AI Can Now Hack Faster Than Your Team Can Patch. Here’s What to Do About It

The advantage attackers once gained from speed is now being amplified by artificial intelligence. An AI agent can scan exposed assets, identify vulnerable services, analyse attack paths, test exploitation techniques, and move to the next target far faster than a conventional attacker. What once required hours or days of manual reconnaissance can increasingly happen in minutes, accelerating the rise of AI-powered cyberattacks.

For security teams, this creates a difficult reality: the window between vulnerability discovery and exploitation is getting smaller. A vulnerability may be detected today, but if remediation takes days or weeks, an AI-enabled attacker may not wait. The question is no longer simply whether your organisation can find vulnerabilities.

Can your security team discover, validate, prioritise, and fix them before an AI-powered attacker exploits them?

How AI Agents Change the Speed of Cyberattacks

Traditional attack automation generally follows predefined instructions. Agentic systems can use feedback to determine their next action. They can inspect a service, interpret an error, adjust an approach, and invoke another tool with less continuous human direction. This capability is increasingly shaping AI-powered cyberattacks, where automated systems can adapt their actions based on the target’s response.

This helps attackers connect activities that previously required repeated manual effort. Reconnaissance, exploit development, troubleshooting, and follow-up actions can become parts of a coordinated workflow. Multiple agents can also work on different tasks simultaneously, increasing the speed and scale of AI-powered cyber attacks.

For example, an attacker used AI agents across exploit development and operational activity. However, results varied between victims, and a web application firewall blocked an attempt against one target. AI increased the campaign’s speed and reach, but defensive controls still affected its success. The practical implication is that organisations must reduce the interval between discovering a weakness and preventing attackers from using it.

Recent AI-Agent Attacks Show the Risk Is Already Real

This is not simply a theoretical concern. Recent incidents demonstrate how agentic AI can change the speed and scale of cyber operations.

The PaperCut Campaign: Coordinated Exploitation at Scale

On September 9, 2026, GreyNoise disclosed a campaign that began on August 31 against PaperCut NG/MF vulnerabilities CVE-2026-81578 and CVE-2026-82078.

The investigation found that the attacker used hundreds of AI agents powered by a DeepSeek model, with OpenAI’s Codex serving as the execution harness. GreyNoise explicitly distinguished the harness from the underlying model.

The attack compromised at least 440 PaperCut instances belonging to 395 identified organisations across 48 countries. Once the campaign fully launched, ld uxwgsxwlzok at least eleven organisations within twenty-six seconds. GreyNoise observed domain administrator access at twelve victim organisations; that outcome did not occur across every compromised environment.

CERT-In’s October Advisory: Agent-Driven Intrusions in India

CERT-In’s October 15, 2026 advisory, CIAD-2026-0049, described a financially motivated campaign against Indian entities involving publicly available AI-native offensive-security frameworks.

CERT-In reported that agentic tooling compressed the time between initial access and final impact from days to a few hours. Some organisations that remediated incompletely were attacked again within days, at greater scale. The advisory did not publicly identify the campaign’s victims or provide a definitive victim count.

It also described separate incidents involving research agents exceeding their authorisation. Those incidents should be distinguished from deliberate risky activity

Move From Periodic Testing to Continuous Security Validation

However, application releases, infrastructure changes, and newly disclosed vulnerabilities can introduce exposure between assessments. As AI cyber threats continue to evolve, attackers can identify and act on these weaknesses faster, increasing the risk of AI vulnerability exploitation.

Build a testing programme that combines periodic expert-led penetration testing with ongoing vulnerability discovery and targeted validation. Run additional checks after significant deployments, authentication changes, new integrations, and critical security advisories. This approach helps organisations identify weaknesses before they become opportunities for AI vulnerability exploitation.

Each activity serves a purpose. Automated scanning helps identify potential weaknesses across assets. AI-assisted validation can help establish which findings are genuine and relevant, while expert-led testing examines business logic, authorisation failures, and attack chains that require deeper contextual understanding.

For example, a scanner might identify an exposed application and an outdated component separately. Further testing should determine whether that component is reachable, whether exploitation is possible, and what access a successful attacker would gain. This becomes particularly important as AI cyber threats enable attackers to correlate seemingly minor weaknesses into actionable attack paths.

Want to know more about vulnerability scanners? Check out AutoSecT, an AI-driven pentest and VM Platform. 

The outcome should be a prioritised remediation queue supported by evidence. Every significant finding needs an owner, a corrective action, and a retest that confirms closure.

Strategies to Protect Your Organisation from AI-Powered Attacks

To defend against AI-powered cyberattacks and reduce the risk of AI vulnerability exploitation, security teams should take the following steps.

• Maintain Visibility Across Your Attack Surface

Keep an updated inventory of applications, APIs, cloud workloads, network devices, and software dependencies. Record each asset’s owner, business importance, and internet exposure. Include staging environments, forgotten subdomains, and vendor-managed systems so teams can quickly identify potential entry points for AI-powered cyberattacks.

• Prioritise Vulnerabilities by Business Risk

Assess vulnerabilities based on exploitability, public exposure, available privileges, and potential business impact. To reduce the risk of AI vulnerability exploitation, prioritise actively exploited weaknesses affecting critical systems. Establish clear ownership and emergency approval processes to prevent urgent fixes from being delayed.

• Reduce Exposure While Preparing Fixes

When patching requires additional testing, apply temporary controls. Restrict public access, disable unnecessary services, isolate affected workloads, or limit access to trusted networks. Assign each temporary measure an owner and a deadline for permanent remediation.

• Limit Access and Prevent Lateral Movement

Apply least privilege to users, applications, and service accounts. Segment networks, protect administrative interfaces, and separate backup access from everyday operations. These controls help prevent lateral movement and limit the damage when an attacker compromises a public-facing system.

Conclusion

AI is changing the speed, scale, and sophistication of cyberattacks. With AI agents automating reconnaissance, vulnerability discovery, and exploitation, attackers can identify weaknesses and act on them faster than traditional security processes can respond.

Recent incidents, including the PaperCut campaign and CERT-In’s October advisory, demonstrate why organisations cannot rely solely on periodic security assessments and manual remediation. A delayed patch, an overlooked asset, or an unverified vulnerability can create an opportunity for attackers.

To stay ahead of AI-powered cyberattacks, organisations must move towards continuous security validation, AI-assisted vulnerability detection, risk-based prioritisation, and faster remediation. 

FAQs