When AI Is the Threat: AI-Enabled Attackers and the Collapsing Exploitation Window

Chapters 16 and 17 treat AI as something to protect; this chapter and the next treat it as the source of the threat. This chapter concerns the adversary who uses AI to find vulnerabilities, turn published patches into exploits, run intrusions at machine speed, and impersonate an executive on a video call. Chapter 19 concerns the threat that needs no adversary: the organisation's own agent that works around a sandbox, a test or an oversight mechanism to complete its task. The security fundamentals and threat handling of Architecture as Code (Chapters 9 and 9C) remain the foundation (72, Nordqvist, 2025).

Two forms of threat, one principle

Classical threat models assume that external adversaries are limited by time and skill, and that internal actors are limited by intention, so a trusted component with broad access is safe as long as it means well. AI erodes both assumptions: models compress the adversary's time and lower the skill required, and agents act inside the estate with credentials, tools and goals, producing actions nobody specified.

None of the responses relies on predicting the actor. An egress allow-list stops an intruder's exfiltration and an agent's unsanctioned download alike, and two-person approval for irreversible actions defeats both a cloned voice and an agent that has found a shortcut. Every boundary around an AI workload, and every approval of a consequential action, should be enforced by something that neither an attacker nor the workload itself can change. Chapter 19 develops that principle for the organisation's own agents; this chapter applies it to the adversary on the evidence available in late 2026.

Adversaries who use AI

The economics of offence

Most of what attackers do with AI is not new; it is cheaper and faster. The Google Threat Intelligence Group (GTIG) and Mandiant put it plainly in October 2026: AI "does not fundamentally change the techniques attackers use. It reduces the time required to combine them" (105, Blum et al., 2026). At the price of API calls, unprofitable campaigns become profitable.

The picture has moved quickly. Anthropic's threat report covering December 2025 to August 2026 stated that "a majority of the operations described in this report were enabled by AI via direct execution or orchestration" (111, Anthropic, 2026). The ENISA Threat Landscape 2026, covering 2025, still found that attackers "primarily use consumer-grade AI tools to augment existing skills", but expected more phases of the kill chain to be directly enabled by AI in 2026 (108, ENISA, 2026). Capability has therefore arrived faster than adoption; that gap is the defender's opportunity, and it is closing.

Every patch is an exploit specification

A security patch tells the attacker exactly where the flaw was. Brumley and colleagues demonstrated this in 2008, generating exploits automatically from Windows Update patches for five Microsoft programs, "usually within a few minutes", and warned that staggered patch distribution could let attackers who receive the patch first compromise many hosts that had not yet received it (83, Brumley et al., 2008).

Large language models (LLMs) have made the technique general. In 2024 Fang and colleagues gave a GPT-4 agent the descriptions of 15 one-day vulnerabilities, disclosed but not yet patched everywhere. It exploited 87 per cent of them, while every other model tested and the ZAP and Metasploit scanners exploited none, and without the description GPT-4 managed 7 per cent (84, Fang et al., 2024); the advisory was the decisive input. In April 2026 Anthropic reported that Claude Mythos Preview, tested against 40 Linux kernel vulnerabilities with public identifiers, succeeded in more than half of its privilege-escalation attempts; the two exploits documented in detail cost under USD 1,000 and under USD 2,000 in API cost and took half a day and under a day (118, Carlini et al., 2026). GTIG's analysis of September 2026 duly named "rapid weaponization of n-days", vulnerabilities for which a patch or advisory exists, as the main driver of growth in exploitation (106, Grunewald et al., 2026). Publishing a fix now starts a race the defender begins with a handicap, because the attacker needs one exploit and the defender needs every instance patched.

The collapsing exploitation window

Mandiant measured an average time-to-exploit of 63 days in 2018 to 2019, 44 days in 2020 to early 2021, 32 days in 2021 to 2022, and 5 days in 2023 (47 days if 15 outliers are included); of the n-days exploited in 2023, 12 per cent were exploited within a day of the patch and 56 per cent within a month (85, Charrier & Weiner, 2024). M-Trends 2026 estimated the mean time to exploit at minus seven days: exploitation now routinely precedes the patch (86, Mandiant, 2026). The window was collapsing before AI, which now pushes in the same direction.

