AI-Assisted Cyber Operations: Automated Phishing, Vulnerability Discovery, and Defense Evasion

Executive Summary

AI-enabled adversary operations increased 89% year-over-year in 2025, and average eCrime breakout time, the interval from initial access to lateral movement, fell to 29 minutes, with the fastest observed case completing in 27 seconds. The mechanism driving this compression is no longer theoretical: Google's Threat Intelligence Group has tracked a maturing transition from nascent AI-enabled operations to industrial-scale application of generative models within adversarial workflows, serving simultaneously as a sophisticated engine for attacker operations and a high-value target. Defenders operating under human-approval governance cannot match that tempo without structural reform of their own detection and response architecture.

• CISOs at critical infrastructure operators: The 29-minute breakout benchmark, documented by CrowdStrike, means your incident-response playbooks measured in hours are structurally obsolete; re-baseline detection thresholds against machine-speed lateral movement before Q4 2026.
• Risk officers and cyber insurers: The ICS/OT firebreak assumption underpinning most policy pricing is under pressure; Scenario B probability revised upward to approximately 42% in this assessment (from 40% in our August 16 analysis) given new evidence of AI-assisted PLC exploitation, detailed below.
• Government and regulatory stakeholders: The NIST AI 600-1 framework's identification of AI as a dual-vector risk, both as offensive capability amplifier and as a newly exploitable attack surface, requires parallel regulatory treatment, not sequential.

Across spear-phishing, vulnerability discovery, and defense evasion, AI has shifted from an experimental tool to a production component of adversary operations, and defenders who have not yet matched that adoption are operating at a structural speed disadvantage that compounds with every month of delay.

Phishing At Scale: How Quality Caught Up To Volume

The 2023-to-2026 arc of AI-generated phishing illustrates a capability transition that matters more than any single incident. The International AI Safety Report 2026, published via arXiv, confirmed that throughout 2024, "adversaries increasingly adopted generative AI, especially as a part of social engineering efforts," but assessed AI as likely secondary to other factors in driving attack volume. That assessment is now outdated. By 2026, the research documented by Frontier AI's cybersecurity landscape paper showed AI-automated phishing matching human expert effectiveness, eliminating the quality gap that had previously capped attacker ambition.

The mechanism is specific: large language models analyzing stolen organizational data, including email thread samples and vendor communications, can now generate lures that replicate institutional voice at scale. The Saudi Arabia CYFIRMA threat report documented AI technologies being leveraged to "automate attack creation and deployment at scale, enabling adversaries to generate high volumes of unique, context-aware messages that traditional defenses struggle to detect." A 135% increase in social engineering attacks followed ChatGPT's widespread adoption, with voice phishing increasing 260% in 2023 compared to 2022, as documented in Frontier AI research. Both figures predate the current generation of agentic AI tools, meaning the baseline is still accelerating.

What is not being reported: Most phishing incident statistics capture detected and reported campaigns. The dark matter is the volume of AI-generated spear-phishing that achieves initial access and is classified as credential compromise rather than phishing in post-incident categorization. The Palo Alto Networks Unit 42 report identified phishing and vulnerabilities as tied at 22% each for initial access vectors, but the classification methodology does not capture AI-enhanced social engineering that exploits legitimate access patterns rather than malicious payloads, meaning the reported phishing share likely understates AI's contribution to initial access.

The geopolitical dimension compounds the enterprise security risk directly. Google Threat Intelligence Group's tracking, as synthesized by the Cloud Security Alliance in its GREYVIBE report, showed that APT42 (Iran, IRGC) used Gemini for constructing social engineering pretexts targeting think-tank staff, while North Korea's UNC2970 used it for OSINT profiling of high-value targets. This state-sponsored scaling of phishing capability translates directly into credential theft that enables downstream financial fraud, data exfiltration, and persistent access to enterprise and government networks beyond the immediate geopolitical target set.

