Cyber Offence at Machine Speed

Part IV turns from what AI does to minds and societies to what people do with it. At this scale nothing escapes anyone's control: the machine obeys, and the harm comes from the people it obeys. Cyber offence is where the evidence is strongest. Two years of reports describe a movement from AI as a research assistant to AI running large parts of real intrusions, while the time from disclosure of a vulnerability to its exploitation has collapsed to less than nothing.

The chapter tests T6 The weapon in human hands, the trope of the machine as an instrument of war, terror and crime, in the domain where it can be tested best. It answers the series' open question Q7 on patch-to-exploit times measured in minutes as far as the evidence allows, and takes a first step on Q4, what machine-speed adversaries mean beyond security operations. It keeps the boundary set in Chapter 1 and in AI Red Team, Chapter 1 (F28): adversary behaviour is described at the level of what reports observed and what it means for defence, never as techniques, tools, prompts or steps (180, Nordqvist, 2026). It builds on AI Platform and Security, Chapter 18, which documented the same evidence for platform architects and set out four commitments against AI-enabled adversaries (F18, F19) (179, Nordqvist, 2026).

The exploitation window from 2018 to 2025 falling from 63 days to exploitation before the patch, with AI acceleration and the defender response

Figure 18.1: The time from disclosure to exploitation fell from weeks to less than zero between 2018 and 2025; AI has been observed to accelerate it, and the defender answers with patch velocity and detection at machine speed.

Table 18.1: The window and where AI has been observed to accelerate it.

Period Time from disclosure to exploitation Observed AI acceleration
2018 to 2019 63 days on average
2020 to 2021 44 days
2021 to 2022 32 days
2023 5 days 2024: agents exploit one-day flaws from the advisory
2025 Exploitation before the patch 2025: AI-orchestrated espionage campaign
2026 n-days weaponised at machine speed AI-assisted discovery drives a patch wave; agentic frameworks abused, minutes to deep access

Defender responses: patch velocity as a supervised metric; detection at machine speed with authority to act; AI for defence under oversight.

From misuse to orchestration

The best evidence comes from the developers whose models attackers used; each sees only its own models, but together the reports trace a clear trajectory.

In January 2025 the Google Threat Intelligence Group (GTIG) reported that government-backed groups from more than twenty countries had used its Gemini models, mostly for research, translation and code troubleshooting, found no novel capability and described AI as useful to attackers but not yet a game-changer (141, Google GTIG, 2025). OpenAI concluded similarly in October 2025 after disrupting more than forty networks (144, OpenAI, 2025).

The first sign of change came in August 2025. Anthropic described an actor that used an AI coding agent to automate reconnaissance, credential theft and network penetration at no fewer than seventeen organisations, among them healthcare providers and government bodies, followed by extortion demands that in some cases exceeded USD 500,000, and an actor with limited technical skill who relied on the model to develop and sell ransomware (142, Anthropic, 2025). In November 2025 Anthropic reported the first documented AI-orchestrated cyber espionage campaign: a state-sponsored group, attributed with high confidence to China, used an AI coding agent against roughly thirty targets and succeeded in a small number of cases. Anthropic estimated that the AI performed 80 to 90 per cent of the campaign, with human operators intervening at perhaps four to six decision points, and recorded a limit: the agent at times overstated its findings or reported credentials that did not work, which Anthropic called an obstacle to fully autonomous attacks (143, Anthropic, 2025).

By the second half of 2026 the landscape had changed. Anthropic's report of September 2026 stated that a majority of the operations it described were enabled by AI; in one case an actor collected authentication material from more than forty cloud tenants in about a day and a half and went from a single developer's access to cloud administrator in about three hours. Humans still chose most targets (145, Anthropic, 2026). GTIG's tracker of the same month described a credential-harvesting campaign planned, built and run in less than six hours, but had not yet observed fully autonomous pipelines against targets in the wild (146, Google GTIG, 2026). The ENISA Threat Landscape 2026, covering 2025, read the period more cautiously: attackers primarily used consumer-grade AI tools to augment existing skills, with more phases of the attack chain expected to be AI-enabled during 2026 (78, ENISA, 2026).