GTIG's September 2026 figures show the pressure. Monthly disclosures rose from 5,045 in January 2026 to 10,740 in August 2026, and in-the-wild exploitation from 10.5 vulnerabilities a month in 2025 to 18 a month in 2026. However, only 0.23 per cent of disclosures were exploited, and GTIG called confirmed exploitation of AI-discovered vulnerabilities "an early indicator rather than an established trend" (106, Grunewald et al., 2026); the small exploited fraction is why prioritisation works at all.

The agencies have drawn the conclusion. In May 2026 the UK National Cyber Security Centre (NCSC) told organisations to "prepare for a wave of patches" and adopt "update by default" (122, NCSC, 2026). In June 2026 the Five Eyes agencies wrote that "the timeline is not years, it is months" and asked leaders to reduce attack surface, accelerate patching, address legacy systems, strengthen identity and prepare for incidents (116, Five Eyes agencies, 2026). A monthly patch cycle no longer matches the threat, as Figure 18.1 shows.

Figure 18.1: The exploitation window then and now. Where weeks once separated a patch from its exploitation, the defender now has days or less, so triage and compensating controls must act within hours, and segmentation must already be in place. The table lists the controls.

Defensive control	Purpose
Accurate inventory and SBOM	Know what is exposed
Triage with EPSS and known-exploited catalogues	Rank by exploitability
Virtual patch or compensating control	Reduce exposure within hours
Emergency patch by exploitability tier	Remove the flaw
Segmentation and zero trust	Limit blast radius, always on
Verify, hunt and record evidence	Confirm the fix and keep the record

Where the trend leads if the time from patch to exploit keeps falling towards minutes is a matter of judgement rather than evidence; the author's projection is in AI Governance, Chapter 24.

AI-assisted discovery and the defender programmes

The same capability finds new flaws. In the DARPA AI Cyber Challenge of August 2025, finalist systems found 54 of 63 synthetic vulnerabilities, patched 43, and found 18 real vulnerabilities, at an average of 45 minutes per patch (88, DARPA, 2025). In April 2026 Anthropic stated that Claude Mythos Preview can "surpass all but the most skilled humans at finding and exploiting software vulnerabilities", withheld it from general availability, and offered access to partners and open-source maintainers through Project Glasswing (117, Anthropic, 2026). By May 2026 about 50 partners had found more than 10,000 high or critical vulnerabilities, patching took about two weeks on average, and human verification was the bottleneck (119, Anthropic, 2026).

Two lessons follow. The volume of patches will rise sharply, and every fix becomes an exploit specification. Moreover, the gating is temporary: Anthropic said in June 2026 that it expects "many other AI companies will have Mythos-class models" within six to twelve months (120, Anthropic, 2026).

Agentic offensive frameworks and campaigns

The step from assisted to orchestrated intrusion is documented. In November 2025 Anthropic reported a state-sponsored group, attributed with high confidence to China, that used Claude Code against roughly thirty targets, succeeding in a small number; the AI performed an estimated 80 to 90 per cent of the campaign, with human input at perhaps four to six decision points, and occasionally produced hallucinated credentials (87, Anthropic, 2025). In 2026 Anthropic described an actor that moved from a single developer token to cloud administrator in about three hours (111, Anthropic, 2026), and GTIG reported a mass credential-harvesting campaign planned, built and run "in less than six hours", while having "not yet observed threat actors deploying fully autonomous pipelines against targets in the wild" (112, Google GTIG, 2026). In October 2026 GTIG and Mandiant reported abuse of open-source agentic penetration-testing frameworks, naming ARTEX, Hexstrike, CAIRN and PentAGI, with execution bursts of about 2 to 25 seconds and one campaign that reached deep access in about four hours. Such frameworks "compress attack timelines to machine speed; however, they currently trade stealth for velocity" (105, Blum et al., 2026).

