# Alex Stamos warns AI is speeding hacks and pushing cybersecurity into a darker era

Published 2026-11-07T15:23:58+00:00 · Updated 2026-11-07T15:23:58+00:00 · By superintelligencenews@gmail.com
Canonical: https://superintelligencenews.com/ai-fields/ai-cyberattacks-stamos-dark-age/

> Alex Stamos says AI is accelerating cyberattacks, helping attackers automate more of the intrusion process and widening the pool of people who can carry out effective hacks. He warns the industry is entering a difficult transition period as recent breaches ripple across AI firms and their customers.

## Key facts

- Alex Stamos told The Verge that AI is helping attackers find vulnerabilities and write exploits in real time.
- Stamos said a malicious Cursor plugin reached 5,000 more companies after a Fireworks breach and stolen API keys were used to access Cursor.
- He said ARTEX-linked attacks hit three South Korean banks first, then about 200 more companies.
- He compared modern DEF CON attendance of 40,000-60,000 people with a couple hundred in the 1990s.
- The Verge published the Decoder episode with Alex Stamos on 2026-11-07.

AI is making it easier for attackers to find weaknesses, write exploits and scale intrusions in real time, and former top security executive Alex Stamos says that shift is already visible in a string of recent breaches, including incidents tied to AI companies and other targets. In a recent *The Verge* interview, Stamos argued the industry is heading into a "dark age" before defenders can catch up.

 

## What Stamos says is changing

 

Stamos, now chief security officer at Cognition, told *The Verge* that the core problem is not simply more hacking activity, but a changed operating model for offensive cyber work. He said AI is helping attackers spot vulnerabilities faster and generate exploits on the fly, shrinking the time between discovery and intrusion.

 

That matters because cybersecurity has long depended on a gap between the people who can build sophisticated attacks and the broader population of criminals who cannot. Stamos says that gap is narrowing.

 

He described the current moment as one in which attackers can automate much of the cyber kill chain using open-weight models, commodity hardware and public tools rather than relying on frontier systems with guardrails, logs and tighter controls.

 

## Why it matters

 

The significance goes beyond one company or one breach. If AI lowers the skill needed to attack networks, then more groups can try more attacks faster, with less cost and less expertise. That raises the odds of frequent breaches against ordinary businesses, not just the largest and best-defended firms.

 

Stamos’s warning also suggests the economics of cybercrime may be changing. A small team with the right tools can now do damage that once required a larger, more experienced crew. For defenders, that means traditional assumptions about the size, speed and sophistication of an attacker may no longer hold.

 

For companies, the practical consequence is simple: the window between a vulnerability appearing and an attacker exploiting it may keep shrinking. That can leave security teams with less time to patch systems, validate software and contain exposure after a supplier compromise.

 

## How the recent breach wave fits together

 

*The Verge* said Stamos pointed to a cluster of incidents in October that put the security industry on high alert. In his telling, the wave included breaches across AI-linked companies and other targets, with one compromise leading to another.

 

He said Fireworks was breached and that API keys from that incident were then used to access Cursor. According to Stamos, a malicious Cursor plugin subsequently reached 5,000 more companies.

 

He also said the recent wave includes hacks of AI-related firms and “neoclouds,” a sign that the attack surface around the AI industry is expanding beyond model builders alone. The implications are broader than a single product or service: software development tools, infrastructure providers and adjacent vendors all become potential entry points.

 

### Chain-reaction risk

 

The Fireworks-to-Cursor example underscores one of the main dangers Stamos is highlighting: a breach at one provider can become a launch point into many others. If an attacker steals credentials or API keys, the impact can spread quickly through interconnected services and customers.

 

That kind of chain reaction is particularly worrisome in the AI sector, where tooling is often tightly integrated and many firms depend on a similar stack of cloud services, developer platforms and third-party plugins.

 

## What Stamos says about the new threat model

 

Stamos contrasted today’s environment with the older cybersecurity model that grew out of Microsoft’s “trustworthy computing” era in the early 2000s. That earlier era, he said, was built around a relatively stable system: a skilled but limited pool of attackers, bug bounties, disclosure rules and a mature defender economy.

 

In his view, that system worked because offensive cyber talent was scarce and expensive. Now, he says, AI is lowering the barrier to entry.

 

“It’s back to the Wild West days,” Stamos said in the interview, capturing his view that the field has shifted from a managed, professionalized environment to one in which the rules are less settled and the threats are faster-moving.

 

> “It’s back to the Wild West days.”

 

He also warned that the industry may be entering a period in which defenders are structurally behind. “We are in for a ‘dark age’ while we try to figure out how on earth to adapt,” he said.

 

> “we are in for a ‘dark age’ while we try to figure out how on earth to adapt”

 

That is not a prediction that cybersecurity will fail altogether. Rather, it is a claim that defenders will spend a period reacting to attack methods that have already become easier to use and harder to distinguish from ordinary technical noise.

 

## Background: how cybersecurity got here

 

For years, cyber defense has rested on a few core ideas. Companies used bug bounties to incentivize researchers to report vulnerabilities. They leaned on responsible disclosure rather than public chaos. And they relied on a relatively small number of highly capable offensive specialists rather than mass-market attack automation.

 

That model evolved alongside the modern internet. As corporate systems became more connected, attackers adapted. Ransomware groups and state-linked actors learned that mid-size firms and infrastructure suppliers could be attractive targets because they offer leverage far beyond their own size. A breach at one supplier can ripple outward into customers, partners and service providers.

 

Cryptocurrency also changed the incentive structure. Bitcoin and similar assets made extortion and money laundering easier, helping cybercriminals collect payment with fewer of the frictions that once constrained them.

