The AI Agent Threat Report: attackers now have an elite hacker on demand.

Key findings

1. The vulnerability supply has gone vertical. 85,836 CVEs were published between January and 23 October 2026 — already 78% more than all of 2025 — with monthly volume more than tripling between January and September.¹ Google counts more than 1,500 CVEs in the AI stack itself this year.²
2. Exploitation is now the #1 way in. For the first time in the 19-year history of Verizon's DBIR, exploiting a vulnerability is the most common initial access vector, at 31% of breaches.³
3. The patch window has closed. Mandiant's mean time-to-exploit fell from 63 days (2018–19) to an estimated −7 days in 2025: exploitation now routinely starts before a patch exists.^4,5
4. AI models went from 12.5% to 100% on a professional CTF benchmark in under two years, and the UK AI Security Institute now measures autonomous cyber capability doubling every 4.7 months.^6,7
5. Attacker agents are in the wild, and cheap. An AI agent did 80–90% of the tactical work in a state espionage campaign; a lone criminal's agents compromised 27+ retailers at a mean model cost of $25.46 per target.^8,9
6. Defense with AI works — and pays. Organizations using security AI and automation extensively save $1.93M per breach on average.¹⁰ The fix is not to out-hire the machines; it is to put equally capable machines, directed by experienced engineers, on your side.

1. The vulnerability flood

Every published CVE is a potential door. For most of the last decade the count grew at a steady 5–15% a year. Then AI arrived on both sides of the ledger: more software is being written with AI assistance, and AI vulnerability-hunting tools are finding flaws in it far faster than human researchers could. The result is the chart below.

Not every CVE gets exploited. The ones that matter most land in CISA's Known Exploited Vulnerabilities (KEV) catalog — confirmed in-the-wild attacks. 2026 additions have already passed the 2025 total.¹¹ Google's threat intelligence team counted 141 exploited vulnerabilities in January–August 2026 against 127 in all of 2025, with 62% of them zero-days.²

Meanwhile, defenders are falling behind on the vulnerabilities that are known to be exploited. Verizon found that only 26% of KEV-listed vulnerabilities were fully remediated in 2025 (down from 38%), and the median time to full resolution rose from 32 to 43 days. The median organization had 50% more critical vulnerabilities to patch than the year before.³ Exploitation is now the top initial access vector at 31%, third-party involvement reached 48% of breaches, and ransomware appeared in 48%.³ A year earlier those figures were 20%, 30%, and 44%.¹²

2. The exploit window has collapsed

The most important number in vulnerability management is how long you have between disclosure and attack. Mandiant has tracked it for years.

VulnCheck measures the same collapse from another angle: roughly a quarter of every year's newly exploited vulnerabilities are attacked on or before the day their CVE is even published.^13,14,15

And once attackers are in, they move faster than any on-call rotation:

Put those together: attackers arrive before the patch, move laterally in under half an hour, and stay hidden for two weeks. A quarterly scan and a monthly patch cycle were built for a world that no longer exists.

3. AI is now an elite attacker

Two years ago, the question was whether AI could exploit anything at all. In April 2024 researchers at UIUC showed GPT-4 could exploit 87% of a set of real one-day vulnerabilities when handed the CVE description — while every other model and the open-source scanners they tested scored 0%.¹⁷ Since then the curve has been almost vertical.

Elite-researcher performance, at machine scale

Benchmarks saturate; real-world results are what matter. They point the same way:

Put plainly: the strongest models now perform like the top fraction of a percent of human security researchers — and unlike those researchers, they run in parallel, never sleep, and cost dollars per target. The very most capable model is currently restricted to vetted defenders — but attackers don't need it. The retail campaign in Section 4 ran on generally available models (Claude Opus 4.6, GLM, and DeepSeek) through open-source agent frameworks.⁹

The economics flipped

Hacking used to be expensive and skill-limited. That is why most small and mid-sized companies were never anyone's priority target. Agents remove both constraints:

When an end-to-end intrusion attempt costs $25 in tokens, the attacker no longer needs to choose targets. They can try everyone. In September 2026, one operator launched 105 automated attack projects in five days.⁹ Anthropic reports that a majority of the operations in its latest threat report were enabled by AI, with breaches completed in roughly two to three hours.²⁴

4. Incident timeline, 2024 – 2026

These are verified, publicly reported incidents and milestones, each linked to its primary source. Filter by type — note how “AI as attacker” goes from deepfakes and experiments to fully autonomous campaigns in about eighteen months.