Agentic offensive frameworks

The reports of late 2026 describe something closer to a product category. In October 2026 GTIG and Mandiant reported that threat actors had abused open-source agentic penetration-testing frameworks, ARTEX among them, which chain a language model to the tools of a professional tester so that the agent plans and executes the stages of an intrusion itself. The researchers observed bursts of activity lasting a few seconds, one campaign that went from the first compromised account to deep access in about four hours and, in one instance, in about fifteen minutes, and enumeration of more than 110,000 objects in a directory service (148, Blum et al., 2026).

AI, they wrote, "does not fundamentally change the techniques attackers use. It reduces the time required to combine them." The frameworks compress attack timelines to machine speed, but "they currently trade stealth for velocity" (148, Blum et al., 2026). The attacker therefore gains hours and the defender gains a signal, provided detection runs at comparable speed and someone has the authority to act on it. A related strand, agents under evaluation that took unsanctioned actions without any attacker directing them, belongs to Part V and is examined in Chapter 25.

The exploitation window

A security patch tells an attacker where the flaw was, and the limit used to be the skilled time needed to turn it into an attack. Mandiant measured how that limit eroded. The average time from disclosure to exploitation was 63 days in 2018 and 2019, 44 days in 2020 and early 2021, 32 days in 2021 and 2022, and 5 days in 2023, when 12 per cent of later-exploited vulnerabilities were exploited within a day (150, Charrier & Weiner, 2024). In March 2026 M-Trends estimated the mean time to exploit at minus seven days, while adding that it did not consider 2025 the year in which breaches became the direct result of AI (151, Mandiant, 2026). The window was collapsing before AI; AI now pushes in the same direction.

It pushes through the step that used to need skill. In 2024 Fang and colleagues gave an agent built on GPT-4 the public descriptions of fifteen one-day vulnerabilities and it exploited 87 per cent of them, against 7 per cent without the description (149, Fang et al., 2024). In April 2026 Anthropic reported that its Claude Mythos Preview model, tested against forty Linux kernel vulnerabilities with public identifiers, succeeded in more than half of its attempts to escalate privileges, and the two exploits Anthropic documented in detail each cost under one to two thousand US dollars and took less than a day (128, Carlini et al., 2026).

The operational data followed. GTIG's analysis of September 2026 suggested that the rapid weaponisation of n-days, vulnerabilities for which a patch or advisory exists, was the main driver of growth in exploitation. Monthly disclosures rose from 5,045 in January 2026 to 10,740 in August, and exploitation in the wild from about ten vulnerabilities a month in 2025 to eighteen in 2026. Yet only 0.23 per cent of disclosed vulnerabilities were exploited, and GTIG called confirmed exploitation of AI-discovered vulnerabilities "an early indicator rather than an established trend" (147, Grunewald et al., 2026). The first caveat is why prioritisation works; the second is why this chapter treats the AI share of the collapse as emerging rather than proven.

The agencies have acted without waiting for that attribution. The UK National Cyber Security Centre (NCSC) assessed in May 2025 that AI would almost certainly increase the frequency and intensity of cyber threats up to 2027 and warned of a divide between systems that keep pace and a large proportion that would be more exposed (76, NCSC, 2025). In June 2026 the Five Eyes agencies told leaders that "the timeline is not years, it is months" (74, Five Eyes agencies, 2026).

The defender's mirror

The capability that weaponises a patch also finds the flaw before anyone patches it, and in 2026 defenders used it at a scale attackers have not been reported to match. Anthropic stated in April 2026 that Claude Mythos Preview could surpass all but the most skilled humans at finding and exploiting software vulnerabilities, withheld it from general availability and offered access to partners and open-source maintainers through Project Glasswing (129, Anthropic, 2026). AI Platform and Security, Chapter 18, records that by May 2026 about 50 partners had found more than 10,000 high or critical vulnerabilities and that human verification, not discovery, was the bottleneck (179, Nordqvist, 2026).

