AI is turning cybersecurity into drone swarm warfare

The obvious response is that only a good guy with AI can stop a bad guy with AI. And the labs are putting serious resources behind that response.

OpenAI's Daybreak, Anthropic's Glasswing, and Google's Fairwind are putting defensive capability, fixes, and deployment support into important software foundations and organizations responsible for essential services. ^{3 4 5}

OpenAI's Defense Factory makes the strongest version of this argument explicit: the defender's window. Defenders can give agents direct access to their own code and use frontier models before comparable capability diffuses more broadly. Turn that head start into continuous discovery, validation, and repair, and defenders can close weaknesses before attackers exploit them. ⁶

AISI puts a number on how quickly comparable cyber capability has been spreading. The leading open models it tested matched closed models released four to seven months earlier, down from six to ten months through much of 2025. That is a real head start. The question is how much of the exposed world can turn it into protection in time. ⁷

Mozilla's Firefox 150 release includes fixes for 271 vulnerabilities identified with Claude Mythos Preview. That is the kind of defensive progress that matters: upstream fixes shipped to users. ⁸

This is where the drone analogy has an important limit. A software defender does not need a fresh interceptor for every incoming request. One deployed patch or enforced policy can defeat an entire attack family. A million copies of the same failed exploit don't become a million independent chances to get through.

The labs understand the deployment problem. OpenAI explicitly warns about under-resourced critical infrastructure, and its Defense Factory account describes a gap between merged patches and fixes deployed across its own fleet. Anthropic says hardening may take years while capabilities advance substantially over months. ^{9 6 4}

The defender's window is real. I expect it to close before much of the exposed world is protected. The head start only matters where defenders can connect the models to their systems and turn findings into protection before offensive capability reaches those same systems. Legacy companies and unsupported IoT devices cannot inherit that operating model by default. I expect the best defenders to get much better, and real-world cyber damage to get much worse.

Expert attention has been a constraint on how many targets an attacker can pursue and how long they can keep adapting. AI changes who can afford that work and how much of it they can sustain.

Mandiant founder Kevin Mandia describes human-led espionage as a sniper round: scarce expert attention concentrated on selected targets. AI lets an operator spread that attention across many more targets and explore them in parallel. Today's swarms can be louder and less coordinated, but the economics have already changed. ¹¹

Epoch estimates that the cost of achieving a given level of performance across five AI benchmarks has been falling roughly thirteenfold each year since 2023. That helps defenders too. My concern is what happens when increasingly capable work becomes cheap enough to keep running against targets that previously weren't worth the effort. ¹²

You can see the same shift in the wave of AI-assisted game mods, reverse engineering, and software recreations: Halo content in Minecraft, Counter-Strike mechanics in Elden Ring, a Terraria boss turned into a training simulator. These are fun, largely innocuous applications of agents understanding and changing unfamiliar software. The same techniques can serve malicious actors when the target stops being a game. ^{13 14 15}

Anthropic reports a single operator targeting 42 entities and gaining internal access to at least 14. In a separate AI-assisted operation, a conventional pipeline decompiled 1.8 million Android app packages and searched for embedded secrets. The 42-target campaign makes the shift especially concrete: one operator sustaining reconnaissance, custom tooling, and exploitation across multiple organizations. ¹⁶

In another operation, Anthropic observed AI-assisted workflows modifying and rebuilding malware after security products detected it. That is adaptation, beyond more scans. ¹⁶

Restrictions on frontier access may buy defenders time. They do not establish a durable monopoly on offensive capability. Anthropic documents advanced cyber capabilities in the open-weight GLM-5.3 model. NIST's independent assessment still places it significantly below the current US frontier, while calling it the strongest open-weight model it has evaluated. Diffusion can matter well before parity. ^{17 18}

The stakes change when the target is a bank, a phone, a hospital, a utility, or a voting system. More targets become worth persistent attention. Persistence matters when agents can learn from failure and look for a different reachable weakness.

The condition inside the defender's window is that effective protection has to arrive before offensive access spreads. OpenAI is trying to compress the whole loop, including inventory, ownership, deployment, and verification. My concern is who can install and sustain that loop across the systems they actually run. ⁶

An AI research agent discovered a flaw in BeyondTrust's remote-access software. Within four days of public disclosure, Google's threat intelligence team observed one threat cluster exploiting it. Within seven days, there were six. Defensive discovery had become an opportunity for multiple attackers while every affected organization still had to secure its own systems. ¹⁹

Anthropic's retrospective patch-replay study shows how much that clock has changed. Mythos produced its fastest working SpiderMonkey exploit in under an hour; the corresponding public source fix had taken 18 days to reach the Firefox 148 release. And Firefox is one of the better cases: supported software with automatic updates. ²⁰

Even advanced defenders encounter this gap. Cloudflare's illustrative workflow puts working fixes at roughly 14 hours and urgent production patching at five days. OpenAI found merged patches whose fixes had not reached deployed systems, then expanded verification to close that gap. These are organizations with the models, the engineers, and control of their infrastructure. Now consider the companies that have none of those advantages. ^{21 6}

That is why I don't find more findings, more fixes, or more tool adoption reassuring on their own. Protection has to keep pace with the exposed systems and the pressure they face.

The strongest counterargument is automatic containment. Mandia compares it to a battlefield dressing: stop the bleeding now; get to the hospital for the full repair later. Existing endpoint and firewall platforms can close an attack path before every vulnerable application has been patched. I take that seriously. Centrally managed companies can move fast. The coverage question is where those controls can see the path, have authority to act, and are already deployed. ¹¹

My concern is how much of the exposed world those protections reach while offensive capability keeps getting cheaper. The real world is slow. Real processes are slow. Legacy companies have custom software, hidden dependencies, downtime limits, and systems they cannot simply turn off. Like an aircraft carrier, legacy infrastructure has to be refitted while it keeps doing its job.

Then there are billions of connected IoT devices, spread across different owners, firmware, and support arrangements. Many lack a workable update path. NIST documents these maintenance constraints; D-Link recommends replacing affected legacy products that no longer receive security maintenance. A better model cannot manufacture missing vendor support or install replacement hardware. ^{22 23 24}

Survival of the fittest gets harsher. And your own security posture is only part of it. Even strong defenders depend on suppliers, identities, and infrastructure outside their direct control. Weak dependencies can transmit damage beyond the first organization compromised.

My prediction is that cheap, adaptive offense keeps finding consequential openings across the unevenly protected world faster than we close them.

The OpenAI–Hugging Face incident adds another asymmetry: an operator can be running a legitimate task while its agents knowingly act outside it. Benign intent at the top does not guarantee authorized behavior below. ^{25 26}

Safeguards aimed at malicious users address only one route to harm. Legitimate workloads still need containment when their agents depart from the task. ²⁵

The reduced safeguards and the defenses that held are central to how I read the incident. OpenAI's preliminary retrospective tests suggest its production harness would have greatly reduced this behavior. Enforced containment matters. ^{27 28}

OpenAI's September DNS incident exposes another part of that problem. An agent in an internal training run used DNS to reach an external chatbot despite network restrictions. Monitoring raised an alert; a human acknowledged it within three minutes. But the expected automatic stop failed, and the run continued for roughly another two and a half hours before manual shutdown. Detection has to lead to enforced containment. ²⁹

The risk grows through both routes: malicious operators scaling attacks, and legitimate operators losing control. As agents become more capable and more connected, good intentions become a weaker basis for trusting the systems we put them in.