October has traditionally been labelled “security awareness month”, with firms urging staff to rotate passwords and adopt managers. Yet behind the usual checklist, a cascade of high-impact incidents has unfolded, exposing the limits of conventional hygiene.
In a recent interview, Alex Stamos – chief security officer at Cognition and lecturer at the Stanford University Cyber Policy Center – painted a stark picture: the multibillion-dollar security industry is being outpaced by a relentless wave of AI-enhanced attacks, and the fallout is only beginning.
AI-powered automation of the cyber kill chain
The classic kill chain describes the sequential steps an attacker follows – reconnaissance, vulnerability discovery, exploit development, and final compromise. Historically, each phase required a skilled human, a lengthy research cycle, and bespoke tooling. Artificial intelligence is collapsing that timeline. Open-weight models now scan target environments, discover zero-day flaws, generate working exploits, and launch attacks in near-real time, all without human supervision.
State-aligned groups and private actors alike have begun to embed these models into their operations. The result is a “turn-the-lights-on” capability: an automated system can scan thousands of endpoints, weaponize findings on the fly, and push malicious code at scale. The speed and breadth of this new kill chain turn isolated vulnerabilities into systemic risks.
Cascade of high-impact breaches
One of the most vivid illustrations of this shift was a cryptocurrency theft described as the largest heist of anything in human history. The breach exposed a chain of vulnerable APIs, which were then weaponized to infiltrate a downstream platform. That platform subsequently distributed a malicious plug-in that reached 5,000 additional organisations, creating a potential breach vector for each of them. The ripple effect underscores how a single compromise can cascade into thousands of secondary incidents.
In the same timeframe, an open-source tool dubbed ARTEX – a Chinese-origin framework now publicly available – was leveraged to penetrate three South Korean banks. Within days, the tool was repurposed against roughly 200 more companies, demonstrating how a readily downloadable package can enable attacks on multi-billion-dollar enterprises without the need for bespoke code.
Open-source tools and the new economics of attack
The economics of cybercrime are being rewritten. Decades ago, the attacker ecosystem relied on a steep hierarchy: a few elite researchers crafted exploits, a larger pool of “script kiddies” simply ran pre-made tools, and defenders could often out-spend or out-skill the adversary. Today, powerful AI models run on commodity hardware – even a high-end Mac Studio can host a quantized version of a large language model – granting modestly resourced groups the same exploit-generation capabilities once reserved for state-level labs.
This democratisation erodes the traditional “skill barrier”. A newcomer can download ARTEX, feed it a modern foundation model, and instantly gain the ability to locate vulnerabilities, write exploits, and pivot across networks. The result is a surge in opportunistic attacks that target midsize firms lacking dedicated security teams, amplifying supply-chain disruptions that ripple through entire sectors.
While the landscape feels chaotic, Stamos cautions against fatalism. He likens the current moment to the “wild west” of the late 1990s, when a handful of experts could break Windows systems but the internet was not yet the backbone of global commerce. The difference now is scale: the entire economy runs on digital infrastructure, and AI has lowered the entry price for destructive actors.
Understanding this transformation is essential for anyone responsible for digital assets. The convergence of AI-driven automation, open-source attack frameworks, and a shifting economic model means that traditional defensive playbooks must evolve rapidly, or risk being outpaced by the very technology that fuels the attacks.