The mirror has an uncomfortable property, however: every published fix becomes an advisory from which an attacker's agent can work. The NCSC therefore told organisations in May 2026 to prepare for a "vulnerability patch wave" and to move to updating by default (152, NCSC, 2026). The mirror is also temporary. The restriction of the most capable cyber models to vetted defenders depends on a few developers holding them back, and one of them expected comparable models from other companies within six to twelve months (179, Nordqvist, 2026). The head start is measured in months.

Change of degree or of kind

The evidence supports three changes of degree and one that begins to look like a change of kind. Scale: work that cost skilled hours now costs the price of computing, so organisations once too small to attract a skilled intruder become worth attacking, which matters most for municipalities, hospitals, schools and small suppliers, the long tail of the NCSC's divide (76, NCSC, 2025). Speed: every documented case is faster, from hours to cloud administrator to minutes to deep access (145, Anthropic, 2026) (146, Google GTIG, 2026) (148, Blum et al., 2026). Skill: actors whose own skill would not have sufficed complete specialist work (142, Anthropic, 2025). The operator as orchestrator: humans intervened at a handful of decision points while the agent did most of the work (143, Anthropic, 2025), so a small group can run many intrusions in parallel. That is still a human wielding a weapon, which keeps the case in T6, but the ratio of human judgement to machine action has shifted further than ever.

What has not changed is equally important. The techniques are ones defenders already catalogue (148, Blum et al., 2026), humans still chose the targets in most cases, the agents made mistakes that remain an obstacle to full autonomy, and no fully autonomous pipeline has been observed in the wild (146, Google GTIG, 2026). The change is mostly one of degree, but degree at this magnitude is enough to break defences built for the old tempo.

That is this chapter's answer to Q4: if machine-speed adversaries are the normal case, the assumption reaches procurement, because suppliers' contracts set patch times, change management, budgets for legacy systems, and governance, because patch speed becomes a decision of the management body.

What Europe and the series have already settled

Much of the response is already European law. The NIS 2 Directive requires essential and important entities to take risk-management measures including vulnerability handling and supply-chain security (Article 21), makes their management bodies approve and oversee those measures (Article 20), and requires an early warning within 24 hours and a notification within 72 hours of a significant incident (Article 23) (10, European Union, 2022). DORA places responsibility for ICT risk on the management body of financial entities (Article 5) and requires the most significant to undergo threat-led penetration testing (Article 26) (11, European Union, 2022). The Cyber Resilience Act obliges manufacturers to provide security updates without delay (Annex I) and, from 11 September 2026, to notify actively exploited vulnerabilities with an early warning within 24 hours (Article 14) (12, European Union, 2024). In July 2026 the European Central Bank wrote to the banks it supervises about AI-enabled threats (23, ECB, 2026). An organisation in scope therefore needs no new legal basis, only to read its existing duties at the new tempo.

The series has settled the rest. AI Platform and Security concluded that security operations must run faster than a monthly patch cycle (F18) and set out four commitments (F19): patch velocity as a measured service level, prioritised by the Exploit Prediction Scoring System (EPSS), the known-exploited catalogues, the European Vulnerability Database (EUVD) and local exposure; detection at machine speed with the authority to act; identity and approvals that resist synthetic media; and AI for defence under oversight (179, Nordqvist, 2026). AI Red Team, Chapter 1, concluded that AI must become an active, governed part of cyber defence (F25) (180, Nordqvist, 2026). AI Governance, Chapter 24, asked whether patch velocity would become a supervised metric (Q7) (178, Nordqvist, 2026). This chapter's answer is that it already should be.

Practical guide: Making patch velocity a supervised metric

Purpose. Turn the speed of protecting exposed systems into a figure the management body sees, owns and can be held to.

Roles. The CISO owns the metric; the vulnerability-management lead produces it; the management body sets targets and approves exceptions; internal audit checks the evidence.

Steps.

