The security industry as we’ve known it can’t keep up with AI-powered attacks, and Alex Stamos thinks things will get worse before they get better. In a long conversation on Decoder, The Verge AI’s interview podcast, Cognition’s chief security officer described a stretch of nonstop breaches and warned that we’re heading into a “dark age” for cyber defense. He isn’t a doomer about the long run. The next few years are another story.
The interview is a good map of where things stand, so here are the key questions and what Stamos had to say.
What’s actually happening right now?
October is normally security awareness month, the time of year companies remind staff to use a password manager. This year it brought a run of major breaches instead. According to The Verge AI’s interview, Stamos pointed to:
- Big bugs in core software, including PHP and Node
- Breaches at several AI neoclouds, one after another
- The Binance hack, which he called “the largest heist of anything in human history”
- The Cursor incident, which shows how these attacks now feed into each other
Cursor is the one to pay attention to. Based on what’s known so far, attackers broke into Fireworks, a major AI inference provider, and stole API keys. They used those keys to get into Cursor. From there they pushed a malicious plugin that reached about 5,000 companies, which means 5,000 possible breaches from one chain.
Stamos calls it a “permanent continuous breach.” One CISO he knows asked a group of peers, “Is anybody else tired?” Everyone said yes.
Why is this different from past waves of hacking?
The attack process has flipped. Security people borrow the military term “kill chain” for the steps an attacker takes to reach a goal, whether that’s stealing data, money, or crypto. Until recently, most of that work happened in advance. Researchers found a bug, wrote an exploit, and then people deployed it against targets.
Now, Stamos says, open-weight models have gotten good enough to automate most of that chain. An AI system can scan targets, find bugs, and write working exploits on the fly, all at the same time.
He named one tool in particular: ARTEX, an open-source Chinese tool with an English translation on GitHub. Pair it with a modified version of GLM-5.3 that has its safety guardrails removed, and he says it can break into “a shocking number of organizations.” The campaign started with three South Korean banks. About 200 more companies were hit in a single week.
Who’s behind it?
There’s no single villain. Criminal groups and state actors like Russia and North Korea are all getting in. Stamos says the bigger issue is that attacker capability is starting to take off because the tools are free and available to anyone.
Should we trust this forecast?
Stamos has a strong track record. He has run security at Facebook and Yahoo, and he lectures at Stanford’s Cyber Policy Center. He’s also known for speaking bluntly, not for hyping problems.
One caveat is worth stating. Cognition builds AI coding tools and competes with Cursor, whose breach is one of his main examples. Nothing he describes looks exaggerated, but readers should keep that in mind.
His comparison to the 1990s holds up. Back then, connecting everything to the internet created years of easy targets before defenses caught up. AI is doing the same thing to the attack side, and it’s happening faster.
What does this mean for the AI industry?
AI companies are now a major part of the attack surface, not just suppliers of attack tools. Inference providers, coding assistants, and plugin marketplaces hold API keys and push code directly into customer environments. A single compromised vendor can spread to thousands of companies.
It also makes the open-weight debate harder. Open models drive a lot of innovation, but once their safety guardrails are stripped they become the engine behind tools like ARTEX. Expect regulators to bring this up.
What should teams do now?
- Audit your AI supply chain. Map every AI vendor, plugin, and extension that has keys or code access in your environment.
- Rotate and scope API keys. Assume any key held by a third party could leak. Use short-lived, narrowly scoped credentials.
- Lock down developer tools. Treat coding-assistant plugins like any other software dependency, with review and allowlists.
- Patch faster. If AI can find a bug and exploit it within hours, a monthly patch cycle is too slow.
- Use AI on defense too. Defenders can use the same models attackers use to find bugs.
Stamos expects the dark age to end eventually. Until then, every company running AI tools should assume it’s a target. The full conversation, which also covers AI misinformation and slop on social networks, is available at The Verge AI.