AI Can Hack Everything? Do the Math First

Introduction

I have written four articles about Mythos-class AI capabilities in the past four months. I described the end of a twenty-year cybersecurity equilibrium. I wrote about what it means for critical infrastructure and OT. I analyzed the AI cryptanalysis results in detail. I meant every word.

I am now going to argue with myself, because the coverage that followed, and the vendor response it triggered, has veered into territory I recognize from three decades of watching security scares produce expensive nonsense.

The cybersecurity conference circuit has a new product category. Vendors are selling “AI-proof” endpoint protection, “AI-resilient” network monitoring, “next-generation” threat platforms purpose-built to withstand autonomous AI attackers. I have seen the pitch decks. Some of them cite my own articles to justify the threat, then offer a subscription license as the remedy. I’ve been in this industry long enough to know what happens next: organizations will spend millions on specialized products and continue to leave their default credentials unchanged.

Here are six things that keep getting lost in the hysteria.

You cannot hack everything if you cannot power the GPUs

The most basic constraint on AI-driven cyberattacks is one that almost nobody in the threat-assessment community is discussing in concrete terms: compute.

When Anthropic swept the OpenBSD codebase with Mythos, roughly a thousand scaffold runs produced several dozen findings at a total cost under USD 20,000. Separately, Mythos found and fully exploited a 17-year-old remote code execution vulnerability in FreeBSD’s NFS server (CVE-2026-4747), granting unauthenticated root access with no human involvement after the initial prompt. The HAWK cryptanalysis cost about USD 100,000 and roughly 60 hours of model time, for one algorithm.

Those costs sound manageable for a targeted operation, and they are. But think about what “hacking everything” would actually require. There are hundreds of thousands of unique software products in active enterprise use. Scanning each to the depth Mythos demonstrated would consume billions of dollars in API credits and require GPU capacity that rivals a mid-size hyperscaler’s inference fleet. Token prices are falling, and they will continue to fall, but physics caps how fast compute scales, and an attacker who concentrates on high-value, widely deployed targets (a widely deployed VPN appliance, a ubiquitous media library, an identity provider) gets far more return than one who attempts to scan every application in existence.

That concentration is exactly how targeted operations work, and it means most organizations will not face a bespoke Mythos-grade campaign aimed at their specific codebase. State actors can absorb six-figure compute budgets for high-value targets, and I have argued that they already are. But the scenario where AI models autonomously compromise millions of systems simultaneously requires more frontier-grade GPU capacity than exists on the planet. The compute to “hack everything” is not being hoarded by a few cloud providers. It has not been built.

The people selling AI-proof products are implicitly arguing that your mid-size manufacturing company faces the same threat as a classified defense network. It does not. Targeted AI-driven attacks will be expensive, specialized operations aimed at high-value targets, and the defense against those is the same thing it has always been: reduce your attack surface, segment your networks, monitor your endpoints, and assume breach.

The real AI weapon is the next WannaCry

If I were planning a large-scale offensive cyber operation with AI assistance, I would not point Mythos at individual targets one at a time. The economics are wrong. I would use it to build a better worm.

In June 2026, researchers at the University of Toronto, Vector Institute, University of Cambridge, and ServiceNow demonstrated exactly this. They built a proof-of-concept AI-driven worm using a publicly available open-weight model running on a single GPU (an NVIDIA A100). It spread through a 33-host enterprise test network, autonomously adapting its attack strategies to each target it encountered, exploiting different vulnerabilities and misconfigurations as it moved from host to host. On the three hosts specifically provisioned with vulnerabilities disclosed after the model’s training cutoff, the worm gained root access on 41 of 67 attempts (61%), generating working exploits at runtime by ingesting public advisories.

An important caveat: the test network was deliberately seeded with known vulnerabilities, the topology was flat, and no endpoint detection or active defense was deployed. Those are laboratory conditions. They are also a fair description of too many real enterprise networks I have assessed over the past thirty years.