5. What it costs when it lands

IBM's 2026 Cost of a Data Breach study puts the global average breach at a record $4.99M, up 12% in a year.¹⁰ AI is now central on both sides of that number:

• One in four malicious breaches was AI-enabled, costing about $6M each; AI-driven attacks rose 56% and add roughly $1M per breach.^25,10
• Roughly one in five organizations reported a breach of their own AI models, apps, or agents — and 92% of those lacked proper AI access controls.¹⁰
• Organizations using security AI and automation extensively saved $1.93M per breach.¹⁰
• 87% of leaders surveyed by the World Economic Forum say AI-related vulnerabilities were the fastest-growing cyber risk of 2025.²⁶

6. Where attacker agents hit first

Agents go wherever the cost-to-reward ratio is best. Across the incidents above, the same six surfaces keep appearing. These are the surfaces our Sweep covers.

7. Fighting AI with AI

The same capability curve that arms attackers arms defenders — and defenders have one structural advantage: we get to go first, with full access, on our own schedule. The evidence that machine-speed defense works is already in:

• Google's Big Sleep agent found SQLite CVE-2025-6965 — a flaw Google says was known only to threat actors — and it was fixed before it could be used.³¹
• DARPA's AIxCC finalists found 86% of planted vulnerabilities and patched 43 of them, in an average of 45 minutes per patch.³²
• Google DeepMind's CodeMender upstreamed 72 security fixes to open-source projects in six months.³³
• Claude Opus 4.6 found and validated 500+ high-severity open-source vulnerabilities.³⁴ Project Glasswing partners have since found more than 10,000 high- or critical-severity issues, with 90.6% of assessed findings confirmed as true positives.³⁵

How ForthClover runs it

We are a senior engineering team working across AI systems, cloud infrastructure, and security. Our defensive harness drives the most capable generally available frontier models — Claude Opus and Claude Fable among them — as specialist agents: one maps your attack surface, others attack it the way an adversary's agent would, others write and test the fixes. A senior engineer directs every run, reproduces every finding, and reviews every line of every patch.

Guardrails on our own agents

• Written authorization first. Scope, targets, and testing windows are signed before any agent touches your systems.
• Sandboxed and non-destructive. Agents run in isolated environments with scoped, short-lived credentials. No data deletion, no denial-of-service, no social engineering of your staff unless you ask for it in writing.
• Your data stays yours. We use model providers under terms that exclude training on your data, and we keep findings in your repo and ticketing system, not ours.
• Humans approve every change. Patches land as pull requests you merge. Nothing ships to production without your team's sign-off.

8. The service: Security Sweep + Patch Watch

Two products, both fixed-price. The Sweep finds and fixes what is exposed today. Patch Watch keeps it fixed as new exploits appear — and costs nothing unless a critical patch is needed.

How patch priorities work

Every new signal is scored against your actual stack — not a generic list. Whether it is exploited in the wild, how likely it is to be exploited (FIRST EPSS), its severity, and whether the affected system faces the internet decide its priority. That priority sets both the deadline and whether it is billable.

What “free maintenance” actually covers

Monitoring, triage, the monthly posture report, and routine (P2/P3) updates batched into your weekly maintenance window are included at $0. You are billed only for P0/P1 critical patches — $950 each, fixed, quoted and approved by you before we start. If a month brings no critical patch, the month costs nothing.

