The Evolution of AI-Enabled Cyber Offense
When sophistication scales: vulnerability exploitation, attack chains and the future of enterprise pentesting
Featuring perspectives from CISOs at leading global enterprises.
The Evolution of AI-Enabled Cyber Offense
From Capability to Campaign
AI-enabled cyber offense has moved beyond isolated productivity gains. Models can already support vulnerability research, exploit development, privilege escalation and post-compromise navigation. What often separates these actions from a campaign is not raw capability, but operational discipline: the ability to sequence actions, maintain access, learn from failure and avoid detection.
Raw cyber capabilityFinding vulnerabilities, generating exploits, obtaining access and navigating an environment
Operational tradecraftCoordinating actions, controlling noise, protecting access, preserving tooling and operating without triggering detection
Campaign
The breadth of raw capability is already significant. In an analysis of 832 banned accounts associated with malicious cyber activity, Anthropic observed AI use across all 14 MITRE ATT&CK tactics and 482 unique sub-techniques, from initial reconnaissance through final impact. The dataset does not measure the prevalence of AI across the entire threat landscape, but it demonstrates how much of the attack lifecycle current models can already support. More importantly, Anthropic’s analysis found that the highest-risk cases were distinguished less by the number of techniques used than by how AI was orchestrated across them.
The Evolution of AI-Enabled Cyber Offense
Current models may still be noisy and operationally immature. They can identify paths to privilege escalation and make rudimentary attempts at stealth without displaying the discipline of an experienced operator. But that clumsiness is not a durable safety boundary.
Attackers can supply the missing discipline through scaffolding that maintains context, coordinates tools and adapts actions based on results. This can make existing models more focused, persistent and repeatable without waiting for the next leap in model intelligence.
Once that operation becomes reproducible, sophistication begins to scale.
When Sophistication Scales
Offensive capability becomes systemic when it is no longer confined to frontier labs or elite teams. Three forces are accelerating that shift: capability diffusion (open-weight performance), private access and falling operating costs.
Capability diffusion: The UK AI Security Institute found that leading open-weight models performed similarly to frontier closed models released only 4 to 7 months earlier. Open models are not at the frontier across every task, but the frontier advantage increasingly resembles a delay rather than a durable barrier.
Private access: Safeguards and regulations can constrain hosted services. Open-weight models can be run privately, modified and stripped of safeguards. Once released, their weights cannot be recalled, according to the International AI Safety Report 2026.
Falling cost: In July 2026, Kimi K3 completed a 32-step simulated network attack in one of ten attempts, within a 100-million-token limit. The range included an intentional attack path and no active defenders, so it should not be treated as a real-world breach. Still, the full token allowance would cost roughly $300 to $1,500 at current API prices. But the deeper cost shift is labor. Tooling that once required specialist developers, operational security and detection testing can increasingly be generated, deployed and replaced when burned. Offensive tooling becomes fungible.
The Evolution of AI-Enabled Cyber Offense
Efficiency is the inflection point.
Long-running frontier models can already discover novel vulnerabilities and complete complex attack chains, but brute-force inference remains expensive and inconsistent. As open-weight models improve and scaffolding focuses their work, these capabilities become cheaper and more repeatable.
Alt’s research team estimates that an attack chain comparable to the Hugging Face incident (see section 5) could cost 100x less than the reported costs with a tailored harness and lower-cost model.
The Evolution of AI-Enabled Cyber Offense
Attacker gold rush
The evolution of AI-enabled cyber offense is creating an “attacker gold rush”. Attackers can run at full speed with little infrastructure or valuable access to protect. Defenders must match that pace while safeguarding production, customers, uptime, compliance and the agents themselves.
This asymmetry accelerates what Google Threat Intelligence Group describes as the “industrial-scale application” of AI across exploit research, malware development and adaptive execution. Advanced methods do not have to become universally available to scale.
The AI offense-defense asymmetry
Run unrestricted models
Tolerate failure and retry
Discard detected tooling
Scale across targets
Govern defensive agents
Prevent production disruption
Protect customers and data
Maintain compliance and availability
Attackers optimize for speed and iteration. Defenders must achieve speed without sacrificing safety or control.
The Evolution of AI-Enabled Cyber Offense
Vulnerability Exploitation
Becomes the Primary Way In
The significance of AI-enabled offense lies not only in what models can do, but where those capabilities meet the current breach landscape. In the 2026 Verizon Data Breach Investigations Report, 31% of breaches now begin with the exploitation of software vulnerabilities, surpassing phishing and stolen credentials as the leading path to initial access.
Vulnerability exploitation becomes the primary way in
Known initial access vectors in non-Error, non-Misuse breaches over time
Source: Verizon 2026 Data Breach Investigations Report
AI could intensify this shift through volume first, then novelty.
Google Threat Intelligence Group observed APT45 sending thousands of repetitive prompts to analyze CVEs and validate PoC exploits. This allows operators to research more products, test more weaknesses and build a more reliable exploit arsenal.
