The AI Hacker Is Not a Genius. It Is Consistent
Publications about cyberattacks using AI often paint a scenario of a sophisticated, “brilliant” attack. The real danger is the ability to repeat the same method across many systems.
Publications about cyberattacks carried out using AI usually present a scenario of a sophisticated attack tool: a system that discovered a hidden vulnerability, wrote code that a human would not have thought of, or bypassed defenses in a particularly brilliant way. It is easy to understand the attraction to this scenario, but it misses a more immediate, quiet, and less glamorous danger: the ability to use the same attack method again and again against a much larger number of systems.
For AI to become a powerful attack tool, it does not have to invent anything new. Once attackers understand why a certain method works, the system can search for the same conditions in other systems, adapt the test to the differences between them, and continue even after failed attempts. In many cases, the main sophistication lies in the first discovery. From here on, the system increases the number of attempts and the number of systems that can be tested.
In a study we conducted on Android applications, which simulated the work methods of real attackers, the researchers found seven vulnerabilities in manual work in the first stage. After we identified the common conditions that created them, we ran the system on 20 applications. The attack tool found five additional vulnerabilities from the same family, along with a separate vulnerability that allowed account takeover. In each of the applications, the code, interface, and permissions looked different.
The system could not settle for re-running the same command. It was required to identify if and how these conditions existed in each application and adapt the test to its structure. Fixed rules work well when all steps and responses are known in advance. In security tests, each system reacts differently, failure requires a change of direction, and a partial finding affects the next step.
A system capable of adapting the test to what it has already found can move between many systems without a researcher accompanying every attempt from start to finish. What distinguishes it from a faster script is the ability to change the test according to what is found along the way. The system must understand the context of each target. It cannot blindly run a fixed scenario; it must understand how the target is built, identify patterns that were not defined in advance, and decide which findings indicate a real risk.
In manual work, each additional target requires additional researcher time. When AI performs the adaptation itself, many systems can be tested more frequently, without starting over each time and without attaching a researcher to each target. AI agents can perform a whole sequence of actions again and again.
In another study we conducted on the open-source platform for conference management Pretalx, we showed that agents can submit fictitious proposals for lectures to various conferences and wait for an expected action from the organizers, such as confirming the lecture, which activates the vulnerability. A task that previously required tracking and manual work can be performed in parallel against many targets.
An attacker does not need to succeed in all attempts, or even in most of them. One success is enough. As the cost of each additional attempt decreases, an automatic system can try the same attack method against many targets, without adding manpower and without choosing in advance only the targets that seem promising.
An organization, on the other hand, must protect many applications, APIs, permissions, and business processes that change with the code. Connecting a new service, changing the connection between two components, or expanding a permission can open an attack path that did not exist in the previous test. An annual or quarterly penetration test is a snapshot. It can be professional and deep, but it describes the system on the day it was tested.
Weeks later, the code has already changed, permissions have been updated, and new services have been added. An attacker who keeps trying does not wait for the next test. The deeper change that AI brings to the cyber world is not the ability to replace the expert, but to shorten the distance between one discovery and a huge number of attempts. An attack method that took time, creativity, and experience to develop can then be tested again and again, against different systems and at a much lower cost.
Therefore, the threat does not begin at the point where a machine thinks better than a human researcher. It begins when one person's idea can continue to operate at scales that one person, or a group of attackers, could not have reached in the past. Faced with such an ability, a defense that is tested and updated only once every few months will struggle to keep up.
Ido Gefen is the co-founder and CEO of the cyber company Novee Security
