Cybersecurity Is About to Be the Biggest Problem in Tech
[](https://substackcdn.com/image/fetch/$s_!9hw_!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Ff3c9dcfa-f5f9-4f92-bd74-d7f1bac144a7_3840x2160.png)
Back in June, the head of the NSA told a U.S. senator that Anthropic’s Mythos model broke into “almost all of [the NSA’s] classified systems, not in weeks, but in hours.”
That was an authorized red-team test. Not a real breach. But think about that: one of the best-defended organizations in the world was broken into by an AI released _months ago_.
Just last week, a security researcher revealed that a Chinese-speaking criminal had pointed autonomous AI agents at more than 1,200 websites, using an open-source AI platform called Cairn. With almost no human help, the agents got into sites belonging to more than 100 companies, including Deere, SharkNinja and Cummins. Nobody knows how much data, if any, they took.
If you have a vulnerable system accessible to the network, assume it’s going to be attacked. We have made the intelligence of hackers available for free, and it can be run in parallel as teams, or in swarms, of agents.
This has made me wonder whether businesses will shut down their online services to start going offline, in order to protect themselves. Will that even matter? Who says there aren’t more complex ways to get in?
Cybersecurity has always been an “acceptable risk” sort of thing. You might not have perfectly secure systems, but you’d ask yourself, “Well, who would want to attack me? Maybe nobody. I’m probably fine.”
That logic is backwards now. An agent looks for weak targets with something worth taking: private data, or control.
That makes small businesses the most likely victims. In Verizon’s 2026 breach report, ransomware showed up in 83% of breaches at organizations with under 1,000 employees, compared to 48% across all breaches. Healthcare and government were the top targets in Cisco Talos’s data for the first quarter of this year.
And anyone running AI tools on the internet is in the crosshairs. A bug in marimo, an AI notebook tool, was exploited within 10 hours of going public.
First, a quick definition. An AI _agent_ is software that can run code or use a computer like any normal person would, or even in more complex ways, all driven by the thinking of an LLM like ChatGPT or Claude.
Agents are cheap and capable of using the exact same tools that human hackers used before. China has a lot less compute than the U.S., so its labs put their research effort into making models more efficient. That makes better models for cheap, and every release is cheaper than the last. DeepSeek V4 Flash is literally free to use for coding agents right now. Since its weights are public, anyone can run it on their own hardware, possibly with safeguards removed. It’s almost a race to the bottom on prices.
Someday soon there could be a free coding agent running on someone’s computer that is capable of hacking. They have nothing to lose by pointing it at you and seeing if they can get in, assuming there’s no recourse.
Picture a hacker somewhere in the world at the helm of a swarm of hundreds of agents running on free open-weight models with their safeguards removed, each one working a different piece of a complex attack or running analysis. They can do pretty much anything a human hacker can: find a vulnerable system, get in, install backdoors, drop payloads, launch more attacks. Just more diverse and more adaptive than any human team.
And they’re fast.
In 2018, attackers took about two months on average to start exploiting a newly announced vulnerability.
By 2023 it was about five days.
Google’s Mandiant team now estimates attacks typically start about a week before a fix even exists. Meanwhile, the median time companies take to patch critical bugs has risen to 43 days.
Attackers only need one weak point. An old Windows 7 desktop or server, or an outdated OS of any kind, is a very easy way into your network. Once an agent is on that machine, it can work out exploits for everything else on the same network, even emulating apps or websites you use, and move laterally from device to device.
When someone finds a security flaw, it usually gets a public ID called a CVE and a write-up describing the problem. That’s meant to help defenders patch. But attackers are using the public CVE lists to find vulnerable targets. An agent can check which version of a piece of software you’re running, look up which published flaws affect that version, and try them. Google’s threat researchers say attackers now likely use AI to compare old and patched versions of software to figure out exactly what was fixed, then build an attack for everyone who hasn’t updated yet.
