Late last month, I began to consider withdrawing some money from my savings account to buy gold. It’s the first time I’ve ever thought about panic-buying. For all of the firewalls and two-factor-authentication codes, the safety of the internet is starting to falter. Hackers are gaining the upper hand over organizations around the world—hospitals, energy grids, government agencies, and, yes, banks.
As AI tools have become extremely good at writing code, they’ve also become extremely good at pulling off cyberattacks. (Malware, after all, is still software.) The result has been a change in the scale, speed, and sophistication of hacks that is difficult to overstate: Among its tens of thousands of clients, the cybersecurity firm Palo Alto Networks identified a fourfold increase in daily attacks from 2024 to 2025. Hackers are developing AI-enhanced computer viruses that adapt on the fly to avoid detection. They are automating cyber-espionage campaigns on foreign governments. They are stealing data in minutes instead of hours. “There’s a crazy amount of offensive activity happening right now,” Alex Stamos, a former chief security officer of Yahoo and Facebook, told me. “Companies are getting hacked every single day.”
I wonder if ai is enabling new attacks primarily because they allow to find vulnerabilities and coding the exploits, or because companies are using ai at their systems and putting generated insecure code into production
eleijeep@piefed.social 17 minutes ago
This is just hype. The marketing hype of these models has focused a huge amount of human effort on looking for vulnerabilities that we could have found before if CTOs could have been convinced that it was worth the time and resource investment to go looking for them.
We now have an industry full of executives who believe they will be the ones held responsible if they don’t quickly respond to this “new threat” and so now the engineers who should have been given the time to address technical debt and look for security issues in their products years ago, actually have the remit from the suits to do so.
Any time one of these snake-oil companies tells you that their model found hundreds of security issues in a project, just realise that what it actually did is spit out thousands of useless pages of nonsense that a team of real engineers had to check, and in checking all of the nonsense they realised that hold on a minute, yes this particular function does have a vulnerability. The AI is just giving us permission to look, by pointing its sixth finger at every other line of code.