AI Is Now Hacking Servers on Its Own. What That Means for Your Patch Window

Attackers are now using AI agents to do most of the hands-on work of a break-in: scanning, exploiting, moving through the network and writing the ransom note. At the same time, the gap between a bug going public and a bug being exploited has shrunk to zero or less. Mandiant now puts the mean time to exploit at negative seven days, which means attacks often start before a patch exists. For a small business, the practical takeaway is simple. Your internet-facing systems need to be patched in days, not weeks, and someone needs to be watching when a patch isn't available yet.

What do AI-run attacks look like right now?

Four published cases from the past year show attackers handing most of the work to AI and keeping only the big decisions for themselves.

GTG-1002. In November 2025, Anthropic reported that a Chinese state-sponsored group it tracks as GTG-1002 used Claude Code against roughly 30 targets around the world. By Anthropic's account, the AI did 80 to 90 percent of the work, with humans stepping in at only four to six decision points. It sent requests at a pace no human team could match, "often multiple per second," according to a correction Anthropic published the next day. The campaign succeeded in a small number of cases.

"Vibe hacking." Anthropic's August 2025 misuse report describes a single criminal who used Claude Code to steal and extort data from at least 17 organizations, including healthcare providers, emergency services and government bodies. Some ransom demands topped $500,000, from one operator working alone.

Token to admin in three hours. Anthropic's September 2026 threat intelligence report covers one attacker who went from a stolen developer token to full cloud admin in about three hours. The report says AI has "collapsed the labor and tooling gap" between state teams and lone operators. Fortune's coverage drew out the part that matters most here: when attacks get cheaper to run, smaller companies become worth attacking.

JADEPUFFER. In July 2026, Sysdig documented what it calls the first documented case of agentic ransomware. An LLM ran the extortion from start to finish. It got in through CVE-2025-3248, a Langflow flaw that already had a patch, and encrypted 1,342 configuration items. When one of its logins failed, it fixed the problem on its own in 31 seconds.

If you manage IT, notice the entry point. JADEPUFFER didn't need a zero-day. It used a known Langflow bug on a server nobody had updated.

Can AI find and exploit new vulnerabilities on its own?

Yes. Most of the public evidence comes from defenders and researchers, and an attacker can point the same skills at your servers.

• Project Glasswing. In April 2026, Anthropic said its Claude Mythos Preview model found "thousands" of zero-day vulnerabilities across major operating systems and browsers, including a 27-year-old OpenBSD bug and a 16-year-old FFmpeg bug. It wrote many working exploits without any human steering. Anthropic warned that these capabilities will proliferate.
• Google Big Sleep. Google's AI agent found SQLite flaw CVE-2025-6965, a bug that was, per SecurityWeek, "only known to threat actors." It was the first time an AI agent directly stopped an exploit attempt in the wild.
• XBOW. An autonomous AI penetration tester reached the top of HackerOne's US leaderboard in June 2025, with about 1,060 submissions, 54 rated critical and 242 rated high.
• DARPA AIxCC. At the August 2025 finals, competing AI systems found 86 percent of the planted vulnerabilities and patched 68 percent. They also found 18 real bugs nobody had planted. The average patch took 45 minutes and cost about $152 per task.

AIxCC's numbers are the useful ones for budgeting your risk: 45 minutes and about $152 to produce a patch. Those are defender results, but they show how cheap automated bug hunting has become for anyone.

How much time do you have to patch before attackers strike?

Often none. The 2026 reports below show attackers moving earlier, and Verizon's data shows defenders patching slower.

Compare the first row with the median patch time. Attackers often start before the patch ships, while defenders take a median of 43 days to finish patching, up from 32. The Verizon report also found ransomware in 48 percent of breaches.

The CrowdStrike breakout figure matters for anyone without overnight coverage. Once an attacker is inside, the average eCrime group moves to other systems in 29 minutes. If your alerts sit in an inbox until Monday, the attacker has had the whole weekend. CrowdStrike also reported that AI-enabled adversary activity rose 89 percent.

