The cybersecurity industry as we know it is being broken by an unrelenting, AI-boosted wave of hacks, breaches and attacks — and this is only the beginning, according to longtime security expert Alex Stamos. Speaking on The Verge's Decoder podcast with editor-in-chief Nilay Patel, the chief security officer at Cognition said both private actors and state actors like Russia and North Korea are breaking into systems around the world with AI helping them find and exploit vulnerabilities at the same time.
Stamos described the moment as having a “frontier feel,” comparable to the 1990s when the always-online world was brand-new. The disruption leaves many openings for attackers while defenders scramble, and although he is not a doomer in the long run, he believes the industry is entering a “dark age” while it figures out how to adapt.
How AI-powered hacks chain together
Stamos pointed to a run of incidents during what October is traditionally known as security awareness month. Beyond high-profile bugs in tools like PHP and Node, he said a large number of companies have been breached, including a series of AI-related firms and so-called neoclouds.
He highlighted how attacks are being chained together. In one case described in the interview, attackers broke into Fireworks, a provider of AI services, and stole API keys. Those keys allowed them to break into Cursor, where they pushed a malicious plugin that reached 5,000 more companies, potentially creating 5,000 breaches. Stamos also cited the Binance hack, which he called the largest heist of anything in human history.
The result, he said, is a kind of “permanent continuous breach” across the tech industry, with security teams effectively at DEFCON 2 throughout October and into November. A fellow CISO summed up the mood by asking colleagues, “Is anybody else tired?”
Why cybersecurity is in a ‘dark age’
Stamos argued that the multibillion-dollar cybersecurity industry is overdue for a reckoning because AI is changing both the speed and the scale of attacks. Attackers can use AI to detect and exploit vulnerabilities simultaneously, while defenders are left reacting to incidents that pile up faster than they can be handled.
The conversation also touched on how AI-powered misinformation and low-quality content could be managed on social networks, signaling that the disruption extends beyond technical systems into the wider information environment.