This is the WannaCry model updated for the AI era, and it is far more plausible than the “AI hacks your specific firewall” scenario. WannaCry infected more than 230,000 computers across 150 countries in a single day in May 2017 by exploiting one vulnerability (EternalBlue) that had a patch available for two months. An AI-enhanced worm that adapts to multiple vulnerabilities, learns from failed attempts, and generates exploit code at runtime from public advisories is a different animal.

The amplification is the point. You use the expensive AI capability once, to build the weapon. The weapon then runs on its own, at scale. (It is not quite free to operate: the Toronto worm performs hundreds of inference calls per target, and it took roughly five days to reach half the test network. But the worm can shift inference onto compromised GPU-equipped hosts, meaning the attacker’s compute bill shrinks as the worm’s footprint grows.) This is the historical pattern of every weapons technology: the R&D is expensive, the deployment is comparatively cheap. A nuclear weapon costs billions to develop and relatively little to deliver. A cyber worm costs AI compute to design and distributes its own operating costs across its victims.

My colleagues in the threat-intelligence community are spending too much time imagining AI as a direct-action tool and not enough imagining it as a weapons-development platform.

How you beat worms: boring cybersecurity

Here is the part that the vendors selling “AI-proof” products are hoping you will not think about too carefully.

AI-enhanced worms, however sophisticated their adaptation mechanisms, still operate through the same kill chain as every worm since the Morris Worm in 1988. They need a vulnerability to exploit. They need network access to reach the vulnerable system. They need to execute code on that system. They need to persist, discover adjacent targets, and repeat.

Every one of those steps passes through controls that your organization already owns. Network segmentation. Patch management. Endpoint detection and response. Access control. Monitoring and logging. The Toronto researchers’ worm succeeded against systems with known, unpatched vulnerabilities and common misconfigurations like reused passwords. The researchers themselves are candid that their test network’s vulnerability density was artificial. Against a properly segmented network with current patches, enforced credential policies, and functioning detection, the worm’s adaptation capabilities are solving a problem that the defender has already eliminated.

WannaCry did not succeed because it was a sophisticated weapon. It succeeded because hundreds of thousands of organizations had not applied a two-month-old patch. The UK’s National Audit Office found that most infected NHS devices were running supported but unpatched Windows 7. These were current systems with available patches. Appropriate patching or correctly managed firewalls would have prevented the exposure. The organizations that patched were fine. The organizations that segmented their SMB traffic were fine. The organizations that had functioning incident response plans contained the damage quickly.

That finding is more damning than the familiar story about obsolete medical equipment. The failure was not ancient hardware. It was failure to operate supported systems properly.

The next AI-powered WannaCry will succeed for exactly the same reason: not because AI made the attack unstoppable, but because organizations still have not done the boring work. And the vendor who sells you a specialized “AI-resistant” platform while your network has flat segmentation and your domain admin passwords are in a shared spreadsheet is taking your money and leaving you exposed.

I said it in my OT security piece and I will say it here more bluntly: stop buying more products until you can demonstrate that the ones you already own are working as intended. Audit your controls. Verify they work. Test your incident response with scenarios that will actually embarrass people. The gap between “security controls deployed” and “security controls functioning” is where breaches happen, and no AI-specific product closes it. Only the tedious discipline of operational security does.

Even direct AI attacks are traditional attacks, run faster

Set aside the worm scenario for a moment and assume your organization is important enough to be targeted directly by an adversary with Mythos-class capabilities. What does that adversary actually do?

Read Anthropic’s own technical writeups carefully. Every disclosed exploit Mythos produced used familiar techniques: stack buffer overflows, use-after-free vulnerabilities, ROP chains, heap sprays, KASLR bypasses, cross-cache reclamation. The FreeBSD NFS exploit is a 17-year-old buffer overflow. The browser exploit chains four vulnerabilities using a JIT heap spray. The Linux kernel privilege escalations use credential-structure overwrites. The specific vulnerabilities and the ways Mythos assembled some chains were novel, but the underlying primitives are textbook.

These are offensive techniques I taught two decades ago. My team at CyberAgency used variants of them against critical infrastructure in the early 2000s. What Mythos does is execute this playbook at machine speed, compressing weeks of skilled human work into hours. That matters, and I have been clear about the implications. But the techniques are the same ones my teams used twenty years ago, executed faster.

