Cybersecurity is Facing a ‘Dark Age’ as AI Accelerates Global Attacks, Experts Warn

The multi-billion-dollar cybersecurity industry as the world has known it is overdue for a complete reckoning, battered by unrelenting, artificial intelligence-boosted waves of hacks, data breaches, and digital attacks. According to prominent cybersecurity expert Alex Stamos, chief security officer at Cognition and a lecturer at the Stanford University Cyber Policy Center, the rapid evolution and democratization of AI-powered capabilities have fundamentally upended traditional security paradigms, leaving organizations worldwide scrambling to adapt.

Appearing on The Verge’s Decoder podcast as part of a special series looking at artificial intelligence in real life, Stamos delivered a sobering assessment of the current threat landscape. Both private cybercriminals and state-sponsored actors—including entities linked to Russia and North Korea—are increasingly breaking into global systems by leveraging AI to detect and exploit vulnerabilities simultaneously. This dynamic has created a volatile, frontier-like atmosphere reminiscent of the 1990s, when the concept of an always-online interconnected world was in its infancy.

This massive technical disruption has opened countless avenues for malicious actors, plunging the tech industry into what Stamos characterizes as a temporary "dark age" while society struggles to comprehend and adapt to a transformed era. Beyond traditional enterprise software vulnerabilities, the ongoing wave of security crises touches on complex dilemmas, including the management of AI-generated misinformation and digital slop proliferating across major social networks.

The Reality of Constant Continuous Breaches

Reflecting on recent industry events, Stamos noted that a series of critical software bugs in systems like PHP and Node, alongside a sweeping succession of corporate breaches, have placed Chief Information Security Officers (CISOs) under unprecedented strain. The modern threat environment has moved past isolated incidents into a state of permanent, continuous disruption.

Highlighting a recent complex chain of security events, Stamos pointed to incidents involving AI-adjacent cloud providers and high-profile platforms. In one notable sequence, a breach at AI service provider Fireworks compromised API keys that were subsequently used to target the AI code editor Cursor. That infiltration enabled attackers to push a malicious plugin affecting thousands of downstream companies, illustrating the cascading risks inherent in modern interconnected software ecosystems.

This continuous breach cycle has left defensive teams perpetually on high alert, creating an environment where security professionals across the globe feel like they are operating under acute, sustained pressure.

Inverting the Cyber Kill Chain

The underlying driver of this escalating crisis is the democratization and rapid takeoff of adversary capabilities powered by open-weight artificial intelligence models. Historically, executing a cyber attack required a rigid, methodical process known as the kill chain: researchers spent considerable time upfront analyzing software, discovering vulnerabilities, writing functional exploits, and finally deploying those payloads against targets. This labor-intensive research and development phase was typically handled by elite teams, while less specialized operational units deployed the tools.

With modern AI systems, however, that traditional kill chain has been thoroughly inverted. Open-weight models have reached a level of sophistication where adversaries can automate the entire lifecycle of an attack. Autonomous systems can analyze targets, discover software bugs in real time, write functional exploits instantly, and breach organizations at unprecedented speeds.

Stamos pointed to open-source automated tools—such as the Chinese-developed project ARTEX—which can be powered locally by advanced models running on high-end hardware. When utilized by bad actors, these easily accessible tools allow operators to bypass traditional barriers, enabling individuals or small teams to penetrate multi-billion-dollar organizations with a simplicity not seen since the early days of consumer computing and early DEFCON conventions.

Unlike the 1990s, however, the contemporary digital infrastructure underpins the entire global economy, meaning that automated exploits can cause widespread disruption at a scale previously unimaginable. Furthermore, while sophisticated state-sponsored groups like North Korean hackers continue to execute highly targeted financial heists through advanced social engineering, smaller criminal cells now possess the technical leverage to threaten mid-size industrial suppliers, medical distributors, and critical infrastructure operators.

Shifting Economics and the Cost of Defense

For decades, the cybersecurity industry relied on a stable economic and cultural framework built around responsible disclosure, bug bounties, vulnerability research tiers, and a clear hierarchy of technical skills. The rise of secure coding practices following major industry memos in the early 2000s fostered a multi-billion-dollar defense sector. However, Stamos argues that this era is effectively over because AI has radically altered the economic balance between attackers and defenders.

While attackers can utilize open-weight models and local hardware configurations with a marginal cost approaching zero, defenders face significant ongoing expenses to monitor petabytes of logs, investigate alerts, and remediate legacy code. To survive this transitional phase, the industry must find ways to dramatically lower the cost of defense.

While significant attention has been dedicated to using AI for bug discovery and software development security, operational security remains a major vulnerability. Security operations centers (SOCs) handling vast volumes of telemetry data cannot sustainably rely on expensive frontier models for every single tier of investigation. Instead, organizations will need to integrate tiered detection architectures—combining traditional classifiers and smaller, optimized models—to manage operational triage economically.

Furthermore, fixing vulnerabilities exclusively through iterative patching is no longer viable given the blistering speed of modern exploitation timelines. Stamos suggests that for heavily flawed legacy codebases, comprehensive refactoring and rewriting software from scratch using memory-safe and type-safe languages like Rust may ultimately prove more cost-effective than continuous patch management. He emphasizes that major technology leaders with vast engineering resources must consider fundamental architectural overhauls—such as reimagining core operating system components like the Linux kernel—to permanently eliminate entire classes of vulnerabilities rather than perpetually managing endless cycles of patches.

Navigating the Transition

As organizations confront these systemic pressures, security leaders must abandon passive risk aversion. Proactive measures, such as internal AI-driven red-teaming—testing software systems with autonomous adversarial tools before malicious actors do—will become mandatory for enterprise survival, despite the legal and operational uncertainties involved.

While the path forward involves navigating a difficult transitional period characterized by heightened risks, automated threats, and complex socio-technical challenges, the long-term resolution will depend on shifting the economic and technical burden toward proactive defense, cryptographic verification of authentic media, and structural code modernization across the global digital ecosystem.