The Vulnerability Discovery Race: Who Benefits From 66,000 Cves

The FIRST forecast of approximately 66,000 CVEs for 2026, reported by Help Net Security in June 2026, changes the calculus for both sides of the defender-attacker equation, but not symmetrically. VulnCheck's assessment noted that AI "appears to increase the volume of vulnerabilities that can be discovered, giving defenders an opportunity to identify and remediate them before attackers do," a potentially optimistic framing that requires scrutiny.

The optimistic scenario assumes defenders can process the additional disclosures faster than attackers can scan for and exploit them. The Palo Alto Networks Unit 42 finding that attackers scan for newly disclosed vulnerabilities within 15 minutes of CVE announcement, combined with the CrowdStrike finding that 42% of vulnerabilities were exploited before public disclosure, indicates the window for the optimistic scenario is narrower than the disclosure volume implies. The MITRE ATT&CK technique T1588.006 (Vulnerabilities) and T1587.004 (Exploits) map directly to this attack phase, and the exploitation evidence base, including CVE-2022-30190 (Follina, confirmed in the Known Exploited Vulnerabilities catalog and linked to ransomware campaigns), illustrates how rapidly disclosed vulnerabilities become operational weapons.

The arxiv.org evaluation framework for emerging AI cyberattack capabilities identifies the specific bottleneck: "Finding previously unknown vulnerabilities is extremely difficult and time-consuming, requiring deep expertise and resources." AI does not eliminate this bottleneck uniformly; rather, it accelerates discovery for vulnerability classes amenable to pattern-matching, specifically memory safety issues in C/C++ and SQL/XSS injection variants, while leaving protocol-level and logic vulnerabilities more resistant to automated discovery. This means AI-assisted discovery primarily expands the exploitable surface in categories defenders already know to patch, accelerating an existing race rather than opening entirely new attack surfaces.

Tactical vs. strategic reading: Tactically, the 66,000 CVE forecast looks like a defender advantage because more bugs are disclosed before exploitation. Strategically, it represents an attacker advantage because the triage burden on defender teams grows faster than AI-assisted patching pipelines can absorb it, and the cognitive overhead of parsing 66,000 annual disclosures degrades the quality of prioritization for the subset that actually matter. Anthropic's April 2026 Project Glasswing warning, noted by VulnCheck, specifically flagged that AI-assisted vulnerability discovery could "enable attackers to hijack systems, disrupt operations, or steal data" through precisely this volume-overwhelm dynamic.

The ICS/OT implications are particularly acute. The August 2026 joint advisory from NSA, CISA, FBI, DOE, and EPA documented threat actors using AI assistance to generate exploitation scripts for Siemens S7 Series PLCs using publicly available information, targeting critical manufacturing, energy, water, and wastewater systems. This advisory, the first of its kind attributing AI-assisted exploit generation to ICS targeting, materially advances Scenario B probability. The advisory noted that actors leveraged internet scanning services like Censys and ZoomEye to identify exposed PLCs, a reconnaissance pattern (MITRE T1595, Active Scanning) now automated at scale by AI-driven tools.

Defense Evasion And The Malware-Free Intrusion Problem

The CrowdStrike 2026 Global Threat Report's finding that 82% of detections in 2025 were malware-free represents the most operationally significant shift for defenders. Attackers are logging in with stolen credentials and using native administrative tools (living-off-the-land tradecraft under MITRE T1059.001, PowerShell; T1059.006, Python) rather than deploying detectable payloads. AI amplifies this shift through two pathways.

First, AI accelerates credential harvesting at the reconnaissance phase. The MITRE T1589.002 (Email Addresses) and T1591 (Gather Victim Org Information) techniques are now executed by AI agents doing OSINT profiling of targets, as documented by Google Threat Intelligence Group for North Korean UNC2970. The CYFIRMA Hong Kong threat report noted underground discussions around AI-generated hyper-personalized phishing lures, with rapid growth in discussions since late 2025. Second, AI enables malware obfuscation (MITRE T1027) that adapts to specific detection environments. The arxiv.org CyberSecEval 3 evaluation documented LLM effectiveness in malware obfuscation, though noting these advances may simultaneously improve detection capabilities, reflecting the dual-use nature of the underlying models.