That last observation is the defender's foothold. Machine-speed intrusion is noisy, so bursts of enumeration and token use from unfamiliar infrastructure are detectable, provided detection runs at comparable speed and has authority to act. ENISA expects at most "possible experimentation of Human-out-of-the loop proof of concepts" in 2026 (108, ENISA, 2026).

Social engineering and deepfake fraud

AI's most mature offensive use remains persuasion. Europol's IOCTA 2026 found that generative AI improves the personalisation of social engineering, that AI-assisted impersonation features in business email compromise and CEO fraud, and that criminal adoption of agentic AI is set to raise online fraud to unprecedented levels (93, Europol, 2026).

The case architects should remember is Arup. In 2024 a finance worker in Hong Kong joined a video conference in which the other participants' voices and images were fabricated, and sent HK$200 million, about USD 25.6 million, in 15 transactions; Arup stated that none of its internal systems were compromised (92, Magramo, 2024). Nothing was hacked. The approval process itself was the vulnerability, because it treated a familiar face and voice as proof of identity and authority.

The architectural response

Four design commitments answer the AI-enabled adversary. Containment of AI workloads, which protects equally against an intruder who has taken over a workload, is the subject of Chapter 19.

Speed: patch velocity and compensating controls

An accurate inventory of software and versions, maintained as a software bill of materials, is the precondition, because nobody can patch what they cannot find. Prioritisation combines the probability of exploitation from the Exploit Prediction Scoring System (EPSS), which FIRST describes as a population-level score that must be combined with local context rather than treated as the final word, with known exploitation from catalogues such as CISA's and ENISA's European Vulnerability Database, and with local exposure (89, FIRST, n.d.), (90, CISA, n.d.), (91, ENISA, 2025). Patch velocity then becomes a measured service level with an emergency path, and where a patch cannot be applied in time, compensating controls such as virtual patching, disabling the feature or isolating the system carry the risk. Immutable, rapidly redeployable infrastructure, the subject of Architecture as Code, makes a two-day service level achievable rather than heroic (72, Nordqvist, 2025).

Detection at machine speed

Detection needs signals that fire in seconds, such as bursts of directory enumeration or a token used from new infrastructure. Canary tokens and honeytokens where no legitimate workload should look turn intrusion into high-confidence alerts. Detection also needs authority, because an alert to a person not empowered to stop the workload produces a record, not a response.

Identity and approvals that resist synthetic media

A face and a voice on a call are no longer evidence of identity. High-value or irreversible actions, whether a payment, a change of bank details, a privileged access grant or a production deployment, therefore require verification through an independent channel registered in advance and approval by a second person who did not receive the request. The same rule covers agents, whose irreversible actions wait for a recorded human decision (Chapter 19).

Using AI for defence, under oversight

The Five Eyes call for accelerated patching is easier to meet with AI that triages advisories, maps them to the inventory, drafts compensating controls and searches the organisation's own code for the flaws that published patches reveal (116, Five Eyes agencies, 2026). Because human verification is the bottleneck in the defender programmes (119, Anthropic, 2026), and defensive agents are agents, Chapter 19's containment applies: scoped credentials, sandboxed verification and a human who approves each change.

Across the usage modes

The AI-enabled adversary reaches the organisation through every usage mode, by different routes (usage-mode matrix); Chapter 19 gives the table for the organisation's own agents.

Usage mode	How the AI-enabled adversary arrives	Controls that matter most
Mode 0 Ambient AI	Manipulated summaries; supplier features as an unreviewed path	Supplier patch terms; inventory of supplier features
Mode 1 Conversational assistants	AI-crafted lures and deepfakes aimed at staff	Synthetic-media-resistant approvals; training
Mode 2 Embedded workplace assistants	AI-generated mail carrying injected instructions	Tenant configuration; detection on mail and documents
Mode 3 Agentic work tools	Poisoned packages, repositories and pages	Package mirror, egress control, Chapter 19 containment
Mode 4 Built AI applications	Automated probing within a shrinking patch window	Patch velocity, virtual patching, segmentation
Mode 5 Autonomous production agents	All of the above, at machine speed	Every control above, plus an independent stop path

Approvals that resist synthetic media protect every mode, because the person approving is the target, whereas patch velocity governs the estate behind Mode 4 and Mode 5.