Novel vulnerability discovery is also emerging. GTIG reported a zero day that it assessed with high confidence had been discovered and weaponized with AI assistance. The flaw used a hardcoded trust assumption to bypass 2FA, illustrating the kind of contextual logic vulnerability traditional scanners often struggle to identify.
The immediate risk is not a sudden flood of AI-generated zero days. It is vulnerability research becoming continuous, systematic and more closely connected to exploitation.
Initial access, however, does not equal impact.
The Evolution of AI-Enabled Cyber Offense
A vulnerability becomes consequential when it connects to privileges, credentials, reachable systems and sensitive assets. This exposes the limitation of programs built around vulnerability counts, severity scores and isolated findings. They describe the weakness, but not the attacker’s most important question:
What can this vulnerability help me reach?
From Security Testing
to Attack-Chain Validation
If AI changes how attacks are executed, it must also change the way enterprises test. Using agents to run more scans or generate more findings risks automating the same checkbox exercise at greater speed.
Traditional scanners remain valuable, but AI does not automatically make security testing more intelligent. It scales the method it is attached to. A targeted harness changes the objective: determine whether an exposed application or another enterprise entry point can be used to gain privileges, move laterally or reach a critical asset.
This is the premise of Targeted Offensive Security. The harness supplies the objective, context, tools, safety boundaries and success criteria. Within those limits, the agent can maintain context, test assumptions and adapt when a path fails. Machine speed becomes valuable because it is directed toward proving a complete path to impact, not maximizing findings.
Model evaluation already reflects this distinction. AISI separates narrow cyber tasks from long-horizon cyber ranges because success on an isolated skill does not prove that a model can plan and execute an end-to-end attack. Enterprise pentesting should make the same shift: from accelerating checks to validating complete attack paths.
Real attackers do not experience an environment as a collection of findings. They combine vulnerabilities, identities, misconfigurations and application logic into a route to impact.
The Evolution of AI-Enabled Cyber Offense
Attack-chain validation shifts the unit of analysis from an individual weakness to the complete route from exposure to impact. A critical vulnerability may lead nowhere, while several moderate weaknesses may combine into a viable chain. The objective is to identify which paths are exploitable, which controls can break them and whether remediation has actually closed them.
Because every deployment, permission change and integration can alter those paths, validation must be continuous. The measures change accordingly: viable attack paths, demonstrated impact, time to validation, time to closure and the number of attack chains broken by a single remediation.
The objective is not to produce more findings relentlessly.
It is to leave threat actors with fewer viable ways in.
The Evolution of AI-Enabled Cyber Offense
This creates a paradox for defenders. Security teams need agents because machine-speed attacks compress the pauses humans once used to detect lateral movement and intervene. But useful agents require access, persistence and freedom to adapt. Those are the same properties that make them risky. They do not need malicious intent to cause damage. An objective, sufficient access and the freedom to find another route may be enough.
A targeted offensive harness must therefore do two jobs: direct the agent toward meaningful impact and make its operating boundary enforceable, including which surrounding systems it can access or repurpose. The right mental model is a privileged insider operating at machine speed.
The answer is controlled autonomy, built on two complementary layers:
Deterministic guardrails
establish boundaries that cannot be negotiated through model reasoning. Under the principle of least agency, each agent receives only the tools, data and permissions required for its current task. Controls should include explicit target allowlists, deny-by-default network egress, short-lived identities, proxied access, prohibited action classes and mandatory approval for destructive operations.
Model-based oversight
provides the context that fixed rules cannot. An independent model can inspect potentially dangerous commands, evaluate behavior against the assigned objective, detect scope drift or attempts to probe containment, and decide whether to allow, block or escalate an action. It can also recognize when individually permitted steps are forming an unsafe trajectory.
Deterministic controls establish where the agent may act. Model-based oversight asks whether its actions inside those boundaries are becoming unsafe. Both layers depend on strong identity, complete audit logs and immediate human interruption.
The unit of trust is not the model.
It is the controlled workflow built around it.
The Evolution of AI-Enabled Cyber Offense
Make autonomy earned
Start with one bounded workflow, such as triaging an alert, validating an exploit or enriching an investigation. Give the agent the minimum authority required to complete it.
Deterministic controls should define the hard limits. An independent model should evaluate behavior inside those limits. Humans should retain authority over irreversible consequences. Expand autonomy only as the evidence supports it: demonstrated accuracy, policy adherence, complete observability and reliable interruption.
Targeted Offensive Security is how defenders turn machine speed into path closure.
It directs adaptive testing toward critical assets, validates the routes an attacker could complete and identifies the choke points that break the most paths. The goal is not indiscriminate coverage. It is to focus machine-speed testing where successful compromise would matter most.
Attackers win by completing the chain.
Defenders win by breaking it first.
