AI is rewriting the rules of cybersecurity. Who has the advantage?

Late Thursday afternoon, suspected North Korean hackers pulled off the largest cryptocurrency heist in history. After breaching a single account at the giant crypto firm Binance and draining $2.5 billion, the hackers compromised 10 other accounts within a 12-minute window.In all, they stole $6.3 billion, according to Binance.It could have been worse. A security company called Blockaid, which uses advanced artificial intelligence, says it detected the initial break-in in less than two minutes and, within the hour, had alerted customers to the attack. The hackers did not get away with all the money; Other cryptocurrency companies were able to trace and freeze roughly $3 billion of what the hackers initially took, Binance said. Welcome to cybersecurity in the age of AI.Just as assembly lines revolutionized manufacturing, AI is transforming the contest between hackers and cybersecurity firms, allowing both sides to operate faster, on a larger scale, and with less human intervention. Although the Binance hack hasn’t been definitively traced to AI, the scale of the breach is shaking the world of finance even as concerns have surged about AI’s role in expanding the risks institutions face. Matt Slocum/AP/FileThe Binance logo is seen on a smartphone, Feb. 28, 2023, in Marple Township, Pa. Software known as AI agents is quickly giving hackers the power to automate their attacks so that, with little or no human assistance, they can attack more targets and threaten everything from your bank account to your identity. Using the same tools, cybersecurity and AI companies are working ever faster to stay a step ahead and protect those things.The winners will be companies and governments that adapt quickly to the new technology. The losers will be those that don’t. “I can only hope that the rest of the world can understand it’s a matter of when [a cyberattack will happen], not if,” says Brandon Tirado, vice president in charge of cybersecurity operations for ReliaQuest, a worldwide cybersecurity firm based in Tampa, Florida.Already during the first half 2026, crypto companies lost some $1.1 billion in a record 212 verified hacking incidents, according to Blockaid. That was more than triple the attacks recorded in all of 2025.What’s going on with AI and AI hacking?On the positive side, AI agents are helping companies, as never before, find software vulnerabilities before hackers can exploit them. Last week, for example, companies coordinated a fix for vulnerabilities in PHP, a programming language used on 70% of websites worldwide. Those vulnerabilities were exposed by agents earlier this year and kept secret until the companies could devise a fix. Jon Nazca/ReutersA photo illustration shows the "<?php" tag taken from the official PHP website, on a computer screen, in Ronda, Spain, October 22, 2026. Government websites across Europe went dark on October 21 as operators raced to patch critical vulnerabilities in PHP, one of the most widely used programming languages on the web. The rollout of the fix was bumpy because news of the vulnerabilities leaked out, Mr. Tirado says. Some companies and governments closed down websites to avoid any problems. Fortunately, the fix was apparently deployed before hackers could find the PHP vulnerabilities.On the negative side, hackers can use the same “helping” AI agents to discover software vulnerabilities that they can then exploit.Are there examples that shed light on the challenge?In September, a Chinese hacking group known as Storm-0940 began using a “penetration-testing harness,” a suite of automated tools that cybersecurity firms use to find vulnerabilities. According to a Microsoft report last week, the group used this harness, or testing system, to automate attacks against hundreds of organizations worldwide across aerospace, defense, automotive, chemical, financial, and other industries, as well as against government agencies, think tanks, and nonprofits.The harness also managed to gain access to several internet cloud-based systems, sometimes in as little as three hours.In the ConnectWise attack earlier this month, hackers used compromised application credentials to try to access more than 2,250 customer accounts. In a separate operation, they launched up to 2,900 login attempts per minute against Microsoft accounts. Those login attempts failed, but Microsoft found evidence that the attackers had meanwhile gained privileged access to other organizations’ cloud systems. Cybersecurity firms believe Storm-0940, the Chinese hacking group, is aligned with China’s government, which has denied being aware of the incident.Perhaps equally worrying is that AI’s expertise is enabling hackers with lower sophistication and far fewer resources to carry out similar attacks.Last week, cybersecurity firm CrowdStrike reported that a hacker with limited cybersecurity expertise used Anthropic’s Claude Code to compromise several Indonesian government websites, a government domain in another country, and several private-sector organizations.“We expect over the next 12 months, some low-skill threat actors will likely use agentic AI to conduct campaigns at a level of effectiveness and scale previously only achievable by organized criminal groups or state-nexus actors,” the CrowdStrike report forecast.Already, the average number of weekly cyberattacks in September rose 16% compared with August and 48% from a year ago, according to Check Point Research. While not all of those attacks involved AI, experts warn that the technology makes it easier for less-skilled hackers to target more organizations.How can a company protect itself?Take Bank of America. In the second quarter, the nation’s second-largest bank added 1,000 contractors to its existing 3,000-strong cybersecurity workforce to help plug its software vulnerabilities against AI-enabled hackers, the bank’s CEO, Brian Moynihan, told CNBC recently. The bank spent more than $200 million in the third quarter on this work and anti-money-laundering compliance measures. Such preemptive AI work could help protect firms – and their customers – from hackers.“The companies that do that are going to be ahead of the game,” says V.S. Subrahmanian, a computer scientist at Northwestern University. “The companies that dither, dawdle, and don’t do that run the risk that the bad guys are going to get ahead of them.” Deepen your worldviewwith Monitor Highlights.Politics with respectGet political stories with respectful analysis.There‘s a world of new ideas in everyBooks newsletter.There‘s more to life, enrich yours withCulture & Learning weekly.Follow humanity‘s discoveries withScience & Nature stories in your inbox.Gain a spiritual perspectivefrom the stories in your inbox.Want to understand the deeper impact of critical events? Learn the Monitor‘s insight.Already a subscriber? Log in to hide ads. Whether AI agents have given hackers or defenders an advantage remains a subject of debate.“Microsoft can amortize the cost of all that finding [of vulnerabilities] over its entire customer base, so it’s cheaper overall for the defender than the attacker,” says Bruce Schneier, fellow at Harvard University’s Berkman Klein Center for Internet & Society and author of more than a dozen books on AI, cybersecurity, and trust. “On the minus side, the defender is much slower. It is faster to find and exploit than it is to find and fix.” ALREADY A SUBSCRIBER? LoginReal news can be honest, hopeful, credible, constructive.The Christian Science Monitor was founded in 1908 to lift the standard of journalism and uplift humanity. We aim to “speak the truth in love.” Our goal is not to tell you what to think, but to give you the essential knowledge and understanding to come to your own intelligent conclusions. Join us in this mission by subscribing.