Autonomous AI Hacking and What It Means for Cybersecurity

For years, the idea of an AI that hacks on its own sounded like conference keynote material. In 2025 it quietly became an operational reality. AI agents can now scan, exploit, persist and exfiltrate with little human involvement, and they do it at a speed and scale no human team can match. Security experts including Heather Adkins, Gadi Evron and Bruce Schneier have argued that this shift could change the economics of cybersecurity, and the evidence from a single summer makes that argument hard to dismiss.

Consider what surfaced in just a few months. On the research side, XBOW, an AI security startup, climbed to the top of HackerOne's US leaderboard after reporting more than a thousand new vulnerabilities. Seven finalist teams in DARPA's AI Cyber Challenge collectively found 54 previously unknown flaws within four hours of compute time. Google said its Big Sleep agent had uncovered dozens of new bugs in open source software.

The criminal side moved just as quickly. Ukraine's CERT documented Russian malware that queried a large language model at runtime to generate reconnaissance and data-theft commands on the fly. Anthropic reported shutting down an actor who had used Claude to run an extortion campaign almost end to end: mapping networks, breaking in, harvesting credentials, choosing which data to steal, pricing ransom demands and drafting the threatening messages. Another actor used the same model to build and sell ransomware with anti-recovery and evasion features. Check Point described attackers using a framework called HexStrike-AI to automate scanning, exploitation and persistence, and researchers showed that hundreds of published vulnerabilities could be reproduced quickly from public information alone. Tooling is spreading too: a Chinese AI pentest tool named Villager, built on DeepSeek, automates complete attack chains and is freely downloadable.

All of this goes far beyond what the autonomous systems at DARPA's 2016 Cyber Grand Challenge could do. China runs its own annual robot hacking competition, which may be at a similar level, though little information about it leaves the country.

Why This Could Be a Turning Point

The concern is not that AI agents are suddenly better than every human expert. The most skilled professionals still hold an edge for now. The concern is that an agent does not need to beat humans across the board to be dangerous. Being dramatically better on just one dimension, whether speed, scale, breadth or sophistication, is already enough to matter, and the trend suggests agents will eventually improve on all four.

That has several uncomfortable consequences:

• Expertise becomes a commodity. Finding and weaponizing bugs used to require rare skills and a lot of time. Agents compress both, which helps average criminals far more than it helps elite ones.
• Old assumptions break. Defenders have long relied on having a window to patch after a flaw is disclosed, and on the idea that withholding exploit details slows attackers down. Neither holds when an agent can rebuild an exploit from a patch note in minutes.
• The whole kill chain gets automated. Persistence, obfuscation, command and control and endpoint evasion are being stitched together into integrated pipelines. Vulnerability research can even happen mid-operation rather than months in advance.
• Goals replace instructions. A criminal can hand an agent an objective as broad as "maximize profit," while a state actor can specify detailed operational requirements such as avoiding detection, and let the system work out the rest.

Offense has historically enjoyed the advantage in security. Autonomous agents threaten to widen that gap to a point where individual organizations, and the industry collectively, cannot keep pace.

How AI-Powered Defense Might Catch Up

The same capabilities are available to defenders, and the more optimistic view is that they can be organized into something systematic. Nobody knows yet which defensive technologies will benefit most, but a plausible path can be sketched in four overlapping stages.

OpenAI Launches Codex Security: The Automatic Patching Revolution in Cybersecurity

OpenAI has announced Codex Security, a new AI agent that can autonomously find and patch security vulnerabilities in software.

An Emergency Brake for AI: A 3-Stage Plan From OpenAI and Anthropic

Anthropic CEO Dario Amodei and OpenAI CEO Sam Altman called for slowing down and auditing AI development over the security risks of autonomous AI agents.

Stage One: Supercharged Vulnerability Researchers

The first effect is simple leverage. AI takes work that once required deep specialization and makes it accessible to more people, while letting experienced researchers move faster or focus on the creative problems machines still struggle with. Security has seen this pattern before: reverse engineering was painstaking manual labor until tools like IDA Pro arrived. Vulnerability discovery could follow the same arc, moving from scriptable interfaces to automated workflows to largely automated research.

Stage Two: VulnOps as a Discipline

Between research breakthroughs and broad enterprise use, a new operational practice may appear, which some call VulnOps. Large research teams already build pipelines around their tools, much as DevOps once turned software delivery into a repeatable process. In this stage, specialist research tooling becomes a product for developers, whether delivered as a SaaS platform or as an internal framework. The aim is AI-assisted vulnerability research that is repeatable, scalable and plugged into normal engineering processes rather than reserved for a few experts.

Stage Three: Continuous Discovery in the Delivery Pipeline

If organizations adopt AI security the way they adopted CI/CD, vulnerability discovery becomes just another pipeline stage. A natural extension is what might be called continuous discovery and continuous repair: flaws found and patched automatically before code ever reaches production. Third-party risk management offers a low-friction entry point here, since vendor testing, procurement checks and certification gates are relatively low-stakes places to prove the approach before rolling it out more widely.

Stage Four: Networks That Heal Themselves

The most ambitious stage is organizations finding and fixing bugs in software they run, including vendor products, without waiting for an official update. Building in-house research teams for that has always been expensive, but agents could produce patches across many kinds of code, extending the existing practice of independent patches for open source. This would raise real security levels, but it also raises hard questions about patch correctness, compatibility, liability, right-to-repair and how customers and vendors relate to each other when customers start patching products themselves.

None of these stages is guaranteed. AI-powered attacks may evolve differently than feared, and defensive AI may turn out to offer advantages that are hard to foresee today. The most likely surprise is the one nobody is currently modeling. What seems clear is that organizations which treat AI as part of their security operations, rather than an add-on, will be better placed for whichever version of this future arrives.