AI broke the cybersecurity world. Now what?

AI has collapsed the skill barrier to serious cyberattacks

The cybersecurity industry was built on a scarce supply of skilled operators, and AI has removed that constraint. Open-weight models let small crews and nation states run attacks that once required rare experts, and one stolen API key can cascade into thousands of breached companies. Stamos expects a dark age rather than an apocalypse, and argues defence has to get radically cheaper, with AI agents absorbing tier-one and tier-two work.

Takeaways

• AI broke the attacker skill bottleneck. Open-weight models automate most of the kill chain. RTX, a Chinese open source tool anyone can download, hit three South Korean banks and about 200 more companies in a week. Two or three people can now run attacks all day.
• One stolen API key cascaded to thousands. Attackers broke into Fireworks, stole API keys that let them into Cursor, and pushed a bad plug-in to 5,000 more companies, creating 5,000 potential breaches. Stamos says the industry spent October at DEF CON two.
• The security industry's skill hierarchy is over. Since Bill Gates's trustworthy computing memo, the business ran on a skill hierarchy and a limited supply of operators, with ex-hackers hired by Microsoft, Oracle and firms like Mandiant and CrowdStrike. Bitcoin broke the money-laundering bottleneck and AI breaks the skill one.
• Frontier cyber models reach too few companies. Mythos and AstraCyber are excellent, but only a tiny number of companies have access and they scan only the most important code. Hundreds of billions of lines of legacy code go unchecked, and Patch Tuesday grew from 150 or 200 patches to more than 900.
• Verify real content instead of detecting fakes. Detecting what is fake is probabilistic and approaches impossibility, while proving what is real can be cryptographically perfect. Stamos predicts someone will disrupt Instagram by keeping images camera-original, and says his three teenagers hate AI slop.
• Human tradecraft still does the damage. The Binance hack, the largest heist in human history, was North Korean and mostly smart social engineering. A 20-person Russian ransomware crew wrecked the country's largest medical and dental supplies distributor, which had one security person and a 10 to 12 person IT team.

Stamos's defence agenda

1. Run RTX against your own company within 90 days, to see what the attacker tool finds.
2. Build defensive agents with deterministic limits. Stamos says if Cognition's defensive agent turns off five people, something has gone badly wrong.
3. Move tier-one and tier-two security operations work to AI. Software security is 25 percent of Stamos's job at Cognition and already revolutionized, while the other 75 percent is where the work is.