9. The Signal Desk: how we stay current

A patch policy is only as good as the intelligence behind it. Our internal Signal Desk pulls, every hour:

• CISA KEV — every newly confirmed in-the-wild exploit.
• GitHub reviewed advisories — critical and high flaws across npm, PyPI, Maven, Go, Composer, RubyGems, NuGet, Rust, and GitHub Actions.
• FIRST EPSS — the probability each CVE is exploited in the next 30 days.
• Threat-intel and security news — CISA advisories, vendor threat-intel blogs, and the major security press, auto-tagged for active exploitation, AI-driven attacks, ransomware, and supply-chain compromise.

Each signal is matched against every client's inventory from their Sweep, then placed on a patch calendar per the policy above. Here is the public slice of what it sees right now:

10. What we won't promise

No one can honestly guarantee you will never be breached, and anyone who does is selling something other than security. What we promise is narrower and checkable: every finding comes with proof, every fix is retested against the original attack, every critical signal that matches your stack is acted on within the stated window, and you get the evidence in writing each month.

Frequently asked questions

Is Patch Watch really free?

Yes, for every Sweep client. We can afford it because the Sweep gives us a precise inventory of your stack, and the Signal Desk does the watching automatically. You pay only for critical (P0/P1) patches, at a fixed price you approve first.

Why do I need the Sweep first?

Monitoring is only useful if we know exactly what you run. The Sweep builds that inventory and clears the existing backlog, so Patch Watch starts from a known-good baseline instead of a guess.

Will your agents break production?

Testing is non-destructive and scheduled with you. Where a check carries real risk, we run it against staging or a snapshot. Fixes ship only as pull requests that your team merges.

Do you need access to our source code?

For the external attack-surface scan, no. For dependency audits and patch PRs, read access to the relevant repositories gives far better results; we work with scoped, revocable access and remove ourselves when the engagement ends.

We didn't build our systems with you. Can you still sweep them?

Yes. Most Sweep clients run websites, apps, and infrastructure that someone else built. That is the normal case.

Is our data sent to AI providers?

Code and findings pass through frontier models under enterprise terms that exclude training on your data. If your policies require it, we run the harness against models hosted inside your own cloud account instead.

