The summer of 2026 produced a string of unsettling demonstrations of what happens when highly capable AI agents are given access to real computing environments. In security evaluations involving models from OpenAI, Anthropic, and Meta, agents went beyond the boundaries of their assigned tasks, using credentials without authorization and interacting with third-party infrastructure in unintended ways.
These incidents make for alarming headlines, but rogue agents are hardly the biggest cybersecurity threat posed by rapidly advancing AI. A more consequential shift may be happening quietly: AI is making sophisticated attacks cheaper and easier to carry out.
As models become better at coding, finding vulnerabilities, and other cybersecurity tasks, attackers can potentially carry out increasingly sophisticated operations with fewer people, less expertise, and less time. Guardrails still keep the strongest models in check
So far, the most capable AI models have mostly remained under the control of a handful of large companies. Providers invest heavily in safety, restrict potentially dangerous requests, monitor abuse, and can tighten safeguards when new techniques for bypassing them emerge.
Those restrictions are not foolproof, but they do raise the barrier.
They also work only as long as the provider retains control. With a commercial cloud-based model, the provider decides what the model can do and can change those rules. With a model that can be downloaded, modified, and run locally, much of that control disappears.
Until recently, there was a relatively straightforward trade-off: the strongest models came with guardrails, while open-weight models offered greater freedom at the cost of capability. That trade-off is becoming less pronounced as developers release increasingly capable open models.
Attackers do not need a model that beats the best commercial systems on every benchmark. They need one that is good enough at the tasks that matter to them. A smaller model optimized for vulnerability research or exploit development may be more valuable than a stronger general-purpose system if it can be modified, fine-tuned, and operated without provider monitoring.
Cybercriminals have already demonstrated demand for unrestricted AI. WormGPT, FraudGPT, GhostGPT, and other so-called Dark LLMs have been advertised on underground forums for years. Many have fallen short of their marketing, and commercial models have often remained more practical.
But the important point is that the demand already exists. What attackers have largely lacked is unrestricted capability comparable to the best commercial systems. Doing more with less
As that capability gap shrinks, the equation changes. The most immediate effect may not be thousands of newcomers suddenly becoming sophisticated hackers. Instead, AI can make existing attackers significantly more productive.
Finding vulnerabilities, developing exploits, adapting malware, and troubleshooting attacks all require expertise and time. A sufficiently capable unrestricted model can reduce both, allowing a small team — or potentially a single operator — to attempt work that previously required several specialists.
There is a useful precedent for what happens when sophisticated capabilities suddenly become easier to reproduce.
In 2016, Mirai automatically infected poorly secured IoT devices and assembled them into a botnet capable of launching enormous DDoS attacks. But Mirai’s real impact did not end with its creators. Once its source code was published, other criminals could modify and reuse it without having to solve the original engineering problem themselves. Numerous variants followed, and descendants of Mirai remain active today.
AI could accelerate the same dynamic. Developing a new attack technique or adapting a model may still require considerable expertise. But once that work has been done, it can potentially be packaged, copied, modified, and reused by people who could never have developed it themselves.
The difficult part only needs to be solved once. What this means for defenders
For defenders, the consequence is straightforward: sophisticated attacks may become more common simply because they become cheaper to execute. Organizations should expect attackers to find vulnerabilities faster, adapt tools more quickly, and automate tasks that previously required considerable manual work.
Defense therefore has to become more automated as well. AI can help with penetration testing, code analysis, incident investigation, and identifying blind spots in security strategies. But that does not mean inserting an LLM into every security process. Real-time network filtering, for example, operates at a latency and scale that makes model inference a poor fit.
The goal is not to fight AI with AI. It is to build defensive systems capable of keeping up with attackers who can suddenly do much more with much less.
_____
About Andrey Leskin
Andrey Leskin is the CTO at Qrator Labs. With over a decade of experience in commercial development and high-performance hardware and software solutions, he has been with Qrator Labs since 2013, advancing from developer to CTO. Andrey oversees product management and technological strategy, playing a pivotal role in shaping the company’s innovative approaches.
Join our LinkedIn group Information Security Community!