 

Stamos’s argument is that AI is now compounding those long-running trends. Rather than introducing a brand-new category of threat, he sees it accelerating the scale and pace of attacks that already existed.

 

## What is ARTEX, and why is it part of the story?

 

Stamos said the open-source Chinese tool ARTEX has been used in attacks, and that it has been paired with what he called an “obliterated GLM-5.3” in operations against South Korean banks and other firms. He said the initial attacks hit three South Korean banks, and that about 200 more companies were struck afterward.

 

His point is not only that an individual tool can be effective, but that open-source and open-weight models can be repurposed quickly by actors who want to automate parts of the attack process. In that scenario, the barrier to entry is not a highly customized cyber arsenal; it is access to code and the will to use it.

 

He also said North Korea is behind Binance-related thefts, and that state and private actors including Russia and North Korea are using AI-enabled tactics. The picture he drew was not of one isolated criminal ecosystem, but of multiple actors, state and non-state alike, taking advantage of similar tools.

 

## By the numbers

 

Stamos’s comments were heavy on scale, which helps explain why he sees the shift as so serious. The figures he cited show a cyber landscape that is larger, faster and potentially more diffuse than before.

 

| Figure | What Stamos said | Why it matters |
| --- | --- | --- |
| 5,000 companies | Potentially exposed through a malicious Cursor plugin chain | Shows how one compromise can spread quickly through a software ecosystem |
| 3 South Korean banks | Initial targets in the ARTEX-linked attacks | Suggests financial institutions remain high-value targets |
| about 200 companies | Additional organizations hit after the bank attacks | Illustrates escalation beyond the original target set |
| 40,000-60,000 people | Modern DEF CON attendance range Stamos cited | Signals how much broader the security community has become |
| a couple hundred people | DEF CON attendance in the 1990s | Highlights how different the early cyber scene was |
| 10 person, 12 person IT team | Example of a mid-size company security staff | Shows the resource mismatch between defenders and attackers |
| 20 person Russian ransomware team | Example attack team size he used in comparison | Underscores how small groups can still create major damage |

 

## How does AI change the attacker's advantage?

 

AI matters because it can compress several steps of an intrusion into a faster, more accessible workflow. Stamos said attackers are using AI to identify vulnerabilities and write exploits in real time. That reduces the need for deep manual expertise at every stage.

 

It also broadens the pool of people who can participate in offensive operations. Someone who once needed years of technical training may now be able to rely on tools that do much of the repetitive or specialized work.

 

The practical effect is a lower skill barrier. If that holds, the market for cybercrime could expand the same way any other market expands when labor becomes cheaper and easier to substitute with automation.

 

### What defenders lose when the barrier falls

 

When fewer people can mount a sophisticated attack, defenders can focus on a narrower set of methods and signatures. When more people can do it, those assumptions break down. The result is more noise, more probing, and more attempts that look tailored even when they are generated from broadly available tooling.

 

That creates a difficult environment for small and mid-sized businesses, which often do not have the deep bench of analysts, engineers and incident responders that the largest firms can call on.

 

## What happens next

 

The immediate question is whether the incidents Stamos described will be independently verified in full, and whether investigators will confirm how much AI contributed to each breach. The fact sheet leaves open which parts of the wave are established fact and which reflect his interpretation of events.

 

What to watch next includes whether more organizations tied to the Cursor plugin chain come forward, whether the ARTEX-linked attacks are attributed more definitively, and whether companies rapidly change how they defend against AI-assisted intrusion campaigns.

 

Security teams are likely to focus on the basics that still matter: tightening credential hygiene, monitoring API key exposure, reviewing plugin and third-party access, and cutting down the blast radius of any single vendor compromise. But Stamos’s warning suggests those measures may not be enough if attack speed continues to rise.

 

The bigger strategic question is whether the industry can rebuild a defense model for a world where offense is cheap, fast and increasingly assisted by AI. Stamos’s answer, at least for now, is that the transition will not be smooth.

 

## Bottom line

 

Stamos’s central claim is stark: AI is not just helping cybercriminals work faster; it is changing who can attack, how they attack and how quickly breaches can spread. If he is right, the next phase of cybersecurity will be defined less by isolated hacks than by a broader erosion of the assumptions that kept the system stable.

## Frequently asked questions

### Why does Alex Stamos think AI is a cybersecurity threat?

He says AI is making it easier for attackers to find vulnerabilities, write exploits and automate more of the attack chain. In his view, that lowers the skill needed for effective intrusions and lets more actors move faster than defenders can respond.

### What breaches did Stamos point to?

He pointed to a recent wave of incidents in October that included hacks of AI-related firms and other targets. He specifically said Fireworks was breached, API keys from that incident were used to access Cursor, and a malicious Cursor plugin reached 5,000 more companies.

### What is ARTEX in this story?

ARTEX is an open-source Chinese tool that Stamos says has been used in attacks. He said it was paired with an "obliterated GLM-5.3" in operations against South Korean banks and other firms.

### What did Stamos mean by a "dark age" in cybersecurity?

He meant a period when defenders are likely to lag behind faster, more automated attacks. He said the industry is entering a "dark age" while it tries to adapt to a new threat model built around AI-enabled offense.

### How many companies were affected in the incidents he described?

Stamos said 5,000 companies may have been exposed through a malicious Cursor plugin chain, and about 200 more companies were hit after the initial attacks on three South Korean banks.

## Sources

- [The Verge](https://www.theverge.com/podcast/1029038/ai-cybersecurity-hackers-data-breach-dark-age-alex-stamos)