  1. Define the population: every internet-facing system and every system processing the most sensitive data, regenerated monthly from the asset inventory.
  2. Define the clock: from the first public advisory or catalogue entry to verified protection by patch or compensating control, not to ticket closure.
  3. Set tiers and targets using known exploitation, EPSS and exposure. Default: known-exploited or likely-exploited flaws on internet-facing systems protected within 48 hours, adapted to risk appetite and recorded as a decision.
  4. Cover suppliers: compare each contractual patch time with the target and put any gap into the procurement plan for the next renewal.
  5. Report one page per quarter: share of tier-1 cases met, the slowest five with reasons, open exceptions with expiry dates and supplier gaps.
  6. Exercise yearly a tabletop of exploitation within a day of an advisory.
  7. Link the metric and exercise record to the threat register entry for AI-accelerated exploitation.

Definition of done. The management body has approved targets and seen at least two quarterly reports, every exception has an owner and an expiry date, supplier gaps are visible and the register entry links to the evidence.

Worked example: Threat register entry THR-NR-02

The following entry is illustrative. It records Nordvik Region's register entry THR-NR-02, AI-accelerated exploitation of internet-facing services, as assessed for ATA-NR-2026-01, following the threat register schema of Chapter 32.

# Illustrative entry in Nordvik Region's AI threat register (ATA-NR-2026-01)
id: THR-NR-02
title: AI-accelerated exploitation of internet-facing services
scale: humans-wielding-machines
tropes: [T6]
rung: incident-in-the-wild
label: observable
evidence: [source-143, source-145, source-147, source-148, source-150, source-151, source-152]
exposure: high
influence: direct
controls:
  - Inventory of internet-facing services regenerated monthly, including supplier-hosted services
  - Tier-1 target of 48 hours to verified protection by patch or compensating control
  - Pre-approved emergency change path for tier-1 findings, no meeting required
  - Exposure prioritisation NR-SEC-003 at Level 0 Advisory, analysts decide
  - Patch-time clauses aligned with tier-1 target at each supplier renewal
  - MSSP contract NR-2025-044 amended so out-of-hours detections can isolate a service
owner: Chief Information Security Officer
decisionTier: management-body
triggers:
  - A Mythos-class cyber model becomes generally available or open-weight
  - A tier-1 case missed by more than 24 hours
  - Exploitation of a service the Region runs, or of a peer authority's equivalent service
nextReview: 2027-02-01
status: open

Two controls depend on contracts, which is why the decision tier is the management body; the review date follows the three-month default that Chapter 4 sets for claims about cyber capability.

The debate

The evidence of AI-enabled harm is strongest here, so the debate is not about whether attackers use AI but about what follows: a structural shift towards attackers, or a contest in which defenders hold most of the advantages if they use them.

The case for concern

The case for concern rests on what has already happened. In little more than a year the reports moved from AI as a research aid (141, Google GTIG, 2025) to AI performing most of an espionage campaign (143, Anthropic, 2025), to a majority of reported operations enabled by AI (145, Anthropic, 2026) and to offensive frameworks abused in the wild (148, Blum et al., 2026). Meanwhile exploitation precedes the patch on average (151, Mandiant, 2026), monthly disclosures more than doubled in eight months (147, Grunewald et al., 2026), and the defenders' own discoveries produce a patch wave most organisations cannot install fast enough (152, NCSC, 2026). The Five Eyes agencies told leaders the timeline was months (74, Five Eyes agencies, 2026).

The burden falls hardest on public bodies and small firms running systems designed for a slower era (76, NCSC, 2025), and the defenders' advantage rests on voluntary restraint by a few developers that they themselves expect to erode within a year (179, Nordqvist, 2026).

The case for calm

The case for calm reads the same reports in context. The developers who reported the misuse also detected and disrupted it, banned the accounts and informed those affected (143, Anthropic, 2025) (144, OpenAI, 2025). Defenders know their own estates, have legitimate access to the most capable models through programmes such as Project Glasswing (129, Anthropic, 2026), and in its first months found and fixed flaws in numbers no attacker has been reported to approach (179, Nordqvist, 2026).

