Understanding the AI Threat Landscape
Every security leader I talk to agrees that AI is changing the threat landscape. Far fewer can say precisely how. Without that precision, budgets go to whatever vendor tells the scariest story.
This chapter builds the mental model. It covers the three structural shifts AI introduced, the numbers that quantify them, who is actually using these capabilities, and, just as important, what has not changed.
The Three Shifts
Shift one: speed compression
Vulnerability research used to be slow by nature. A skilled researcher picks a target, learns the codebase, builds a test setup, finds a candidate bug, then spends days or weeks proving it is exploitable. Months per critical finding was normal.
AI collapsed that timeline. Anthropic reported that the thousand runs against OpenBSD that surfaced the 27-year-old bug cost under $20,000 in total, and the single run that found it cost under $50.
The attacker side shows the same compression. CrowdStrike's 2026 Global Threat Report puts average eCrime breakout time, the time from initial access to lateral movement, at 29 minutes, 65% faster than the year before. The fastest breakout it observed took 27 seconds. Mandiant's M-Trends 2026 puts the median handoff from initial access to a secondary threat group at 22 seconds, down from more than eight hours in 2022, and estimates the mean time to exploit a vulnerability at minus seven days: exploitation typically starts before a patch exists.
Shift two: scale multiplication
Humans audit code sequentially. Models do not. An agentic system can work through an entire repository, form hypotheses about hundreds of code paths in parallel, and run as many instances as the compute budget allows.
Glasswing made this concrete. By Anthropic's May 22 update, roughly 50 partner organizations had identified more than 10,000 high- or critical-severity vulnerabilities. Anthropic's own scan of more than 1,000 open-source projects flagged 23,019 candidate issues, of which an estimated 6,202 were high or critical. By the October update, the verified total from partners stood at 129,000 or more.
No human research community, at any size, produces those numbers in four months.
Shift three: capability democratization
The early assumption was that Mythos-level capability would stay locked inside one lab. The evidence says otherwise.
Independent researchers at AISLE took the flagship vulnerabilities from Anthropic's announcement and tested them against small, cheap, openly available models. Given the relevant code, eight of eight models detected the showcase FreeBSD bug, including one with only 3.6 billion active parameters priced around $0.11 per million tokens. A 5.1-billion-active-parameter open model recovered the core reasoning chain behind the OpenBSD finding.
That does not mean a small model matches Mythos end to end. Finding a bug you have been pointed at is easier than finding it cold in a million-line codebase, and building a reliable exploit is harder still. But it means the moat is the engineering around the model, the scaffolding, test infrastructure and triage, more than the model itself.
The Hugging Face intrusion in July reinforced the point from the attacker's side. Hugging Face said it did not know which model powered the agent that breached it. Attackers do not need access to a restricted lab model. They need a capable enough model and a loop.
The race among frontier labs, which I follow in my Grok AI hub, makes wider availability a near certainty. By June 2026 Anthropic's own safeguarded Mythos-class model, Claude Fable 5, was generally available. The question is no longer whether attackers will have this capability. It is how well the guardrails around it hold.
The Numbers Security Leaders Should Know
Here is the data I would put in front of any executive team, with sources you can verify on the Sources page at the end of this guide.
| Number | What it measures | Source |
|---|---|---|
| 29 minutes | Average eCrime breakout time (65% faster than prior year) | CrowdStrike 2026 Global Threat Report |
| 27 seconds | Fastest observed breakout | CrowdStrike 2026 Global Threat Report |
| 89% | Year-over-year increase in operations by AI-enabled adversaries | CrowdStrike 2026 Global Threat Report |
| 42% | Year-over-year increase in zero-days exploited before public disclosure | CrowdStrike 2026 Global Threat Report |
| -7 days | Estimated mean time to exploit: exploitation typically starts before a patch | Mandiant M-Trends 2026 |
| 22 seconds | Median handoff from initial access to a second threat group (over 8 hours in 2022) | Mandiant M-Trends 2026 |
| 1 in 4 | Malicious breaches where attackers used AI (up 56% year over year) | IBM Cost of a Data Breach 2026 |
| ~$6M | Average cost of an AI-enabled breach, versus a $4.99M global average | IBM Cost of a Data Breach 2026 |
| 31% | Initial access through vulnerability exploitation, now the top vector (up from 20%) | Verizon DBIR 2026 |
| 48% | Breaches involving a third party (up from 30%) | Verizon DBIR 2026 |
| 109 to 1 | Machine identities per human identity | Palo Alto Networks 2026 Identity Security Landscape |
| 129,000+ | Vulnerabilities verified by Glasswing partners, April to July 2026 | Anthropic, October 2026 |
| 516 of 6,157 | Open-source findings patched upstream out of those Anthropic disclosed, as of October 2 | Anthropic disclosure dashboard |
| 14 of 1,061 | Publicly attributed AI-assisted discoveries confirmed exploited in the wild, by mid-2026 | VulnCheck |
Read those last three rows together. Discovery is enormous. Remediation is a fraction of it. Exploitation of the discovered set is, so far, low. That pattern defines the next twelve months, and Chapter 4 is built around it.