The Conti group's leaked ransomware playbook, referenced in the LLM Cyber Evaluations research, documented that post-exploitation automation is "feasible" for tasks involving specific software installation and PowerShell command execution (T1059.001), suggesting AI can now automate the mid-chain operational steps that previously required skilled operators. This drives the speed compression measured by CrowdStrike: if the steps between initial access and lateral movement can be scripted and automated by AI agents, the 29-minute average breakout becomes the new floor, not the ceiling.

The IBM X-Force Threat Index's 44% increase in attacks beginning with exploitation of public-facing applications confirms the combined effect: AI lowers the reconnaissance and initial-access barriers, credentials enable malware-free persistence, and living-off-the-land execution completes the chain with minimal detectable artifact. This translates directly into financial exposure for organizations because the mean time to detect malware-free intrusions is substantially longer than malware-based breaches, widening the exfiltration window.

The following table presents assumptions underlying the analytical findings above. Each assumption is stated in plain prose, with the evidence basis, falsifying condition, consequence if wrong, and the single best observable metric for tracking.

Counterarguments

1. The 89% AI-enabled adversary increase may overcount capability diffusion: The CrowdStrike figure tracks operations where AI tools were used in any phase, not operations that could not have been conducted without AI. If AI primarily accelerates existing tradecraft rather than enabling net-new attack categories, the structural threat increase is smaller than the headline suggests. A red team assessment on this point would require distinguishing AI-assisted operations from AI-dependent ones, a distinction the 2026 reporting generally does not draw. Overweighting the headline number risks overinvestment in AI-specific defenses at the expense of foundational controls, such as multi-factor authentication and credential hygiene, that address the malware-free intrusion problem regardless of AI involvement.

2. The vulnerability discovery race may favor defenders over a 24-month horizon: VulnCheck's 1H-2026 State of Exploitation report explicitly noted that AI "appears to increase the volume of vulnerabilities that can be discovered, giving defenders an opportunity to identify and remediate them before attackers do." If AI-assisted patch development matures faster than AI-assisted exploit development, the 66,000 CVE forecast represents a net improvement in the security posture of the software supply chain rather than a net threat increase. This assessment weights the attacker-speed evidence more heavily, but the countervailing argument is not trivial and would require reassessment if defensive AI patch generation reaches production scale ahead of the 12-18 month horizon.

3. The Taiwan multi-agent attack and PLC advisory rest on limited public attribution: The Dream research advisory documenting the Taiwan attack, cited in The Financial Times and Reuters, did not attribute the operation to a specific named group. The August 2026 NSA/CISA/FBI/DOE/EPA PLC advisory similarly did not attribute to a known actor. Where single-source or unattributed reporting drives key findings, the possibility of misclassification, deliberate staging for intelligence effect, or vendor-motivated framing cannot be fully excluded. Both the Taiwan attack and the PLC advisory advance this assessment's Scenario B reasoning, but a more conservative reading would treat them as indicative rather than confirmatory until independent technical corroboration is available.

Indicators To Watch

The table below identifies observable signals that would most materially confirm or revise the findings above. Each indicator is drawn from publicly trackable data series.

Near-term watch list: (1) Dragos Q3 2026 OT Threat Report (expected September 2026): the single most important data point for Scenario B probability; if Dragos documents confirmed AI-assisted OT-layer access, the firebreak assumption collapses and Scenario B rises above 50%. (2) CISA Known Exploited Vulnerabilities catalog updates through October 2026: the rate at which 2026-vintage CVEs enter the KEV catalog, relative to the 66,000 disclosure forecast, will reveal whether attacker exploitation is tracking the AI-driven disclosure surge or remaining concentrated in legacy software. (3) Google Threat Intelligence Group's next AI threat tracker update (expected Q4 2026): the prior February 2026 update confirmed APT operationalization of Gemini; the next edition will reveal whether additional models, including open-source and purpose-built offensive models, have entered adversary workflows.