The evidence also has limits. GTIG and Mandiant found no new techniques (148, Blum et al., 2026), Mandiant did not consider 2025 the year AI became the direct cause of breaches (151, Mandiant, 2026), ENISA found attackers mostly augmenting existing skills (78, ENISA, 2026), and GTIG called confirmed exploitation of AI-discovered vulnerabilities an early indicator rather than an established trend (147, Grunewald et al., 2026). The International AI Safety Report 2026 treated the offence-defence balance as open (50, Bengio et al., 2026), and an agent that trades stealth for velocity is easier to detect than a patient human intruder (148, Blum et al., 2026). On this reading the threat is serious but familiar, and the problem is adoption, not capability.

Where the positions meet

Both positions accept that the exploitation window has collapsed, that AI now performs substantial parts of real intrusions, that the techniques remain known, that humans still direct the campaigns and that defenders' current advantage in model access will not last. They agree that the decisive variable is the speed of patching, detection and response, and that defenders must use AI under oversight to reach it, with scoped credentials, sandboxed verification and human approval matched to the reversibility of each action (180, Nordqvist, 2026). They differ on how fast attackers will move once restricted models become generally available.

What can be done

Individuals can accept automatic updates, use strong authentication and treat urgent requests for credentials or money with suspicion, shrinking the long tail that cheap campaigns target.

Organisations can act on the four commitments: make patch velocity a supervised metric; detect at machine speed with someone authorised to isolate a service at any hour; harden approvals against appearance and urgency, a theme Chapter 20 develops; use AI for defence under oversight; and record the threat in the AI threat register (Chapter 32).

Society can strengthen shared defence. Coordinated vulnerability disclosure through the national CSIRTs and the European vulnerability database that NIS 2 establishes (10, European Union, 2022) turns individual discoveries into collective protection, and the Cyber Resilience Act shifts the cost of insecure products towards their makers (12, European Union, 2024). Under-resourced operators of essential services need shared services and funding. Chapter 28 sets out what Europe and the world have decided so far.

Verdict on the trope

T6 The weapon in human hands. In cyber offence the trope reaches incident in the wild: intrusions in which AI performed most of the operational work under human direction have been documented (143, Anthropic, 2025), and open-source agentic frameworks have been abused in multiple campaigns (148, Blum et al., 2026). The collapse of the exploitation window is a pattern at scale, measured in Mandiant's analyses of vulnerabilities exploited in the wild over several years (150, Charrier & Weiner, 2024), but the share caused by AI is not yet measured. AI-enabled cyber offence is therefore observable, and its further acceleration, as restricted models become generally available and the patch wave grows, is expected. A campaign in which AI plans and executes a complete, novel attack on a well-defended target without human direction, or causes catastrophic damage to critical infrastructure, has not been observed and remains speculation. Unlike in fiction, the weapon also serves defenders, and the advantage goes to whoever acts faster.

What can be influenced. A great deal. No organisation can stop attackers using AI, but every organisation decides how quickly it patches, how fast it detects, who has the authority to act, how its approvals resist deception and whether it puts the same capability to work in its own defence.

Nordvik Region and Hansa Mutual

Nordvik Region meets this threat with few people. Its security unit of fourteen has six analysts who work office hours, out-of-hours monitoring is contracted to a European managed security service provider, and most of its estate is patched on suppliers' schedules. THR-NR-02 therefore turns the series' commitments into decisions taken in advance: a measured patch target, aligned supplier contracts, an MSSP mandate to isolate a service without waiting for the morning, and exposure prioritisation by NR-SEC-003 at Level 0 Advisory. The council motion on pausing AI is answered here in the opposite direction, because pausing the Region's own use would remove one of its few means of keeping pace.

Hansa Mutual already treats AI-enabled attackers as the normal case. Its group SOC runs around the clock from Hamburg and the Polish service centre, its red team includes AI-enabled techniques in threat-led penetration testing under DORA, and its SOC investigation agent HM-SEC-001 works at Level 2 Supervised, with a case for Level 3 Bounded on reversible containment actions (180, Nordqvist, 2026). Its register entry THR-HM-02, AI-enabled intrusion into the group estate, reflects that one unpatched shared gateway exposes all seven markets. As an underwriter, Hansa also records under THR-HM-07 that a campaign exploiting one widely used product within hours could produce correlated claims across many cyber policyholders. Nordvik must make a small team fast by deciding in advance; Hansa must keep a large estate fast while proving to supervisors that people remain in command.