The European frame

European instruments already require much of this response. The Cyber Resilience Act (CRA) obliges manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents from 11 September 2026 through ENISA's Single Reporting Platform: an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days after a corrective or mitigating measure is available for exploited vulnerabilities (109, ENISA, 2026), (7, European Union, 2024). The process that meets those clocks is the same one that compresses an organisation's own patch window.

NIS 2 requires each Member State to designate a computer security incident response team (CSIRT) to coordinate vulnerability disclosure; its Article 21 places supply-chain security among the required measures, and Article 23 sets the incident-reporting timelines (4, European Union, 2022). DORA requires financial entities to test their digital operational resilience, including threat-led penetration testing for the most significant entities, to which AI-enabled adversary emulation is a natural extension (3, European Union, 2022).

The AI Act requires high-risk systems to be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting vulnerabilities (Article 15), and requires human oversight that can interrupt the system safely (Article 14) (1, European Union, 2024); a high-risk system on an unpatched inference server is hard to call resilient. For providers of general-purpose AI models with systemic risk, the Code of Practice names "cyber offence" among the systemic risks to assess, alongside "loss of control", which Chapter 19 takes up (14, European Commission, 2025). A deployer cannot evaluate those risks itself, but it can ask for the evidence in procurement, as AI Governance, Chapter 7 describes.

Practical guides

The four guides below are work a large organisation or public authority can start this quarter. Adapt the defaults to the organisation's risk appetite and record the adaptation as a decision.

Practical guide: compressing the patch window

Purpose. Bring the time from advisory to protection within days for the vulnerabilities that matter. Roles. Vulnerability management lead (owner), platform and application owners, change advisory board, CISO for exceptions.

1. Generate a software inventory with versions, as an SBOM from the build pipelines, for every internet-facing system, AI platform component and inference server, and map new advisories to it automatically.
2. Classify each finding into a tier by known exploitation, exploitation probability and exposure, as in the policy below.
3. Pre-approve an emergency change path for tier 1, so that no meeting stands between the patch and production.
4. Prepare compensating controls in advance for every tier-1 component class, and record each use with an expiry date.
5. Verify remediation by rescanning, not by closing a ticket, and publish service-level performance monthly.
6. Move systems that need no manual testing, such as browsers and operating-system security updates, to automatic deployment with canary rings and rollback, as AI Governance, Chapter 24 argues.

# patch-velocity-policy.yaml — service levels by exploitability tier
apiVersion: security.example.eu/v1
kind: PatchVelocityPolicy
tiers:
  - id: tier-1
    criteria:
      anyOf:
        - knownExploited: true
        - epssAtLeast: 0.10
          exposure: internet-facing
    protectWithin: 48h          # patch or compensating control in place
    changePath: emergency-pre-approved
  - id: tier-2
    criteria:
      anyOf:
        - epssAtLeast: 0.01
        - exposure: internet-facing
    protectWithin: 7d
  - id: tier-3
    criteria: {default: true}
    protectWithin: 30d
compensatingControls:
  allowed: [virtual-patch, feature-disable, network-isolation]
  maxDuration: 14d
  approval: ciso

Definition of done. Tier-1 findings are protected within 48 hours in at least 95 per cent of cases over a quarter; automatically updatable systems receive security updates on release; every tier-1 component class has prepared compensating controls with an owner and an expiry date.

Practical guide: the first hours after a critical patch is published

Purpose. Act before an exploit for a published critical patch exists. Roles. Duty security officer (owner), affected system owners, network team.

1. Within one hour, confirm exposure from the inventory.
2. Within four hours, apply the vendor's interim mitigation or a compensating control to internet-facing instances.
3. Within eight hours, raise detections for unusual process launches, new outbound connections and access to secrets on the affected component.
4. Within 24 hours, patch tier-1 instances through the emergency path, most exposed first.
5. Review logs since disclosure for earlier exploitation, and if found, move to incident response and assess reporting under NIS 2, DORA or the CRA.

Definition of done. Exposure known within one hour; internet-facing instances mitigated within four hours; each step recorded in the evidence store.

