For all the attention we’re paying to what AI will help us build, it seems we need to spend more time considering what AI will help attackers break.
Cybersecurity breaches will quickly become more frequent, more disruptive, and harder to contain. The danger lies in a growing mismatch: AI is accelerating the discovery and exploitation of vulnerabilities, while securing the organizations exposed to them remains a complicated, often slow process.
This week provided a warning. AI-assisted research helped uncover two critical flaws in PHP, software used across much of the web. OpenAI and its partners spent roughly two months coordinating a response. Yet Amazon subsequently identified an exploitation attempt four days before the vulnerabilities were publicly disclosed.
Finding the flaws was only the beginning. Getting protection into every affected system was the harder problem.
The clock is ticking
Security teams must identify exposed systems, test fixes, coordinate with vendors, and deploy updates without disrupting operations. Those steps take time. AI is helping attackers compress theirs: Amazon warns that AI-assisted analysis makes it cheaper to turn technical disclosures into working exploits, allowing more attackers to act within hours or even minutes.
And those capabilities are spreading. Anthropic’s testing shows that openly downloadable models can now develop sophisticated exploitations, putting powerful offensive capabilities within reach of a much broader audience.
That is why we expect the transition to be so dangerous. Offensive capabilities can spread faster than defensive improvements reach the businesses that need them.
The risk is moving inside the business
AI agents introduce another challenge.
An agent with access to customer records, internal systems, or payment workflows becomes another identity that needs to be secured. If compromised or manipulated, its legitimate permissions can become a route to damage.
The access that makes an agent useful also makes controlling its authority essential.
For founders adopting AI, three questions should accompany every deployment: What can this agent access? What can it change? Who is accountable when something goes wrong?
An urgent problem creates an opportunity
AI also gives defenders powerful tools to inspect software, identify weaknesses, and develop fixes. Over time, those capabilities could help produce a substantially more secure internet. Getting there requires turning discoveries into tested, deployed protection.
That is where we see the entrepreneurial opportunity.
The most valuable solutions will shorten the path from identifying a threat to protecting a customer: prioritizing vulnerabilities that matter, deploying repairs safely, controlling agent permissions, and making effective defenses accessible to organizations with limited resources.
We may eventually look back on this period as the beginning of a safer internet. Before we get there, I expect we’ll experience breaches at a pace, scale and severity that it’s hard to imagine.
For entrepreneurs who can help businesses defend themselves at the speed this new environment demands, the need is urgent. So is the opportunity.
