For the first time in 19 years, the Verizon Data Breach Report, which samples over 22,000 breaches across 145 countries, has a new number one initial access vector: vulnerability exposure. So for nearly two decades attackers have gotten in through misused credentials and suddenly in 2026 it’s changed. Why is that?
The same reason lots of things have up-ended recently. Artificial Intelligence.
Two AI Models Break Out and Break In
It’s one thing to see a stat, but this shift hits closer to home in the form of actual anecdotes. Let’s look at two recent incidents that highlight the new door attackers are using and it’s significance.
On July 21st, OpenAI reported that a model which was supposed to be in an isolated test environment without access to the internet found a previously unknown zero-day vulnerability in JFrog Artifactory, which is a registry cache proxy, and then used said vulnerability to access the production environment of Hugging Face. This is the AI attack fear everyone pictures. Rogue model or even a model controlled by bad actors discovers a niche vulnerability that no human would ever uncover and quickly exploits it for access.
Incident two.
A little more than a week after OpenAI’s disclosure, Anthropic made a disclosure of its own. They reviewed over 140,000 of their model evaluations and found three incidents where their models that were supposed to have no internet access went on to access production infrastructure of other organizations. The difference between these incidents and the one OpenAI reported is that the Anthropic models didn’t even discover some novel zero-day vulnerability to exploit. It found regular misconfigurations, unauthenticated endpoints, weak passwords, SQL injections, and credentials found on an open debug page. It wasn’t reinventing the wheel when it came to how to break in, but it was doing it at a scale that a human could not. In one instance it scanned 9,000 potential targets before identifying one with the right vulnerabilities to allow for compromise.
The other interesting thing is the discovery of the breach. Anthropic would have never even noticed their model had escaped containment and breached other organization’s production if it hadn’t been for OpenAI’s disclosure, which prompted them to go back and investigate their 140,000 or so model evaluations.
The two takeaways from this is that AI models are very capable of finding vulnerabilities (duh) and it can exploit them very quickly and without setting off any alarms.
The CISO’s Calculation Has Changed
Vulnerability backlogs have always been a way of life. Security teams always knew there were some vulnerabilities, but only the ones that could realistically be exploited were worth closing. Now, with models that can scan 9,000 opportunities for a single vulnerability without a human even touching the keyboard, that backlog doesn’t seem like an acceptable thing to keep anymore.
But also, the backlog wasn’t just being left for fun, it was there because no human or even team of humans could realistically go through and fix every vulnerability at a large organization.
Which brings us to the obvious conclusion that the only solution to AI driven offense is AI driven defense. If attacks are moving at machine speed, both discovery and exploitation of zero days or the Anthropic style of using regular breach tactics at a massive scale, then defense and hygiene needs to happen at machine speed.
Defense in a World of AI Attackers
One lesson from this is that attackers are not always going to be malicious. You don’t have to just watch out for Eastern European ransomware groups or Nigerian scammers. You now have to worry about some of the largest private companies in the world running tests in what they think is a sandbox environment and those tests going rogue. Attacks can come from anywhere.
I can’t find the source now but I saw someone once say that long horizon multi-step LLM tasks are like tying a lawnmower to your dog so he can mow the lawn. You can’t be surprised if your neighbors' hedges get ruined. LLMs are powerful but can also be unpredictable over long horizons.
These models may not be trying to conduct an attack at all and just sort of accidentally breach your organization. You need to be thinking of things differently.
This changes what "good security" looks like. Until now the goal was just to keep everyone out. This was a bit of a game of whack-a-mole but it was maintainable when the pool of people capable of getting in was small and mostly human. But now that pool just got a lot bigger, a lot faster, and almost entirely non-human. Not to mention some of it isn't even hostile.
Perhaps the new paradigm isn’t "how do we keep every attacker out," but rather "when something gets in, how fast can we shrink what it's able to touch?"
When it comes down to it you are doing two things, shrinking the attack surface (where they can get in). This is not new. And shrinking the blast radius (what they can touch). These are jobs that are actually very well suited to AI. A machine that never sleeps can do the unglamorous hygiene that used to sit on your backlog forever: killing dormant accounts and stale service identities, stripping standing privileges down to only what is actually being used and quarantining the thing that is behaving like it scanned 9,000 targets in an afternoon. Much of this is not stopping intrusion, but limiting the impact if it were to happen. Because the impact takes seconds.
The intruders are using agentic weaponry. The future is agentic defenses. With a human in the loop, of course.