Practical guide: hardening approvals against voice cloning and deepfake video

Purpose. Make sure no payment or privileged change can be authorised by appearance alone. Roles. CFO and treasury, IT service management, internal audit.

1. List the actions that move money, change payee details, grant privileged access, or deploy to production.
2. For each, require call-back verification through a channel registered in advance, and above a threshold a second approver who did not receive the request.
3. Introduce a cooling-off period for first-time payees and urgent requests.
4. Train the people in these roles with synthetic-media exercises, and make clear that refusing an urgent request from a "senior executive" is protected behaviour.

Definition of done. Every listed action has a call-back and a second approver, and a test request using a synthetic voice is stopped by the process.

Practical guide: a 30-60-90-day plan for a large organisation or public authority

Purpose. Sequence the work so that the most exposed risks fall first. Roles. CISO (owner), CIO, head of AI platform, chief financial officer.

1. Days 1 to 30. Inventory internet-facing systems, AI components and inference servers; adopt the patch-velocity policy; introduce call-back verification for payments and payee changes; remove non-essential production access from agents, as Chapter 19 prescribes.
2. Days 31 to 60. Prepare compensating controls for each tier-1 component class; set decision rights for emergency patches and for stopping agents; run a synthetic-media exercise and a tabletop in which an exploit follows an advisory within 48 hours.
3. Days 61 to 90. Publish patch service levels; add AI-enabled adversary emulation to testing, under DORA where it applies; review vendor evidence on cyber-offence risks for the models in use.

Definition of done. After 90 days, the organisation can state its tier-1 patch performance, show prepared compensating controls, and show that no payment can be approved on appearance alone.

Nordvik Region and Hansa Mutual

Nordvik Region meets the AI-enabled adversary through its people and its suppliers. AI-assisted phishing and voice cloning target its payment and payee-change processes, and its patch window is set by supplier release cycles and procurement, since the benefits-triage system and most of its estate are patched on the supplier's schedule. Its plan therefore starts with call-back verification, patch service levels written into supplier contracts at the next renewal, and an inventory of the ambient AI features suppliers switch on; its own inference platform, patched by a small team, argues for automatic updates wherever testing allows.

Hansa Mutual meets the adversary at scale. Its shared platform serves seven markets, so one unpatched inference server or gateway is exposed on behalf of every entity, and payment approvals that cross entities and languages make deepfake-resistant approvals more important. Its EU entities can fold AI-enabled adversary emulation into DORA's threat-led penetration testing (3, European Union, 2022), while the UK and Swiss entities follow their own regimes. Nordvik's priority is closing the routes adversaries use against its people and suppliers; Hansa's is patching a large, shared estate faster than exploits arrive.

Summary

Adversaries now use AI to turn patches into exploits within days, to find flaws at a scale that has multiplied the number of fixes, to run intrusions at machine speed, and to impersonate the people whose word moves money. The agencies' advice is consistent: shrink the attack surface, patch faster, strengthen identity, and prepare for incidents.

The response rests on controls that hold whatever anyone intends: patch velocity as a measured service level with compensating controls, detection with authority to act, approvals that do not trust appearance, and defensive AI under human oversight. Chapter 19 applies the same principle to the organisation's own agents that exceed their mandate.