Your firewall does not need to know whether the packet was crafted by a human researcher or by an AI model. Your IDS does not care who wrote the exploit. Your SIEM does not distinguish between a human lateral movement and an AI-directed one. The defenses that stop a skilled human attacker stop an AI attacker doing the same things faster, provided those defenses are actually working. The speed advantage matters because it compresses your response window, not because it requires a different kind of defense.

If the answer to “how do we defend against faster attacks” is “spend USD 2 million on a new AI security platform,” you have been sold. The answer is: detect faster, respond faster, and segment so that speed of initial compromise does not translate to speed of full-estate access. Those capabilities live inside the tools and processes you already have, if you bother to operate them properly.

If AI starts breaking cryptography, the answer is crypto-agility backed by layered defense

The HAWK and AES results published this week triggered a separate wave of alarm about AI breaking encryption. As I wrote in my detailed analysis, no deployed cryptographic system was affected. HAWK is a NIST candidate, not a standard. The AES attack targets 7 of 10 rounds and requires $$2^{105}$$ chosen plaintexts. ML-KEM, ML-DSA, SLH-DSA, Falcon, and production AES are all untouched.

But suppose, for the sake of argument, that the trajectory continues and AI models start producing tier-two findings (parameter weaknesses, not fundamental breaks) across a wider range of algorithms. What is the defense?

The primary answer is crypto-agility: the ability to identify where an algorithm is used, replace it, update dependent protocols and systems, revoke and reissue affected cryptographic material, and deploy the change while preserving operations. A broken encryption primitive may expose passively collected data without the attacker entering the protected network. A broken signature primitive may enable forged certificates, identities, or software artifacts. Segmentation cannot restore confidentiality to ciphertext that is no longer cryptographically secure, and a firewall cannot restore authenticity to a broken signature algorithm. The first response to a weakened primitive must be to replace it and revoke the affected material. Crypto-agility is what makes that possible in weeks rather than years.

Layered defense still matters as consequence containment. An attacker who breaks your encryption still has to use the resulting access to authenticate, move laterally, and exfiltrate data. Network controls, access management, monitoring, data classification, and incident response constrain what happens after a cryptographic failure, even if they cannot repair the failure itself.

Organizations should build crypto-agility during their PQC migration, because the migration is the one time they have executive attention, budget, and a mandate to touch every certificate, library, and protocol endpoint. The AI cryptanalysis results reinforce that case. If an AI model discovers that your chosen post-quantum signature scheme needs a parameter change, crypto-agility is what lets you respond in weeks. Without it, you are stuck with whatever the vendor’s next firmware release provides, whenever they get around to it.

The AI threat to cryptography and the quantum threat to cryptography converge on the same organizational capability. Build crypto-agility once, and you are prepared for both. That is a budget argument I can make to a board in five minutes, and it does not require buying a new product.

Now arm the defenders

Project Glasswing has expanded to roughly 200 organizations across 15 countries, and those organizations are already using Mythos to find thousands of critical vulnerabilities in their codebases. Good. But the admission threshold (infrastructure whose compromise could affect more than 100 million people) excludes most of the actual attack surface: the mid-size manufacturers, the county hospitals, the municipal utilities. The Toronto researchers built their AI worm with a free model on a single GPU. The offensive side is already democratizing through open-weight models. The defensive side should keep pace. Making Mythos-class scanning broadly available to defenders is the right long-term policy, and it is a separate argument I will make at length elsewhere. For now, the immediate priority is simpler.

The answer to AI hacking is not a new product category. It is not an “AI-resistant” firewall. It is not a specialized subscription service that monitors for “AI-generated exploits,” as if the exploit cares who generated it.

The answer is the same answer it has been for thirty years: do cybersecurity well. Patch your systems. Segment your networks. Monitor your endpoints. Test your controls. Practice your incident response. Build crypto-agility during your PQC migration. Give your defenders the best tools available, including AI.

I have spent my career watching organizations chase the latest threat with the latest product while neglecting the fundamentals that would have protected them against every threat, current and future. AI hacking changes the speed of the game. It does not change the game.