The rapid evolution of AI makes reactive security obsolete. The new approach involves testing models in high-fidelity simulated environments to observe emergent behaviors from the outside. This allows mapping attack surfaces even without fully understanding the model's internal mechanics.

A key threshold in AI-driven hacking has been crossed. Models can now autonomously chain multiple, distinct vulnerabilities together to execute complex, multi-step attacks—a capability they lacked just months ago. This significantly increases their potential as offensive cyber weapons.

Defenders of AI models are "fighting against infinity" because as model capabilities and complexity grow, the potential attack surface area expands faster than it can be secured. This gives attackers a persistent upper hand in the cat-and-mouse game of AI security.

Unlike human attackers, AI can ingest a company's entire API surface to find and exploit combinations of access patterns that individual, siloed development teams would never notice. This makes it a powerful tool for discovering hidden security holes that arise from a lack of cross-team coordination.

The same AI technology amplifying cyber threats can also generate highly secure, formally verified code. This presents a historic opportunity for a society-wide effort to replace vulnerable legacy software in critical infrastructure, leading to a durable reduction in cyber risk. The main challenge is creating the motivation for this massive undertaking.

AI tools aren't just lowering the bar for novice hackers; they are making experts more effective, enabling attacks at a greater scale across all stages of the "cyber kill chain." AI is a universal force multiplier for offense, making even powerful reverse engineers shockingly more effective.

The public narrative about AI-driven cyberattacks misses the real threat. According to Method Security's CEO, sophisticated adversaries aren't using off-the-shelf models like Claude. They are developing and deploying their own superior, untraceable AI models, making defense significantly more challenging than is commonly understood.

AI 'agents' that can take actions on your computer—clicking links, copying text—create new security vulnerabilities. These tools, even from major labs, are not fully tested and can be exploited to inject malicious code or perform unauthorized actions, requiring vigilance from IT departments.

Generative AI's positive impact on cybersecurity spending stems from three distinct drivers: it massively expands the digital "surface area" needing protection (more code, more agents), it elevates the threat environment by empowering adversaries, and it introduces new data governance and regulatory challenges.