Cyberattacks are changing as AI tools become capable of finding software weaknesses and producing ways to exploit them. In an interview with The Verge, cybersecurity expert Alex Stamos described a shift that could make attacks faster and harder for companies to contain.
AI is changing the sequence of an attack
In the traditional model Stamos describes, attackers did much of their research in advance. They studied software, identified vulnerabilities and prepared exploits before deploying them against a target or many targets.
AI can compress those steps. Stamos says systems can now examine targets, search for bugs and write exploits as they go. That changes the pace of the work: attackers may not need to prepare every part of an operation well ahead of time.
The term “kill chain” refers here to the sequence of actions used to achieve an effect, such as stealing information, disabling a service or taking money. If AI can automate much of that sequence, attackers can potentially move from finding a weakness to acting on it with less delay.
Breaches can spread through connected companies
The interview describes security incidents that can lead into one another through services and software used by multiple companies. Stamos points to an alleged chain involving Fireworks, Cursor and a malicious plugin. According to his account, stolen API keys from Fireworks were used to access Cursor, and a plugin was then distributed to 5,000 more companies, creating the possibility of further breaches.
This kind of chain makes a breach more than a problem for the first organization involved. When companies depend on outside providers and shared tools, a compromised account or software update can create exposure elsewhere. The account in the interview illustrates how quickly one incident may become a broader response effort.
Stamos also describes security teams facing sustained pressure, with incidents and vulnerabilities arriving in quick succession. The strain is not only technical: organizations must investigate what happened, fix weaknesses and assess whether other systems may have been affected.
Open tools can lower the barrier to entry
Stamos names ARTEX as one example of an AI-related tool discussed in connection with recent attacks. He says the tool is open source and that an English translation is available on GitHub. In his account, it was first used against three South Korean banks, followed by about 200 more companies that week.
The broader concern is that capable tools may be accessible to more than highly resourced attackers. Stamos says it has been a long time since someone could download an open-source tool and use it to break into very large companies. That accessibility could widen the range of groups able to attempt attacks.
The interview says attackers include a variety of groups, including private and state actors. AI can help them detect and exploit weaknesses, but the source does not suggest that every incident has the same origin or method.
A difficult transition for defenders
Stamos compares the current moment to the early days of an always-online internet, when the security landscape felt unsettled. He does not describe himself as pessimistic about the long term, but warns that the transition may involve a “dark age” as organizations work out how to respond.
That response will require adapting to a different tempo. If attackers can discover and exploit flaws in real time, defenders face pressure to identify problems and fix them quickly, while also keeping track of risks that may have spread through suppliers or software. The interview presents this as an industry-wide challenge rather than a single bug with a simple remedy.
AI’s effects also extend beyond breaking into systems. The conversation touches on misinformation and AI-generated content on social networks, raising another question for platforms: how to manage harmful material at scale. Together, these issues point to a broad security shift, with companies and platforms still working out what effective defenses should look like.