01 Trigger Event
On The Verge’s Decoder podcast, Cognition CSO and Stanford Cyber Policy Center lecturer Alex Stamos described the current situation as follows: AI is enabling private actors and state actors such as Russia and North Korea to improve vulnerability discovery and exploitation simultaneously. Multiple breaches have already occurred, while the multibillion-dollar cybersecurity industry has yet to finish adapting.
The episode focused on the previous month, citing supply-chain vulnerabilities involving PHP and Node, as well as successive compromises of AI-related companies and neoclouds. Stamos also referenced the Binance hack, calling it “the largest theft in human history.”
The original account, however, did not provide a complete breach timeline, financial losses, or attack samples. These examples therefore cannot be treated as proof that AI already drives every incident. His comments are better understood as a security leader’s qualitative assessment of an expanding attack surface than as a rigorous attribution report.
02 What This Really Means
The issue is not that AI has created an entirely new category of malware. It is that AI is compressing the operational friction on both sides of the security contest.
Discovering vulnerabilities, validating them, writing exploits, and adapting them to target environments once required substantial engineering expertise. Now attackers can use models to assist with code review, payload generation, scan-result processing, and social-engineering content. Defenders can use AI too, but both sides gain the same general-purpose leverage.
This is where convergence theory is most applicable: as the marginal cost of generating, validating, and distributing exploits falls, the most valuable capability is not yet another vulnerability scanner. It is a workflow that connects vulnerability context, identity permissions, cloud assets, and incident response. An isolated detector does not automatically become a defense moat; the depth of data and workflow integration does.
Stamos evoked the frontier atmosphere of the 1990s, when an always-online world was still a new concept, to show that the change is not merely greater model capability. Enterprise exposure has also expanded from attacking an application to attacking dependencies, credentials, and employee behavior. Once supply-chain nodes are interconnected through APIs, OAuth tokens, CI/CD pipelines, and third-party agents, an attacker who finds an edge foothold can move laterally across the permission graph.
What will ultimately be priced is not how much AI a company uses, but whether it can shorten the detection-to-containment time.
03 Historical Analogies and Structural Comparisons
The shift resembles the cloud migration enabled by AWS in 2014 more than an ordinary feature upgrade.
When enterprises moved computing and storage into the cloud, the central benefits were elasticity and lower marginal cost. New risks included IAM misconfiguration, blurred lines of shared responsibility, and the failure of traditional perimeter devices. AWS did not eliminate hacking; it moved the attack surface from the data center to the control plane and created a new industry around cloud security.
AI has a similar but more difficult effect on cybersecurity. Cloud migration generally required architectural transformation, whereas attack automation can begin before enterprises change their architectures. Attackers can enumerate configuration errors at scale, generate tailored phishing content, and iterate on exploits. If defenders still rely on manual alert triage, quarterly patching cycles, and static rules, the resulting speed asymmetry becomes extremely dangerous.
The 2008 financial crisis also demonstrated that adaptability does not emerge automatically. Financial institutions already had risk models, regulatory frameworks, and specialized talent, yet when new tools moved faster than governance, legacy control systems failed collectively. Stamos’s “dark age” does not mean permanent technological chaos. It refers to a transition period in which organizations cannot rebuild their security operating models quickly enough.
Zero trust provides another historical comparison. Zero trust was not initially the purchase of a zero-trust product; it redefined access so that every request had to be authorized based on identity and context. AI-driven security will likewise move beyond a product checklist toward continuous behavioral judgment. Yet, as AI enters both offense and defense, the fixed knowledge framework of traditional security awareness training will lose value. Attackers can translate messages in real time, alter their tone, and fabricate context, making static training increasingly difficult to maintain.
04 What This Means for AI Builders
First, re-examine agent permission scopes now. Reading code, calling models, accessing production telemetry, and executing shell commands should not share one set of credentials merely because they operate inside the same agent. Agent identities must be independently revocable and should have separate audit logs. Although I have not conducted internal red-team validation, any architecture that treats “the model will not deliberately exceed its permissions” as a security boundary is unsound.
Second, treat MCP servers, OAuth scopes, API key rotation, and egress policies as one threat model rather than separate DevOps checklists. If an MCP tool description exposes sensitive paths, or a server permits broad access by default, stronger models will produce more efficient tool calls and a larger incident radius.
Third, build a dedicated evaluation set for security agents. Do not assess them only on whether they can identify known CVEs. Test whether they can identify genuine attack chains in noisy logs, recognize low-confidence but high-impact anomalies, and propose actionable containment steps. For AI builders, the most valuable internally deployed security agent will often compress alerts into a small number of high-signal incidents rather than automatically remediate them, because autonomous remediation remains constrained by the cost of false positives.
Fourth, incorporate model routing into security policy. Using low-cost models for log classification and high-capability models for complex exploit analysis is a sensible arrangement. However, if prompts and retrieved context move among models and providers, data residency, retention, and subprocessor risks must be explicit. Cheapest-token economics cannot be the sole optimization objective.
Fifth, do not conflate hallucination risks in customer-facing agents with prompt-injection risks in internal agents. The former affects content quality; the latter can become privilege escalation once connected to real tools. Evaluation metrics should include at least prompt injection, indirect instruction injection, and tool-policy violation.
The adjustment needed this month is not to buy one more security product. It is to define which models may access which data, invoke which tools, retain information for how long, and who has the authority to disconnect them immediately when an incident occurs.
05 Counterarguments and Risks
I may be overestimating AI’s marginal contribution to the recent increase in attacks. The breaches cited in the original account do not individually establish that their exploit chains used AI. AI may also be amplifying existing processes more effectively rather than creating an entirely new attack paradigm. If subsequent disclosures show that most incidents still involve credential theft, weak supply chains, and traditional vulnerabilities, attributing the current disorder to AI would obscure older, less sophisticated infrastructure problems.
I may also be underestimating the gains available to defenders. Attackers need reliable exploits, low false-positive rates, and scalable infrastructure, while enterprises possess comprehensive telemetry, asset inventories, and identity graphs. AI may provide a greater advantage on the defensive side, particularly in log analysis and vulnerability prioritization. If AI reduces attack costs fivefold while reducing defense costs twentyfold, the net effect may not be worse. No public data supports this calculation, and I have not run the relevant internal benchmark; the point is that the supply and demand sides of the market are not directly symmetric.
Another risk is excessive securitization. If security teams frame every AI-driven incident as “unprecedented,” they may drive expensive control programs with low returns. A SOC does not need to chase every model-generated alert; it needs better signal quality, patch cadence, and containment drills.
Finally, the episode’s title is compelling, but Stamos’s “dark age” is first an assessment of the industry’s adaptation period, not a measurable inflection point. The indicators that could falsify it are not breach counts, but attack speed, time from public disclosure to exploitation, time from detection to isolation, and the actual share of all incidents involving AI-enabled attacks. Without these data, the safest conclusion is that AI is increasing the speed of both offense and defense, existing security organizations may be adapting too slowly, and no firm conclusion can yet be reached on which side will ultimately hold the structural advantage.