Sources

1. Nordqvist, G. (2025). Architecture as Code. The Transformed Architecture, Book 1, published at aac.geon.se. (72, Nordqvist, 2025)
2. Blum, Mainor, Nambiar et al. (2026). ARTEX and Friends: Enter Agentic Offensive Frameworks. Google Threat Intelligence Group and Mandiant, Google Cloud Blog, 30 October 2026. (105, Blum et al., 2026)
3. Anthropic (2026). Detecting and countering misuse of AI: September 2026. Threat Intelligence Report, September 2026. (111, Anthropic, 2026)
4. European Union Agency for Cybersecurity (2026). ENISA Threat Landscape 2026. September 2026. (108, ENISA, 2026)
5. Brumley, D., Poosankam, P., Song, D. & Zheng, J. (2008). Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications. 2008 IEEE Symposium on Security and Privacy, pp. 143–157. (83, Brumley et al., 2008)
6. Fang, R., Bindu, R., Gupta, A. & Kang, D. (2024). LLM Agents can Autonomously Exploit One-day Vulnerabilities. arXiv:2404.08144. (84, Fang et al., 2024)
7. Carlini, N., Cheng, N., Lucas, K. et al. (2026). Assessing Claude Mythos Preview's cybersecurity capabilities. Anthropic Frontier Red Team, 7 April 2026. (118, Carlini et al., 2026)
8. Grunewald, R., Mazumdar, S. & Vanderlee, K. (2026). Vulnerability Discovery and Exploitation Trends in the AI Era. Google Threat Intelligence Group, Google Cloud Blog, 30 September 2026. (106, Grunewald et al., 2026)
9. Charrier, C. & Weiner, R. (2024). How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends. Mandiant, Google Cloud Blog, 15 October 2024. (85, Charrier & Weiner, 2024)
10. Mandiant (2026). M-Trends 2026: Data, Insights, and Strategies From the Frontlines. Google Cloud Blog, 23 March 2026. (86, Mandiant, 2026)
11. National Cyber Security Centre (2026). Preparing for a 'vulnerability patch wave'. NCSC blog, 1 May 2026. (122, NCSC, 2026)
12. Five Eyes cyber security agencies: ASD's ACSC, Canadian Centre for Cyber Security, NCSC-NZ, NCSC-UK, NSA and CISA (2026). The AI shift in cyber risk: why leaders must act now. Joint statement, 22 June 2026. (116, Five Eyes agencies, 2026)
13. Defense Advanced Research Projects Agency (2025). AI Cyber Challenge marks pivotal inflection point for cyber defense. DARPA, 8 August 2025. (88, DARPA, 2025)
14. Anthropic (2026). Project Glasswing: Securing critical software for the AI era. 7 April 2026, updated 6 October 2026. (117, Anthropic, 2026)
15. Anthropic (2026). Project Glasswing: An initial update. 22 May 2026. (119, Anthropic, 2026)
16. Anthropic (2026). Expanding Project Glasswing. 2 June 2026. (120, Anthropic, 2026)
17. Anthropic (2025). Disrupting the first reported AI-orchestrated cyber espionage campaign. 13 November 2025. (87, Anthropic, 2025)
18. Google Threat Intelligence Group (2026). GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI. Google Cloud Blog, 8 September 2026. (112, Google GTIG, 2026)
19. Europol (2026). The evolving threat landscape. How encryption, proxies and AI are expanding cybercrime – Internet Organised Crime Threat Assessment (IOCTA) 2026. Luxembourg: Publications Office of the European Union. ISBN 978-92-9414-096-8. (93, Europol, 2026)
20. Magramo, K. (2024). Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee. CNN Business, 16 May 2024. (92, Magramo, 2024)
21. Forum of Incident Response and Security Teams. Exploit Prediction Scoring System (EPSS). FIRST; academic basis Jacobs, J. et al. (2021), Digital Threats: Research and Practice 2(3), https://doi.org/10.1145/3436242. (89, FIRST, n.d.)
22. Cybersecurity and Infrastructure Security Agency. Known Exploited Vulnerabilities Catalog. CISA. (90, CISA, n.d.)
23. European Union Agency for Cybersecurity (2025). European Vulnerability Database (EUVD). Launched 13 May 2025 under the NIS 2 Directive. (91, ENISA, 2025)
24. European Union Agency for Cybersecurity (2026). The CRA Single Reporting Platform is launched. 11 September 2026. (109, ENISA, 2026)
25. European Parliament and Council of the European Union. Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). Official Journal of the European Union, 20 November 2024. (7, European Union, 2024)
26. European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). Official Journal of the European Union, 27 December 2022. (4, European Union, 2022)
27. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, 27 December 2022. (3, European Union, 2022)
28. European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, 12 July 2024. (1, European Union, 2024)
29. European Commission. The General-Purpose AI Code of Practice. European AI Office, 10 July 2025. (14, European Commission, 2025)