AI Automates Cyberattacks at 5,000 Firms, Pushing Security Into a Dark Age
Updated
Updated · The Verge · Nov 7
AI Automates Cyberattacks at 5,000 Firms, Pushing Security Into a Dark Age
3 articles · Updated · The Verge · Nov 7
Summary
API keys stolen from AI provider Fireworks were used to breach Cursor, which then pushed a malicious plugin to about 5,000 companies, illustrating what Alex Stamos called a “permanent continuous breach” across tech.
Open-weight models and tools such as ARTEX now let attackers automate most of the cyber kill chain in real time—finding bugs, writing exploits and moving through targets far faster and more cheaply than human-led teams.
Stamos said the economics now favor attackers: one frontier-model investigation can cost about $900, while small groups can run offensive agents on Macs or gaming PCs at near-zero marginal cost.
He argued defenders must respond by automating first-line security operations, aggressively AI-red-teaming their own systems within 90 days, and in some cases rewriting old codebases instead of patching thousands of flaws.
The broader outlook is a cybersecurity “dark age,” he said, with progress best measured by fewer major breaches, fewer wormable core-software bugs and Patch Tuesday totals falling from recent levels near 900.
With hackers weaponizing AI to exploit vulnerabilities instantly, can automated defensive red-teaming truly prevent the impending cybersecurity dark age?
As AI automates cyberattacks at unprecedented speeds, will a complete rewrite of legacy infrastructure be our only hope for digital survival?
If AI makes detecting deepfakes impossible, can cryptographic provenance alone save us from a future where digital truth no longer exists?