That’s exactly how the first documented AI-run ransomware attack worked. In June, an agent that researchers named JADEPUFFER broke into a company through Langflow, an AI workflow tool. The bug it used had been fixed more than a year earlier and was already on the U.S. government’s list of known exploited flaws. From there it used default passwords and an old security key nobody had ever updated to move deeper, then encrypted the company’s database, deleted the originals, and left a ransom note. Every weakness it used was old. A lot of computers aren’t updated regularly, and those will be prime targets.
Phishing will be an enormous issue, with sophisticated impersonation attacks, and it’s already starting. One unaligned agent can scrounge up detailed information about a person from the internet, including videos of them shared by their own accounts or their friends’. Then it can use a real-time voice model to clone their voice and sound just like them when it calls you, or their family, asking for “help” with money or something sensitive.
The FBI is already warning that scammers clone voices from short clips posted online. People on social media are telling everyone to set up a password with their family, and the FBI recommends the same thing: a secret word or phrase that’s never written down or mentioned anywhere. KnowBe4 found a 41% rise in Microsoft Teams attacks, often from people posing as IT staff, HR or executives.
Many cheap, no-name smart devices ship with little to no security. The Kimwolf botnet infected over 2 million devices, mostly off-brand Android TV boxes, through a developer debug mode left switched on with no password.
I bet that botnet attacks are about to become enormously popular due to the widely available IoT devices in nearly every home. Earlier this month Anthropic tested whether small AI models can copy themselves across cheap internet-connected devices, and a Chinese open-weight model, GLM-5.2, managed it in a simplified test. We haven’t seen a fully autonomous AI worm yet, but I think that’s the next logical phase for software that can reason for itself and solve problems it runs into along the way. And maybe the worm of cheap, locally-run AI models communicates up to a larger model that orchestrates the swarm. Who knows?
If you use AI agents, they’re a way in too. Palo Alto Networks found real web pages hiding instructions meant for AI agents that read them, telling the agents to start Stripe and PayPal payments and delete databases. An agent that reads the web and has access to your accounts can be tricked into acting against you. Notably, users found that Meta has started hiding agent instructions in their documentation pages to avoid providing legal advice, likely for their AI assistant Muse.
The add-ons you give your agent are another common source of vulnerabilities: skills, plugins and tools can be poisoned before you ever install them. In one incident, researchers confirmed 1,184 malicious skills published for a single agent platform. And agents run on API keys, which tend to end up in code, config files and logs. A leaked key lets an attacker run AI on your bill, or act as your agent with whatever access you gave it.
Those aren’t the only ways, either. Anything your agent can read, install or touch is something an attacker can try to turn against you.
Often you won’t know for a while. Mandiant found attackers sat inside networks for a median of 14 days before anyone noticed, and 122 days for spies.
Do agents leave evidence? Less than humans do. Traditional malware reuses the same files and servers, so security tools can recognize it. JADEPUFFER wrote fresh code for its one victim, so there were no known-bad files to scan for. In the future, agents might leave almost no trace at all. Defense has to shift from “look for known bad files” to “notice when something behaves strangely.”
What do they want from us? Usually one of four things.
Ransom: lock your data and charge you to get it back. Your data and passwords, to sell or to get into something bigger. Your computing power and internet connection, which Kimwolf rents out and uses for attacks.
Or _compute_ itself: attackers steal AI API keys to run models on someone else’s bill, which security firm Sysdig calls “LLMjacking.” Theft of AI service credentials rose 376% from late 2025 to early 2026. I’ve also heard of AI models looking for jobs so they can earn enough money to pay for cloud computer services to run more attacks or expand their networks. (But they’re probably just being naive — of course they would be better off using botnets of IoT devices in residential homes where nobody would even know anything was awry aside from the FBI showing up at their door months later.)
We don’t have the capacity to protect every vital computer and service exposed to the internet, so assume few websites and services are actually secure anymore. What you can do is make sure your own stuff isn’t an easy target and help spread the word.
- **Use a password manager.** Bitwarden or 1Password. Use a strong, unique password everywhere, and memorize one master password to unlock them. Turn on two-factor login wherever you can.
