AI is giving attackers a head start, Microsoft warns

Threat actors are using AI to find bugs, build malware and run intrusions faster than defenders can keep up.

Microsoft’s 2026 Digital Defense Report, covering July 2025 to June 2026, describes a near-term period in which attackers collect the benefits of AI first and defenders have to move quickly to close the gap. “AI is changing the physics of cybersecurity,” the company said.

Bugs found faster than they get fixed

Vulnerability discovery and weaponization once required human experts. In a lot of cases, the job comes down to “simply writing a prompt,” Microsoft noted.

The median time from vulnerability discovery in the wild to weaponization has dropped to well below 24 hours. The number of CVEs tracked for 2026 is on track for a record of an estimated 72,000.

Remediation moves slower than discovery, so Microsoft expects a multi-year period in which known, unpatched vulnerabilities pile up. Well-funded attackers may be able to stockpile zero-days found this way.

Phishing was the way in for 23% of the intrusions Microsoft’s incident responders investigated between July 2025 and June 2026, up from 7% a year earlier. Exploits against public-facing applications rose from 15% to 24% over the same period.

Phishing and fraud get an upgrade

AI lets attackers personalize every phishing message, turning spear phishing into a mass operation, and helps them get past language and skill barriers.

Fraudsters faking an identity used to slip up with a forged ID that looked off, writing that read like a second language, an accent that came through during an interview, and barely any trace online. “AI fixes all four simultaneously,” Microsoft stated.

In 52.2% of intrusions that began with valid accounts, attackers harvested more credentials once inside, and another 18.4% involved active password spray campaigns.

State hackers fold AI into their work

Some Chinese state actors use AI tools to search for vulnerabilities or for tips on exploiting them. Russian threat actors have used vibe coding and AI-generated tooling, with AI serving to boost the scale and speed of their operations.

North Korean actors have increased their use of AI. The remote IT worker scheme uses AI for persona development, social engineering and keeping access, and other North Korean groups use it for malware creation and infrastructure management. Some have tried agentic workflows and LLM-generated code to speed up malware deployment.

The March 2026 compromise of the Axios npm package by a state-sponsored group is listed among North Korean supply chain activity.

The company expects China, Iran, Russia and North Korea to keep adding AI throughout the intrusion lifecycle, including more autonomous systems.

Malware with a model inside

The s1ngularity malware, spread through trojanized Nx npm packages in August 2025, looked for Claude Code, Gemini CLI or Amazon Q CLI on infected machines and ran them with permissive overrides to hunt for secrets and SSH keys. It leaked about 2,000 secrets and about 20,000 files from 225 victims.

PromptLock, an experimental ransomware prototype, shipped with prompts alone and received Lua scripts at runtime from an open-weights model on attacker infrastructure.

In December 2025, Microsoft found a malicious browser extension with more than 600,000 installs harvesting ChatGPT and DeepSeek conversations. It affected almost 10,000 organizations before it was mitigated.

Autonomous attacks move out of the lab

Anthropic’s Mythos and OpenAI’s GPT-5.5 were the first models to show the potential to orchestrate complex attacks on their own. In a test against an emulated enterprise environment with no defenders, they took control of the whole domain, including the main server and all user accounts, through a 32-step attack chain. Open-weight models trail closed models in attack orchestration by seven months.

Early July 2026 brought the first documented automated ransomware extortion attack, which the Sysdig Threat Research Team named JADEPUFFER. Microsoft has observed AI-orchestrated intrusions that share elements with that activity, at low volumes. The same month, OpenAI cybersecurity model training agents escaped their sandbox and attacked Hugging Face to get at a benchmark’s answer keys.

A report published in June 2026 showed that self-spreading worms driven by AI are feasible with current technology. Microsoft warns that a threat actor could soon build a worm that uses stolen LLM provider keys to improve itself, researching new vulnerabilities and refining its social engineering.

“Target selection, operational decision-making, and execution of the most complex intrusions remain manually driven in the majority of campaigns we observe,” Microsoft wrote. The company expects those limits to fade soon.