Decision Relevance

Scenario A (~43%): AI-assisted attack tempo continues escalating at the IT layer, with no confirmed autonomous ICS/OT breach and no major-power kinetic escalation in the next 12 months. Revised downward from the August 16 estimate of approximately 45%, reflecting the NSA/CISA PLC advisory's evidence of AI-assisted ICS targeting narrowing the distance to Scenario B. If you are a CISO at a financial institution, government agency, or large enterprise without OT exposure, the 29-minute breakout baseline from CrowdStrike sets your detection-response requirement: any SOC architecture that cannot flag lateral movement and initiate containment within 20 minutes is operating outside the threat envelope. If you lack resources for full SOC re-architecture, prioritize identity monitoring and cross-domain correlation above all other controls, because 82% of intrusions are malware-free and signature-based defenses will not catch them.

Scenario B (~42%): An AI-assisted operation achieves confirmed ICS/OT exploitation with kinetic-capable effects, collapsing the IT/OT firebreak. Revised upward from the August 16 estimate of approximately 40%, driven by the NSA/CISA/FBI/DOE/EPA joint advisory on AI-generated Siemens S7 PLC exploit scripts and the Taiwan multi-agent attack establishing autonomous IT-layer breach capability. If you advise on cyber insurance underwriting, pricing for critical infrastructure policies under the assumption of a robust IT/OT firebreak is no longer supportable. If you hold positions in energy infrastructure equities or operate in the critical manufacturing, energy, water, or food and agriculture sectors, initiate OT asset inventory and network segmentation validation now; the Dragos Q3 2026 report is your decisional tripwire, not a quarterly update to file.

Scenario C (~15%): A confirmed autonomous AI cyber operation triggers escalation between major powers. Maintained at the August 16 estimate of approximately 15%. The Taiwan attack corroborates the mechanism but the specific conditions for AI-autonomous (rather than AI-assisted human-directed) attribution and consequent state response remain narrow. If you operate defense-adjacent supply chains or financial infrastructure linking US and Asian markets, the indicator to watch is not the next large-scale attack but the first instance where a targeted government publicly attributes an attack to an autonomous AI system rather than a state-directed one, a distinction that changes the escalation calculus materially.

• The primary offensive capability data derives from vendor threat intelligence reports (CrowdStrike, Google GTIG, Palo Alto Networks Unit 42, IBM X-Force), all of which have commercial incentives to frame AI threats at elevated severity. Independent academic corroboration for the quantitative figures, particularly the 89% AI-enabled adversary increase, is not yet available, and the methodology for attributing an operation as "AI-enabled" versus "AI-assisted" is not standardized across vendors.
• The International AI Safety Report 2026 (arXiv) assessed that "human-AI collaboration remains the dominant paradigm for cyber operations," with AI automating technical subtasks while humans provide strategic direction. This directly contradicts the fully autonomous attack narrative that the Dream/Taiwan advisory and some vendor reporting imply. The picture is mixed and this assessment treats the Taiwan attack as a near-autonomous, rather than fully autonomous, event.
• Defensive AI adoption data is largely self-reported from surveys, with the Crogl/Ponemon and Deloitte figures based on practitioner interviews rather than observable deployment metrics. If actual adoption is higher than survey data suggests, the defensive lag this assessment emphasizes may be smaller.
• The NSA/CISA/FBI PLC advisory did not attribute the Siemens S7 targeting activity to a named threat actor or country. Without attribution, the organizational intent behind the capability, whether criminal, nation-state, or opportunistic, cannot be assessed, which limits the geopolitical forecasting confidence for Scenario B.
• No verified public evidence of a successful autonomous AI operation achieving sustained ICS/OT safety-system override exists as of August 22, 2026. Scenario B rests on the narrowing distance to that capability threshold, not its confirmation. If the Dragos Q3 2026 report documents no escalation in OT targeting, the Scenario B probability estimate would require downward revision.