Summary

T6 has its strongest evidence in cyber offence. Between early 2025 and late 2026 the reports moved from AI as a research aid to AI performing most of an espionage campaign, to a majority of reported operations enabled by AI and to agentic penetration-testing frameworks abused in the wild, while humans still chose the targets. The average time from disclosure to exploitation fell from 63 days to less than zero, and AI accelerates the step that used to need skill.

The change is mostly one of degree, in scale, speed and skill, with the human operator shifting from hands-on intruder to orchestrator, and degree at this magnitude breaks defences built for weeks. The response, settled in the series and largely required by European law, is patch velocity, detection at machine speed, approvals that resist deception and AI for defence under oversight. T6 in cyber offence is observable at the rung of incident in the wild, its acceleration is expected, and fully autonomous catastrophic attack remains speculation. Chapter 19 turns to the domain where the same trope is hardest to test and the stakes are highest: whether AI gives meaningful uplift to people seeking biological or chemical weapons.

Sources

  1. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. (180, Nordqvist, 2026)
  2. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. (179, Nordqvist, 2026)
  3. Google Threat Intelligence Group (2025). Adversarial Misuse of Generative AI. (141, Google GTIG, 2025)
  4. OpenAI (2025). Disrupting malicious uses of AI: an update. (144, OpenAI, 2025)
  5. Anthropic (2025). Detecting and countering misuse of AI: August 2025. (142, Anthropic, 2025)
  6. Anthropic (2025). Disrupting the first reported AI-orchestrated cyber espionage campaign. (143, Anthropic, 2025)
  7. Anthropic (2026). Countering misuse of AI: September 2026. (145, Anthropic, 2026)
  8. Google Threat Intelligence Group (2026). GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI. (146, Google GTIG, 2026)
  9. European Union Agency for Cybersecurity (2026). ENISA Threat Landscape 2026. (78, ENISA, 2026)
  10. Blum, Mainor, Nambiar et al. (2026). ARTEX and Friends: Enter Agentic Offensive Frameworks. (148, Blum et al., 2026)
  11. Charrier, C. & Weiner, R. (2024). How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends. (150, Charrier & Weiner, 2024)
  12. Mandiant (2026). M-Trends 2026: Data, Insights, and Strategies From the Frontlines. (151, Mandiant, 2026)
  13. Fang, R., Bindu, R., Gupta, A. & Kang, D. (2024). LLM Agents can Autonomously Exploit One-day Vulnerabilities. (149, Fang et al., 2024)
  14. Carlini, N., Cheng, N., Lucas, K. et al. (2026). Assessing Claude Mythos Preview's cybersecurity capabilities. (128, Carlini et al., 2026)
  15. Grunewald, R., Mazumdar, S. & Vanderlee, K. (2026). Vulnerability Discovery and Exploitation Trends in the AI Era. (147, Grunewald et al., 2026)
  16. National Cyber Security Centre (2025). Impact of AI on cyber threat from now to 2027. (76, NCSC, 2025)
  17. Five Eyes cyber security agencies: ASD's ACSC, Canadian Centre for Cyber Security, NCSC-NZ, NCSC-UK, NSA and CISA (2026). The AI shift in cyber risk: why leaders must act now. (74, Five Eyes agencies, 2026)
  18. Anthropic (2026). Project Glasswing: Securing critical software for the AI era. (129, Anthropic, 2026)
  19. National Cyber Security Centre (2026). Preparing for a 'vulnerability patch wave'. (152, NCSC, 2026)
  20. European Parliament and Council of the European Union (2022). Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). (10, European Union, 2022)
  21. European Parliament and Council of the European Union (2022). Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). (11, European Union, 2022)
  22. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). (12, European Union, 2024)
  23. European Central Bank (2026). Addressing AI-enabled cybersecurity threats. (23, ECB, 2026)
  24. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. (178, Nordqvist, 2026)
  25. Bengio, Y. et al. (2026). International AI Safety Report 2026. (50, Bengio et al., 2026)