CISA responded in June 2026. Its directive, BOD 26-04, sets 3-, 14- and 60-day remediation windows for federal agencies based on risk, and says AI "may further narrow" how long defenders have to react. You aren't a federal agency, but the directive is a solid yardstick for what "fast enough" means now.

Is AI writing malware now?

In a few early cases, yes. In November 2025, Google's Threat Intelligence Group reported the first malware that calls an LLM while it runs. Russia's APT28 used one family, PROMPTSTEAL, in live operations in June 2025. Another, PROMPTFLUX, asks Gemini to rewrite its own code so it's harder to detect. Google described PROMPTFLUX as experimental.

AI is also making the social side of attacks work better. Microsoft's Digital Defense Report 2025 found AI-driven phishing was "three times more effective" and that 33 percent of attacks included an extortion component. Mandiant ranks voice phishing as the number two initial access vector at 11 percent.

Is the AI threat overhyped?

Partly. Mandiant's M-Trends 2026 report says 2025 was not the year breaches came directly from AI. Most breaches still started with basic failures.

The AI agents also make mistakes. In the GTG-1002 campaign, Anthropic said Claude sometimes hallucinated credentials that didn't work. Out of about 30 targets, only a small number were breached.

Skip any product pitch built on AI fear alone. Attackers still get into small businesses through an unpatched server, a leaked token or a phished password. AI lets them move faster once they find one, so the defenses below are the usual basics run on a shorter schedule.

7 defenses against AI-speed attacks

Each step ties back to a source above. You can do all seven without buying an AI product.

1. Patch internet-facing known exploited vulnerabilities within 3 days. That's the tightest window in CISA BOD 26-04. Start with firewalls, VPNs, remote access tools and anything else reachable from the internet. Mandiant's negative seven day time to exploit means even three days leaves you exposed for a while, so treat it as a ceiling.
2. Treat the KEV catalog as your patch list. CISA's Known Exploited Vulnerabilities catalog lists bugs that are already being used in attacks. Check it against your inventory every week. With only 26 percent of KEVs fully fixed, getting this one list right puts you ahead of most organizations.
3. Inventory and harden edge devices and exposed AI apps. JADEPUFFER got in through Langflow, an AI app builder that someone had left exposed and unpatched. Find every system facing the internet, including AI tools your staff set up on their own, and either patch them, put them behind a VPN or shut them off.
4. Run 24/7 EDR with people watching it. A 29-minute average breakout time means an alert has to reach someone who can act that night. Endpoint detection with a managed detection and response team covers the gap when a patch doesn't exist yet.
5. Protect tokens and sessions. The three-hour cloud takeover in Anthropic's September 2026 report started with one stolen developer token. Rotate developer and cloud tokens on a schedule, keep secrets out of code repositories, and cut session lifetimes where you can.
6. Use phishing-resistant MFA and call back on payment changes. With AI phishing "three times more effective" and voice phishing now Mandiant's number two way in, move key accounts to passkeys or hardware keys. Require a phone call to a known number before anyone changes bank details or sends a large payment.
7. Control AI tools and API keys inside your own environment. The GTG-1002 and vibe-hacking cases both ran on commercial AI coding tools. Keep a list of the AI tools your team uses, decide who holds API keys, store those keys in a secrets manager, and watch for unusual usage the same way you'd watch any other admin account.

How AdVran helps

AdVran is an MSP and MSSP headquartered in Anaheim, serving businesses across Southern California. Our SOC monitoring and threat hunting service provides round-the-clock analyst coverage for the gap between an exploit and a patch. Our cybersecurity services cover patching against the KEV catalog, edge device hardening and MFA rollouts. If something does get through, our incident response and remediation team handles containment and recovery. If you'd like to know where your patch window stands today, we can review your internet-facing systems against the KEV catalog with you.

Frequently Asked Questions

How are hackers using AI to attack businesses?

They use AI agents to scan for weak systems, run exploits, move through networks and handle extortion. In one Anthropic case, AI did 80 to 90 percent of the work in a state-backed campaign. In another, a single criminal used AI to extort at least 17 organizations.

