AI Has Driven Cyberattack Costs Near Zero, But the Cybersecurity Industry Still Charges Per Incident

Alex Stamos currently serves as Chief Security Officer at Cognition, and also teaches at Stanford University's Cyber Policy Center. He shared on The Verge's Decoder podcast that the familiar era the cybersecurity industry has long operated in is now over. The multi-billion-dollar security industry was built on a set of old assumptions: very few people could find zero-day vulnerabilities, even fewer could organize coordinated attacks, attacks required upfront R&D and post-development execution, and defenders had enough time to roll out patches. AI is dismantling all of these assumptions one by one.

What he describes is not a far-off future, but the situation over the past month. AI-focused firms and neocloud platforms have been breached one after another. Binance was looted, in what he calls the largest heist in history. The Cursor incident triggered a whole chain reaction: Fireworks was breached, API keys were stolen, attackers gained access to Cursor, pushed a malicious plugin that spread to 5000 companies, creating 5000 potential data leak points. A CISO friend of his asked in a group chat if anyone still wasn't burnt out, and everyone replied that they were exhausted. The whole month of October felt like we were permanently at DEFCON 2.

Who's carrying out these attacks? The sources are wide-ranging. North Korea has dedicated teams that specialize in stealing Bitcoin, and social engineering played a huge role in the Binance breach. Most of the groups hacking into AI companies are small contracted teams based in China, what the industry calls the "cottage access industry" — they break into systems, then sell the accessed data to larger firms. The more critical factor is tools. Alex mentioned an open-source Chinese tool called ARTEX, which has English translations available on GitHub. Hook it up to models like the "obliterated GLM-5.3", and it can break into a staggering number of organizations. It first hacked three South Korean banks, and this week around 200 more companies were hit. He says it's been a very long time since you could just download an open-source tool and break into multi-billion dollar companies, it feels like we're back in the 90s.

The old attack chain was: research, find vulnerabilities, write exploits, deploy. AI has flipped that order entirely: the system directly scans targets, finds bugs in real time, writes exploits in real time, and breaches the system in real time. The old skills pyramid has been flattened. Back in the day there was a huge gap between script kiddies and people who could build attack tools, and only a few hundred people in the world could reverse Microsoft patches and write stable exploits. Now a moderately skilled person with a Mac Studio and an open-source model can do much of the work that used to be reserved for top-tier "god-level" security researchers. Defenders are still paying per headcount and per hour, while attackers' marginal costs are sliding toward zero.

Alex leads security at Cognition, and he says software security only makes up 25% of a CISO's job. AI has drastically improved the bug finding and bug fixing part of the work, but the other 75% is where the real headaches lie. For example, security operations centers have to sift through massive volumes of logs, determine if someone is using their own technology against them, then decide how to respond without shutting down the entire company. This type of work can be delegated to AI, but you can't run raw PB-scale logs directly through a large LLM as a first step — that's far too expensive. You first use traditional classifiers, TF-IDF, and small models to filter data, then escalate only the suspicious bits to large models. He mentioned that some of his peers spend $900 on a single investigation using state-of-the-art models, which makes it impossible to compete against attackers whose marginal costs are nearly zero.

He also offered a very specific recommendation: rewrite old legacy code. When you scan and find 10,000 bugs in a codebase, rewriting the whole segment is often cheaper than patching each bug individually. He's currently helping a company connect all their code repositories, use models like Mythos to scan for bugs, fix them, write test cases for validation, and auto-merge PRs. Work that would take human teams years can be done automatically in days. The Linux kernel is an even bigger example: he says Google or Amazon should partner to fork a production server-grade Linux kernel, rewrite it in a memory-safe language like Rust, and cut out all the unused drivers. The total cost would be around $100 million, which is a massive bargain compared to the global social cost of constantly patching and rebooting machines over and over again.

Over the next 90 days, every single company has to run an AI-powered red team drill, referring to this practice with the shorthand "RTX". You can use off-the-shelf AI red team products, or hire third-party teams to run it. If you skip it, you will get hacked. There's a very real contradiction here: AI red team operations are non-deterministic, vendors claim their products are secure on paper, but their contracts shift almost all the risk onto the client. But you still have to do it, because a 19-year-old who just shut down his Call of Duty match and runs red team tools on his gaming PC could stumble onto your critical vulnerability first.

He's very wary of the word "swarm". Whenever he hears someone use the term "swarm", he discounts their technical advice by 20%. During the Hugging Face incident, OpenAI's "swarm" had between 700 and 1400 agents, with underlying hardware costs ranging from $300 million to almost $1 billion. He estimates the electricity cost for a real swarm attack could easily hit the millions of dollars, which is extremely uneconomical. Most real attacks only use one agent, maximum two. You can deploy defensive agents, but they need hard deterministic limits: for example, the agent can suspend Okta accounts, but only up to 3, and any action over that limit will flag for human approval.

On the topic of model provider liability, his take is very nuanced. If a model breaks out of its containment and launches attacks on its own, the model maker should be held responsible. The far more pressing problem right now is bad actors using models from all kinds of sources to launch attacks through other people's devices and IP addresses. Another problem is defenders getting blocked by model access controls. If your security team is running an investigation on your worst possible day, and suddenly gets flagged as a malicious actor and cut off, that's a catastrophic outcome. He also notes that the US only makes up 5% of the global population, and legitimate defenders in Europe and Asia get even worse treatment from these systems.

On the problem of content platforms, he offers a counterintuitive angle. Detecting fake content will always be a probabilistic problem, and it's only going to get harder. Verifying real content, on the other hand, can be done very reliably with cryptography. Products like Instagram actually have a simple path to implement this: the entire content pipeline can be contained within iPhone sensors and the app itself: photos come directly from the camera, all edits happen inside the app, and no AI-generated content can enter this pipeline. He says his three teenage kids hate low-quality AI slop, and there is huge unmet demand for authentic real content. Someone is going to disrupt Instagram on the back of this.

At the end, he lays out several observation metrics for this coming "dark age": the total number of major data breaches drops, the volume of wormable CVEs falls, the number of patches released on Microsoft's monthly Patch Tuesday drops from over 900 back down to reasonable levels, and the wave of emergency patches that drops right before new model launches shrinks. He wants to build a public "Dark Age Index" to track these metrics. Alex doesn't think we'll hit perfect cybersecurity any time soon, nor does he think we're heading for an immediate apocalypse. He's far more worried about real people using AI to harm other people, than the hypothetical P(doom) parroted by 24-year-olds who only ever studied AI. He says he's in favor of slowing down the pace of frontier model releases, and reallocating cheap model capacity to the defensive side, but he also admits he's living in a world that other people set the rules for.