# AI has broken cybersecurity. We're in a dark age. > Attackers now use AI to find and exploit vulnerabilities in real time. Defenders are scrambling to adapt, and the economics of hacking have shifted forever. - Title: AI has broken cybersecurity. We're in a dark age. · The Verge - Summary: Attackers now use AI to find and exploit vulnerabilities in real time. Defenders are scrambling to adapt, and the economics of hacking have shifted forever. - Keywords: cybersecurity, artificial intelligence, hacking, vulnerabilities, alex stamos, cognition, ransomware, data breaches, artex, linux kernel, operational security, The Verge - Source: The Verge — https://theverge.com/podcast/1029038/ai-cybersecurity-hackers-data-breach-dark-age-alex-stamos - Author: Nilay Patel - Published: 2026-11-07T15:00:00+00:00 - Read time: 4 min - Topics: cybersecurity, artificial intelligence, hacking, vulnerabilities, alex stamos, cognition, ransomware, data breaches, artex, linux kernel, operational security, technology ## October was brutal for security October is security awareness month, but instead of routine password changes, companies faced major breaches. PHP and Node bugs emerged. AI companies were breached in succession. Binance suffered the largest heist in human history. ## Breaches are chained together now Fireworks, an AI services provider, was hacked. Stolen API keys let attackers break into Cursor. From Cursor, they pushed a bad plugin to five thousand more companies, causing five thousand potential breaches. ## Security teams are exhausted A CISO friend told colleagues, "Is anybody else tired?" Everyone said yes. The industry has been at DEFCON two for all of October and into November. > Is anybody else tired? ## Who is attacking? Multiple groups. Russia, North Korea, and Chinese contractors are all involved. But the real change is that AI has enabled attackers to automate the entire kill chain, the steps needed to compromise a target. ## The kill chain has inverted Traditionally, attackers researched targets, found bugs, wrote exploits, then deployed them. Now AI systems find bugs and write exploits in real time against hundreds or thousands of targets simultaneously. ## ARTEX is the tool everyone fears ARTEX is a Chinese open-source tool available on GitHub with an English translation.Powered by a model like GLM-5.3, it can break into a shocking number of organisations.It started with three South Korean banks. ## It feels like the nineteen nineties Alex Stamos says this is like the early days of the internet when Windows was a security disaster.Back then, a couple hundred people had hacking skills and were mostly good guys. ## The economics have completely changed Attackers no longer need frontier models with protections and logs.They can run quantized open-weight models locally on a Mac.The cost per token for attackers is going towards zero. ## Skill gaps have collapsed There used to be a hierarchy: script kiddies, tool writers, vulnerability researchers, and gods.Now AI gives script kiddies the skills of the gods. ## Small teams can now do what armies did Two or three Russian kids with Macs or Nvidia H-100s can run agents all day.They can do what used to require a twenty person Russian ransomware team. ## Software security is only part of the job As a CISO, Stamos says software security is twenty five percent of his job.AI has revolutionised and improved that part. ## Defenders need cheaper AI tools Security operations centers watch logs and respond to attacks.Companies must replace human analysts with AI, starting with cheaper traditional classifiers, then small LLMs, then larger ones.One frontier model investigation costs nine hundred dollars. ## We are entering a dark age Stamos says we are not doomed long term, but we are entering a dark age.Things will get more bleak.The responsibility of those in cybersecurity is to help shorten that dark age. > we are entering a dark age ## Patching alone will not work If a codebase has ten thousand bugs, rewriting it is now cheaper than finding and fixing each one.Companies need to stop patching and start refactoring. ## Google or Amazon should rewrite Linux Stamos proposes Google or Amazon spend one hundred million dollars to rewrite the Linux kernel in Rust.It would eliminate drivers for old hardware nobody uses. ## Every company must red team itself now In the next ninety days, every company must run an AI attack on itself using ARTEX or an equivalent red teaming product.If you do not, you will get breached.Some dude will do it to you. > If you do not, you will get breached. ## Red teaming contracts are terrifying Red teaming companies promise verbally it is completely safe.Their contracts say the product will give you cancer, will end the human race, and you hold them harmless. ## Conservative risk frameworks block defense Most large companies have risk management frameworks that prevent them from red teaming themselves. Lawyers demand one hundred million dollars in insurance. Vendor risk processes are so onerous that accepting the risk is impossible. ## Defensive agents need hard limits Defensive AI agents must be plugged into logs, EDR, and cloud systems with deterministic limits on what they can do.An agent might turn off accounts in Okta, but only up to a limit. ## Automatic bug fixing is the only way through Companies must autonomously fix software bugs at scale.Stamos is helping a company scan repositories with Mythos, finding and fixing thousands of bugs, verifying with tests, and merging pull requests automatically.This takes days instead of years. ## Key takeaway AI has democratised hacking, letting small groups exploit vulnerabilities faster than defenders can patch them. Alex Stamos, chief security officer at Cognition, says we are entering a dark age of cybersecurity.