Cognition's security chief warns AI has weaponised hacking—and defenders are losing the race

The economics of cybersecurity have inverted, according to Alex Stamos, chief security officer at Cognition. As attack costs plummet thanks to open-weight AI models, defensive spending has stalled at elevated levels. Stamos, who also teaches at Stanford University's Cyber Policy Center, made his case on The Verge's Decoder podcast, where he outlined a grim picture: low-skilled attackers now wield capabilities once reserved for elite threat actors.

The culprit is open-weight AI models paired with automated attack tools. These systems can now orchestrate most of the kill chain—the sequence of steps from vulnerability discovery through data exfiltration. Stamos pointed to ARTEX, a Chinese open-source hacking tool available on GitHub with English documentation, which attackers combine with a modified version of the GLM-5.3 model stripped of safety guardrails. This combination has already compromised roughly 200 organisations, he said.

We are entering a dark age. Things are going to get more bleak.

Alex Stamos, Decoder podcast

Frontier models are no longer necessary

The initial breaches using AI-powered tools struck three South Korean banks, which CrowdStrike attributed to automated attack systems in October. The pace has accelerated since then. Attackers no longer depend on frontier models—those proprietary systems whose usage logs could theoretically aid law enforcement investigations. Stamos demonstrated the point by noting he runs a stripped-down GLM-5.3 on his personal Mac Studio.

Some intrusions still rely on human manipulation. North Korea's breach of Binance, which resulted in a $6.3bn loss, exploited social engineering through a fraudulent job interview. Meanwhile, intrusions targeting AI companies bear the hallmarks of what Stamos characterised as China's "cottage access industry"—small contractors who steal system access and resell it to larger Chinese organisations.

The cost asymmetry widens

The cost per token for attackers is going towards zero, and the cost of defense for defenders is staying quite high.

Alex Stamos

A contact at a major security firm told Stamos that running a single investigation with a frontier cyber model costs $900. This economic reality forces security teams to delegate initial monitoring duties to AI systems. The most cost-effective approach would deploy cheap classifiers first, escalating alerts to larger models only when needed.

At Cognition itself, Stamos has implemented a security agent capable of disabling staff accounts, though it halts at a predetermined threshold pending human approval. He also expressed scepticism about sensationalised claims regarding AI attack "swarms," discounting such narratives by roughly 80 percent. The actual attacks he observes typically deploy a single agent, occasionally two.

The 90-day ultimatum

Stamos issued an unambiguous directive: every organisation must conduct adversarial testing against its own infrastructure within approximately 90 days. Companies can deploy ARTEX, comparable AI red-teaming platforms, or engage external specialists for this purpose.

If you do not, you will get breached.

Alex Stamos

Such exercises may cause temporary service interruptions, Stamos acknowledged, but they would not result in data theft or catastrophic failures like the cyberattack that recently compromised French blood bank refrigeration systems, pushing temperatures to dangerous extremes.

Rewriting the Linux kernel

Patching alone cannot sustain security, Stamos contended, because each new frontier AI model unleashes fresh waves of Linux kernel vulnerabilities requiring fixes. He called on Google and Amazon to fork the Linux kernel for server infrastructure and rewrite it in Rust, a memory-safe programming language. The undertaking would cost between $100m and $1bn, he estimated. Recent PHP vulnerabilities nearly proved the point—they were difficult to weaponise in practice but demonstrated the mounting pressure.

Accountability and unequal treatment

Stamos advocated for holding AI developers liable when their models escape containment and directly harm targets. However, he warned that OpenAI and Anthropic have already begun rejecting certain requests from defensive security researchers. European and Asian companies receive noticeably worse treatment than their American counterparts from these labs, he observed. Slowing frontier AI development to allow defensive models to catch up would be acceptable to him.

On other fronts, Stamos argued against embedding personalities into chatbots and suggested that Meta should verify authentic photographs directly from camera sensors rather than attempting to detect synthetically generated images. He joined Cognition in September and plans to develop a "dark age index" measuring patch volume trends. Microsoft's monthly Patch Tuesday has ballooned from roughly 150 fixes to over 900, illustrating the accelerating burden.

Source: The Next Web