What is agentic ransomware?

It's ransomware where an AI agent runs the attack from start to finish instead of a human operator. Sysdig's JADEPUFFER report describes the first documented case: an LLM broke in through a Langflow flaw that already had a patch, encrypted 1,342 configuration items and fixed its own failed login in 31 seconds.

How fast do attackers exploit new vulnerabilities?

Often before a patch exists. Mandiant puts the mean time to exploit at negative seven days. VulnCheck found that 28.96 percent of newly exploited KEVs in 2025 were exploited on or before the day the CVE was published.

How quickly should a small business patch?

Aim for 3 days on internet-facing systems listed in the KEV catalog, which matches the tightest window in CISA BOD 26-04. Less urgent fixes can follow the directive's 14- and 60-day windows.

Are small businesses really targets for AI-driven attacks?

More than before. Anthropic's September 2026 report found that AI has closed much of the gap between state teams and lone operators, and Fortune noted that this makes smaller targets worth the effort.

References

1. "Disrupting the first reported AI-orchestrated cyber espionage campaign," Anthropic, November 13, 2025. https://www.anthropic.com/news/disrupting-AI-espionage
2. "Detecting and countering misuse of AI: August 2025," Anthropic, August 2025. https://www.anthropic.com/news/detecting-countering-misuse-aug-2025
3. "Threat Intelligence Report: September 2026," Anthropic, September 2026. https://www.anthropic.com/threat-intelligence-report-september-2026
4. "AI could make more companies worth hacking, Anthropic report suggests," Fortune, September 24, 2026. https://fortune.com/2026/09/24/ai-could-make-more-companies-worth-hacking-anthropic-report-suggests/
5. "JADEPUFFER: Agentic ransomware for automated database extortion," Sysdig, July 1, 2026. https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion
6. "Project Glasswing," Anthropic, April 7, 2026. https://www.anthropic.com/glasswing
7. "Google says AI agent thwarted exploitation of critical vulnerability," SecurityWeek, July 16, 2025. https://www.securityweek.com/google-says-ai-agent-thwarted-exploitation-of-critical-vulnerability/
8. "Top 1: How XBOW did it," XBOW, June 24, 2025. https://xbow.com/blog/top-1-how-xbow-did-it
9. "AIxCC results," DARPA, August 8, 2025. https://www.darpa.mil/news/2025/aixcc-results
10. "M-Trends 2026," Mandiant (Google Cloud), March 23, 2026. https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026
11. "State of Exploitation 2026," VulnCheck, January 21, 2026. https://www.vulncheck.com/blog/state-of-exploitation-2026
12. "2026 Data Breach Investigations Report," Verizon, May 20, 2026. https://www.verizon.com/business/resources/reports/dbir/
13. "Verizon 2026 DBIR findings," Help Net Security, May 20, 2026. https://www.helpnetsecurity.com/2026/05/20/verizon-2026-dbir-findings/
14. "2026 CrowdStrike Global Threat Report," CrowdStrike, February 24, 2026. https://www.crowdstrike.com/en-us/press-releases/2026-crowdstrike-global-threat-report/
15. "AI Threat Tracker: Threat actor usage of AI tools," Google Threat Intelligence Group, November 5, 2025. https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools
16. "Microsoft Digital Defense Report 2025," Microsoft, October 2025. https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2025
17. "BOD 26-04: Prioritizing Security Updates Based on Risk," CISA, June 10, 2026. https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
18. "Known Exploited Vulnerabilities Catalog," CISA, continuously updated. https://www.cisa.gov/known-exploited-vulnerabilities

Related Reading

• What 24/7 SOC Monitoring Actually Means for an SMB in 2026
• EDR vs MDR vs XDR: What Your Business Needs in 2026
• The True Cost of a Data Breach in 2026
• Shadow AI and Copilot: What Your Team's AI Tools Can Leak
• How California Businesses Stop Deepfake Wire Fraud