AI is changing cyberattacks in ways that make them faster, broader, and harder to contain. What once required deep expertise, long preparation, and high cost can now be accelerated with machine assistance, lowering the barrier for attackers and increasing the chance that threats appear more often at larger scale.
The most striking shift is happening around zero-day exploitation. A zero-day is a software vulnerability that developers do not yet know about and therefore have not patched, which makes it especially dangerous if attackers find it first.
Google recently identified the first zero-day discovered with AI. That finding shows how machine learning models can analyze massive code bases and surface hidden weaknesses that were previously much harder to uncover.
That speed matters because it does not end at discovery. When AI shortens the time needed to find flaws, attacks can be launched faster too, while defenders are forced to respond with much more adaptive methods.
Supply chains are becoming a bigger target
AI is also amplifying attacks on software supply chains. These campaigns target third-party components or software dependencies, then use those weak points to reach a much wider set of systems.
One widely noted example is the “Shy Hulud” worm from the npm supply chain attack. The AI-powered worm exploited software dependencies and was able to infiltrate systems with precision while spreading efficiently across platforms.
That kind of case shows why supply chain security can no longer be treated as an extra layer. A single compromised component can open a path to many targets at once.
Malware is becoming more evasive
AI is also expanding the attack surface through malware that adapts more easily. Polymorphic malware can change its code dynamically, making it harder for traditional antivirus tools to recognize and stop it.
Attackers are also using AI-assisted obfuscation networks. Their purpose is to confuse defenders, extend malicious activity, and make detection far more difficult.
Another development viewed as critical is autonomous malware. With AI, malware can operate more independently, reducing the need for human involvement while improving the scale, persistence, and efficiency of attacks.
A race that includes states and security vendors
The use of AI in cyber operations is not limited to criminal groups. China, Russia, and North Korea are described as being at the forefront of integrating AI for vulnerability hunting, espionage, and disruption of critical infrastructure.
That competition has turned AI into more than a technology issue. It is also a geopolitical issue, because machine-driven offensive and defensive capabilities are beginning to shape the balance of power.
On the defensive side, companies such as Anthropic and OpenAI are said to be developing advanced models like Mythos and GPT 5.5 Cyber. These systems are designed to detect and address vulnerabilities in real time by analyzing data at scale.
Open source expands access, and risk
Open source AI models give researchers and developers access to powerful tools. At the same time, that same openness creates opportunities for abuse, from automated phishing campaigns to deepfakes and more advanced hacking tools.
AI is also reshaping the economics of cybercrime. Smaller attackers can now use AI-driven automation to expand their operations with relatively little effort.
For defenders, the cost of AI-based security tools remains a challenge. That gap makes affordable, scalable protection increasingly important, especially for small businesses that remain more exposed.
Practical steps mentioned in this shift include multi-factor authentication, regular software updates, and thorough audits of software supply chain dependencies. Organizations are also being pushed to use AI-based security tools for real-time detection and response, while improving education around phishing, deepfakes, and AI-driven scams.