Sources

1. CVE.icu yearly summary data (Jerry Gamblin / RogoLabs), data as of 23 Oct 2026 — cve.icu/data/yearly_summary.json
2. Google Threat Intelligence Group, “Vulnerability Discovery and Exploitation Trends in the AI Era,” 30 Sep 2026 — cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era
3. Verizon, 2026 Data Breach Investigations Report — executive summary, May 2026 — www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf
4. Mandiant / Google Cloud, “How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends,” 15 Oct 2024 — cloud.google.com/blog/topics/threat-intelligence/time-to-exploit-trends-2023
5. Mandiant, M-Trends 2026, 23 Mar 2026 — cloud.google.com/blog/topics/threat-intelligence/m-trends-2026
6. Cybench leaderboard (end-to-end % of tasks solved); newer rows from model system cards on 35–39-task subsets — cybench.github.io
7. UK AI Security Institute, “How fast is autonomous AI cyber capability advancing?” 13 May 2026 — www.aisi.gov.uk/blog/how-fast-is-autonomous-ai-cyber-capability-advancing
8. Anthropic, “Disrupting the first reported AI-orchestrated cyber espionage campaign,” 13 Nov 2025 — www.anthropic.com/news/disrupting-AI-espionage
9. Gambit Security, “Autonomous AI agents attack online retailers for $25 a company,” 22 Sep 2026 — gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company
10. IBM X-Force, “2026 Cost of a Data Breach: AI adversaries and enterprise risk” — www.ibm.com/think/x-force/2026-cost-of-a-data-breach-ai-adversaries-enterprise-risk
11. CISA, Known Exploited Vulnerabilities catalog (live JSON feed) — www.cisa.gov/known-exploited-vulnerabilities-catalog
12. Verizon, 2025 Data Breach Investigations Report — executive summary, Apr 2025 — www.verizon.com/business/resources/reports/2025-dbir-executive-summary.pdf
13. VulnCheck, “2024 Trends in Vulnerability Exploitation” — www.vulncheck.com/blog/2024-exploitation-trends
14. VulnCheck, “State of Exploitation 2026,” 21 Jan 2026 — www.vulncheck.com/blog/state-of-exploitation-2026
15. VulnCheck, “State of Exploitation 1H 2026,” 28 Jul 2026 — www.vulncheck.com/blog/state-of-exploitation-1h-2026
16. CrowdStrike, 2026 Global Threat Report, 24 Feb 2026 — crowdstrike.com/en-us/press-releases/2026-crowdstrike-global-threat-report
17. Fang, Bindu, Gupta & Kang (UIUC), “LLM Agents can Autonomously Exploit One-day Vulnerabilities,” arXiv:2404.08144, Apr 2024 — arxiv.org/abs/2404.08144
18. XBOW, “The road to Top 1,” 24 Jun 2025 — xbow.com/blog/top-1-how-xbow-did-it
19. UK AI Security Institute, Frontier AI Trends Report, Dec 2025 — aisi.gov.uk/frontier-ai-trends-report
20. UK AI Security Institute, “Our evaluation of Claude Mythos Preview’s cyber capabilities,” 13 Apr 2026 — www.aisi.gov.uk/blog/our-evaluation-of-claude-mythos-previews-cyber-capabilities
21. Anthropic, Claude Mythos Preview research post, Apr 2026 — www.anthropic.com/research/mythos-preview
22. Anthropic, “Measuring LLMs’ ability to develop exploits,” 22 May 2026 — www.anthropic.com/research/exploit-evals
23. Anthropic, Project Glasswing / Claude Mythos Preview, 7 Apr 2026 — www.anthropic.com/glasswing
24. Anthropic, Threat Intelligence Report, September 2026 — anthropic.com/threat-intelligence-report-september-2026
25. IBM, Cost of a Data Breach Report 2026 (newsroom), 29 Jul 2026 — newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
26. World Economic Forum, Global Cybersecurity Outlook 2026, Jan 2026 — reports.weforum.org/docs/WEF_Global_Cybersecurity_Outlook_2026.pdf
27. AWS Security Blog, “AI-augmented threat actor accesses FortiGate devices at scale,” Feb 2026 — aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale
28. AWS Security Blog, “China-nexus cyber threat groups rapidly exploit React2Shell (CVE-2025-55182),” Dec 2025 — aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/
29. Microsoft Threat Intelligence, “Storm-0940 uses ARTEX agentic AI in ConnectWise supply-chain compromise,” 21 Oct 2026 — www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
30. CrowdStrike, “Agentic AI attack campaigns,” Oct 2026 — www.crowdstrike.com/en-us/resources/reports/agentic-ai-attack-campaigns/
31. Google, “Cybersecurity updates, summer 2025” (Big Sleep), 15 Jul 2025 — blog.google/technology/safety-security/cybersecurity-updates-summer-2025/
32. DARPA, “AI Cyber Challenge results,” 8 Aug 2025 — www.darpa.mil/news/2025/aixcc-results
33. Google DeepMind, “Introducing CodeMender,” 6 Oct 2025 — deepmind.google/blog/introducing-codemender-an-ai-agent-for-code-security/
34. Anthropic, “LLM-discovered 0-days” (Claude Opus 4.6), 5 Feb 2026 — www.anthropic.com/research/zero-days
35. Anthropic, “Project Glasswing: an initial update,” 22 May 2026 — www.anthropic.com/news/glasswing-initial-update

Incident sources are linked inline in the timeline. Figures were checked against each primary source in October 2026; KEV figures in Figure 3 and the live feed update hourly.