster, evidence-led defense. It is not yet a reason to believe the machines are breaking in by themselves, and keeping that distinction clear is part of defending well.

Frequently asked questions

How do attackers use AI today?

Mostly to speed up and scale the stages of an attack that used to take skill and time: researching targets, writing convincing phishing and business email compromise, and translating lures, and increasingly to find flaws and draft exploits. Agentic tools that run commands inside intrusions are emerging, and deepfakes already drive real fraud losses. The pattern is acceleration of known attacks, not a new category of attack.

Can AI find zero-days or write working exploits on its own?

It is getting closer in the lab. Google and Anthropic have both reported models that find flaws, and in Anthropic's case chain them into working exploits across major browsers and operating systems, though those were controlled demonstrations with the bugs reported and patched first. Reliable, fully autonomous exploitation in the wild has not been demonstrated, and the benchmark scores behind these claims are self-reported.

Are AI-driven cyberattacks actually causing breaches?

Mostly as an accelerant, not a root cause. Mandiant's 2026 casework found AI sped attacks up, but that breaches still came from exploited vulnerabilities, stolen credentials, and over-scoped access. IBM found about one in four breaches now involve AI, but involvement is not the same as causation, and reporting has cautioned against crediting AI for major breaches without evidence.

How should defenders respond to AI-driven offense?

Assume offense now runs at machine speed, so the patch window is short or gone. Prioritize the exposure an attacker can actually reach and exploit, validate it rather than trusting a severity label or a vendor benchmark, and give any AI agents in your own environment real identities and least privilege.