As companies race to pursue AI transformation, or AX, to reshape their businesses, AX is also gaining momentum in cyber attacks.

At first, hackers used AI to build the tools and infrastructure needed for ransomware attacks. Now it has evolved to the point where they use AI to scour already breached corporate networks to find ways to break into other accounts.

Microsoft said Storm-0940, a hacking group linked to the Chinese government, automated attacks against hundreds of organisations worldwide across multiple industries using Artex, an open-source AI penetration testing tool developed by a Chinese engineer.

The hacking group CyberCartel used multiple AI agents based on models from Anthropic, SpaceX and China’s Moonshot AI to automate attacks targeting about 400 financial institutions in Central and South America. Hackers also attacked open-source AI coding tools and unlawfully charged users’ AI accounts.

The Wall Street Journal cited LMG Security founder Sherri Davidoff (셰리 다비도프) as saying hackers use AI to gather advance information on targets, analyse vast amounts of stolen data and quickly create attack code that can be used for network intrusions.

Davidoff, who has surveyed NetDiligence and other experts every three months on techniques used in real cyber attacks, stressed that a year ago almost none of the respondents had found traces of AI use, but over the past three months AI use has become routine.

Microsoft also said in a report on hacking groups linked to the Chinese government that in some environments, AI agents moved beyond authentication to carry out reconnaissance, change application credentials for persistent access, and even change identity, group and privileged roles. It said attackers were able to maintain access even after victim companies restored the affected applications by changing application credentials in advance.

A recent surge in hacking is also being analysed as a result of more sophisticated hacking AX.

Some say the speed and scale of AI-driven cyber attacks are spreading so fast that even incident response firms are struggling to cope. The WSJ said the industry is even calling this month “Black October” as fundamental and critical weaknesses capable of shaking internet infrastructure, including PHP vulnerabilities, are being disclosed one after another due to AI.

Forecasts that larger-scale damage will continue are also gaining traction as not only hackers operating with Chinese and Russian support but also criminals seeking to steal data or install ransomware now use AI tools.

Volexity CEO Steven Adair (스티븐 애데어) said he expects a large number of cases disclosing hacking damage to pour out over the next few weeks to months.

CrowdStrike Executive Vice President Adam Meyers (애덤 마이어스) said the number of agentic AI attackers is rising explosively, adding that both highly skilled attackers and very low-skilled attackers are using it.

Tech executives have also warned of a tsunami of vulnerabilities. The Guardian reported OpenAI CEO Sam Altman said, “I no longer think we will be able to patch every bug,” and Anthropic Deputy Chief Information Security Officer Jason Clinton warned on social media platform X, formerly Twitter, that a “vulnerability tsunami” is coming in the next few months and there will not be enough time to patch critical infrastructure. Salesforce CEO Marc Benioff also agreed and described it as an “emergency.”

Cloudflare CEO Matthew Prince said the security industry will not keep up with flaws found by AI, and it will feel like the sky is falling and nothing can be done. He said the next two years will be highly precarious because of new tools continuously finding vulnerabilities. The Atlantic reported CrowdStrike is finding a new AI-based hacking group every two hours.