Two other numbers matter for context. Verizon's 2026 DBIR shows vulnerability exploitation overtaking stolen credentials as the top way into a breach for the first time in the report's history, with credential abuse falling to 13% of initial access. That is exactly the trend you would expect when finding bugs gets cheap. And IBM found that shadow AI, unsanctioned AI tools adopted without security review, was a factor in 43% of AI-related breaches, up from 20% the year before. The attack surface is growing from the inside as well.
Who Is Using These Capabilities
Different adversaries gain different things from AI. Lumping them together leads to bad prioritization.
| Threat actor | Before AI | With AI | Risk to a typical enterprise |
|---|---|---|---|
| Nation-state groups | Already found and stockpiled zero-days | Faster discovery across more targets, more parallel campaigns | High for critical infrastructure and suppliers; targeted elsewhere |
| Organized cybercrime | Exploit kits, known CVEs, access brokers | Cheaper custom exploitation, machine-speed lateral movement, AI-written phishing | Highest for most enterprises: profit-driven and fast-adopting |
| Opportunistic attackers | Public exploits and scripts | Agentic tooling that turns modest skill into real capability | Medium to high: the attacker pool expands |
| Insiders | Manual knowledge of systems they can access | AI analysis of code and configurations they are authorized to see | Medium, with outsized impact when it happens |
A few scenarios make this concrete.
A cybercrime crew buys initial access to a mid-market SaaS company. Instead of a human operator spending a weekend mapping the network, an agent enumerates cloud permissions, finds a CI token in a build log, and reaches the production database before the SOC finishes triaging the first alert.
An opportunistic attacker points an open-weight model at the source of a popular self-hosted application, finds an authentication bypass the maintainers missed, and scans the internet for exposed instances.
A nation-state team runs discovery against the firmware of edge devices used by the energy sector. CrowdStrike reported that 40% of the vulnerabilities exploited by China-nexus actors in 2025 targeted internet-facing edge devices. AI makes that hunting cheaper and broader.
The Economics Shifted by Orders of Magnitude
The most underrated part of this story is cost.
| Factor | Traditional research | AI-assisted research |
|---|---|---|
| Main cost | Senior researcher time | Compute plus scaffolding |
| Typical spend per campaign | Months of specialist salary | Thousands to tens of thousands of dollars |
| Output | A handful of critical findings per researcher per year | Hundreds to thousands of candidate findings per campaign |
| Expertise needed to start | Years of specialization | Strong engineering plus a working agent setup |
| Hours of operation | Human working hours | Continuous and parallel |
My estimate (analysis): on these numbers, the marginal cost of a validated vulnerability has dropped by two to three orders of magnitude for anyone with a good scaffold. For a criminal group that already earns millions per year, a $20,000 discovery campaign is a rounding error with an obvious return.
If you want to understand how model pricing drives these economics, my guide to AI tokens and pricing breaks down what compute actually costs at scale.
What Has Not Changed
It would be easy to read this chapter and conclude that everything is new. It is not, and the old threats now come cheaper.
Identity is still a main door. Stolen credentials lost the top spot in the 2026 DBIR, but they did not go away, and the identity population keeps growing: Palo Alto Networks' 2026 Identity Security Landscape report counts 109 machine identities for every human one. AI did not replace credential abuse. It industrialized it.
Phishing is still a favorite AI-enabled entry point. AI-written phishing is personalized and grammatically clean, and CrowdStrike reports adversaries weaponizing AI across reconnaissance, credential theft and evasion. The classic tells your users were trained to spot are disappearing.
Fundamentals still decide outcomes. In incident after incident, the decisive failures are long-lived credentials, flat networks, missing logging and slow patching. AI exploits those faster. It rarely needs anything exotic.
This is good news for defenders. The controls that work against AI-driven attackers are mostly the controls security teams already know: least privilege, segmentation, short-lived credentials, fast patching and behavioral detection. What changed is the tolerance for doing them slowly.
Key takeaways
- AI changed three things at once: the speed, scale and accessibility of vulnerability research.
- 2026 data shows attackers moving in minutes, AI involvement in a quarter of malicious breaches, and exploitation now the top initial access vector.
- Discovery has outrun remediation by a wide margin, while in-the-wild exploitation of AI-found bugs remains low for now.
- The old threats, identity abuse and phishing above all, are cheaper and faster with AI.
- Most effective defenses are familiar. The difference is speed and completeness.
Understanding the landscape is step one. Step two is mechanical: how exactly does a model find a vulnerability, and how does that same loop become an intrusion? That is Chapter 2.