- **Turn on your firewall on every device.** Firewalls monitor network traffic in and out of your device, blocking anything that doesn’t meet its security rules. This is genuinely one of the best defenses against outside attackers: what cannot _connect_ generally cannot _control_. Again — why I think many people and businesses will simply choose to go offline.
- **Keep everything up to date.** Apps and operating systems, with automatic updates on. Vulnerabilities get exploited the day they’re discovered, and plenty of opportunistic attackers are waiting for exactly that. The best protection is staying up to date, and running popular software that gets those critical updates ASAP. That also includes all of the apps you run.
- **Retire old machines.** If an old Windows 7 box is still on your network, it’s a weak point.
- **Close doors you don’t use.** Every always-on remote access service is a way in: SSH, FTP, Remote Desktop, Remote Control on Claude and ChatGPT, and the debug mode on Android devices. Turn off what you don’t need, turn off UPnP on your router so devices can’t open ports on their own, change default passwords, and skip no-name internet-connected devices.
- **Keep offline backups.** Ransomware can’t encrypt a backup it can’t reach.
- **Limit what your AI agents can do.** Give them only the access they need, and require your approval for anything that spends money, deletes things, or performs potentially risky actions.
- **Use your coding agents or Claude to review your own systems for vulnerabilities.** They can search your computer for hidden weak spots that you’d normally have a hard time finding. But beware that they _love to find things_, so you may end up with a report of 50 issues that are really only 3 big issues with a bunch of BS filler for the rest. As usual with AI, take it with a grain of salt.
Right now the scariest hacking abilities are locked inside frontier models like Mythos, which only a handful of organizations can use. But that won’t last much longer.
Chinese labs release most of their models as open weights, meaning anyone can download and run them, and modify them. And they’re a lot closer to the frontier than people realize. Epoch AI, a research group that tracks AI progress, measured open-weight models’ hacking ability at about six to seven months behind the best closed models. The top open model, Z.ai’s GLM-5.3, already beats OpenAI’s GPT-5.4 from this past March.
The Institute for Progress, a think tank, predicts a Chinese lab will release a Mythos-level model by the end of this year. My bet is the next big Chinese releases land around January or February 2027, and they’re going to be crazy.
(Because what’s a good crisis if there isn’t a buck to be made in the commotion?)
I bought CIBR and NET in my retirement account. CIBR is a cybersecurity ETF holding many of the primary cyber defense companies that will be shielding other big companies from these attacks. NET is Cloudflare — which is already 3.8% of CIBR holdings — but they do a lot of interesting things around the internet, cloud hosting, and cybersecurity. I like using their products, and I believe that they will be steadily more important, so I decided to start investing in them.
The issue with these tech stocks however, is that the really smart investors have already thought about how much money they are likely to make in the future, so that value is already _priced in,_ meaning we are paying the cost of a business that will do really well in the future. CIBR holdings are all of those tech companies they expect to do great in the next few years, so if they happen to do really badly, then expect the value to plummet. If they do really amazing, however, it will just keep going up steadily. That’s the risk.
The stock price of CIBR since 1 year ago. Notice that the price began to rise rapidly around the time AI cyberattacks became popular in June.
In general, I like to think of it as, the market prices are representative of the present and future expectations. You don’t buy a business for how much money it makes today, you are also paying for how much money it will make down the road, since that’s a big part of a company’s value. Expect fluctuations as expectations change and adjust. Just food for thought.
Tech is getting crazy by the day. In June we had agents at OpenAI hack into the AI hosting platform Hugging Face, criminals are already pointing agents at real companies for attacks, and free open-weight models aren’t far behind the frontier.
You don’t have to become a security expert. But “who would want to attack me?” isn’t a plan anymore. Keep your stuff updated, close the doors you don’t use, and be suspicious of any call or message that asks for money in a hurry, even when it sounds exactly like someone you love.
We should all stay aware of what these tools can do so we can protect ourselves. Raise awareness. If you’re really paranoid, the best solution is less complexity: less apps, less networks, less computers — that’s less targetable.