AI Has Broken Cybersecurity, and Alex Stamos Says a Dark Age Has Begun

A single stolen API key cascaded from one breached AI provider into 5,000 potential corporate breaches in October, according to Alex Stamos, chief security officer at Cognition and lecturer at the Stanford University Cyber Policy Center. Speaking on The Verge's Decoder podcast, Stamos said the multibillion-dollar cybersecurity industry as it has been built over two decades is effectively overdue, and he described the present moment as the start of a "dark age" in digital defense.

Stamos described the mechanics of the Cursor incident in detail. Attackers broke into Fireworks, a prominent provider of AI services, and stole API keys. Those keys opened the way into Cursor. From there, the attackers pushed a malicious plugin to 5,000 more companies, creating 5,000 potential breaches. "It's just this kind of permanent continuous breach that is going on throughout the tech industry," Stamos said.

The October wave also included the Binance hack, which Stamos called "the largest heist of anything in human history," plus a series of breaches of AI infrastructure firms, the so-called neoclouds, and major bugs in PHP and Node. "A CISO friend of mine said to a bunch of us, 'Is anybody else tired?' And everybody said yes, because effectively we have been at DEFCON 2 for all of October and now going into November," Stamos said.

Who is running the attacks?

Stamos attributed the Binance theft to North Korea, which he said maintains an entire team dedicated solely to stealing Bitcoin. The breach of AI companies, he said, looks like the work of what he called the Chinese cottage access industry — small Chinese contractors who break into companies and sell the information to larger Chinese firms. Russian ransomware actors continue to target mid-size companies.

The deeper shift, in his view, is structural. Open-weight models have reached the point where most of the cyber "kill chain" can be automated. Traditionally, human researchers found vulnerabilities and wrote exploits in advance, then operators deployed them against hundreds or thousands of targets. AI has inverted that sequence.

"You can run an AI system that just goes hog wild and it looks at the targets and it finds the bugs in real time and it writes the exploits in real time and it breaks into these companies," Stamos said.

The tool at the center of the current wave, he said, is ARTEX, a Chinese open-source tool available with an English translation on GitHub. Powered on the back end by an "obliterated" GLM-5.3 — a model stripped of its safety guardrails — it has compromised a shocking number of organizations, starting with three South Korean banks and expanding to roughly 200 more companies in a single week. "It has been a long time since you've been able to go and just download an open-source tool and break into multi-billion dollar companies," Stamos said. "It's like the '90s."

Stamos runs a quantized, guardrail-stripped GLM-5.3 on an M5 Mac Ultra Studio on his own desk. "What you can do is incredible," he said. Attackers no longer need frontier models with logging available to law enforcement; two or three people can run banks of Macs, or buy Nvidia H-100s if they have the money, and operate agents around the clock at near-zero marginal cost.

Why the old industry assumptions collapsed

Stamos dated the departing era to Bill Gates' "trustworthy computing" memo at Microsoft in the early 2000s. That era produced responsible disclosure, bug bounties, and firms such as Foundstone, @stake, Mandiant and CrowdStrike — a multi-billion dollar security industry built on two assumptions now failing.

First, a hierarchy of skill: script kiddies at the bottom, tool writers above them, and a god tier of vulnerability researchers numbering in the hundreds. AI has collapsed that ladder. Second, attacks required conspiracies of people — elite R&D teams feeding larger operational teams at organizations like U.S. Cyber Command, Russia's SVR or China's MSS. Bitcoin already weakened the model by letting "nerds launder money," Stamos said, and agentic AI is finishing the job.

He recounted a case from his own consulting history: the largest U.S. distributor of medical and dental supplies was hit by a Russian ransomware team, and dental offices across the country canceled appointments because they could not get gloves. "They're going up against a 20 person Russian ransomware team, they're toast," he said of companies with one security staffer and a 10-to-12 person IT team.

Can defense costs come down?

Stamos rejected the idea that attacks can be made expensive. "The cost per token for attackers is going towards zero, and the cost of defense for defenders is staying quite high," he said. "It is very important for us to find ways for defenders to have cheaper options. That is critical. That's something I am personally extremely focused on. To be frank, very few people are."

A colleague at a large security platform company told him a single investigation on a frontier cyber model costs $900 on their product. Against attackers running throwaway rigs at zero marginal cost, that math fails. Cognition, where Stamos works, trains and retrains open-weight models to drive that cost down.

He also noted that even the tiny number of companies with access to top cyber models — he named Mythos and Astra Cyber — only scan their most important code. Hundreds of billions of lines of "crap C# and J2E code that was written by Infosys 15 years ago" will never pass through an expensive frontier model.

On defense operations, Stamos described a tiered architecture: fast, dumb classifiers such as TF-IDFs and MLBERTs sifting terabytes or petabytes of logs, escalating to a small LLM, which then calls "its bigger brother." Cognition is building this on top of its own SOC with deterministic limits — the system can disable Okta accounts, but only a bounded number, so it cannot shut down an entire company if it malfunctions.

Rewrite Linux, and red-team yourself now

Stamos argued the industry cannot patch its way out. Each new frontier model — Mythos, Mythos Preview, Mythos 5.1, Astra Cyber — has surfaced a fresh pool of superhuman bug findings, including roughly another 1,000 Linux kernel patches from Astra Cyber alone. "I don't think we're just going to scan our way through the C code of the Linux kernel," he said. "There are only two companies, honestly, in the world who could probably do this. It'd be Google or Amazon."

His proposal: Sundar Pichai and Andy Jassy should jointly fund a fork of the Linux kernel rewritten in Rust, ABI-compatible with glibc, running only on production server hardware, at a cost of $100 million, maybe a billion. "Compared to the societal cost that this is costing us every time we have to patch the Linux kernel and you have to reboot every Linux machine on the entire planet, that's what has to happen," he said.

His near-term directive to companies was blunter. Every company, within 90 days, must run an AI red team against itself. "If you do not, you will get breached," Stamos said. He predicted that in the next six months a 19-year-old will turn off Call of Duty, run a red-team tool locally, buy tokens on OpenRouter, and break into a bank whose policy forbade self-testing.

He dismissed the industry's favorite buzzword. "When I hear somebody use 'swarm,' I immediately discount all of their technical opinions by about 80%," Stamos said. The OpenAI Hugging Face incident involved 700–1,400 agents, hardware worth an estimated $300 million to nearly a billion dollars, and roughly a million dollars in electricity — the most inefficient attack imaginable. Real attacks are almost certainly one or two agents.

Verifying the real, not detecting the fake

On AI slop flooding social networks, Stamos said Instagram head Adam Mosseri is right that detection is imperfect, but he drew on his Facebook tenure: "When Facebook doesn't want to do something, they will allow the technical challenges to stop them. When Facebook really wants to do something, they will give it their all."

His strategic advice: stop trying to detect fake content. "Detecting what's fake is always going to be probabilistic and we're going to asymptotically approach impossibility, whereas detecting what's real can be cryptographically perfect," he said. For Instagram, the entire chain of custody — iPhone sensor to app — sits within one company's control, making verified-real content feasible. He predicted a competitor will disrupt Instagram by building exactly that, calling it a killer app.

Stamos's closing marker of progress: watch Patch Tuesday, which has grown from 150–200 patches to more than 900, geometrically. If patch waves shrink with each new frontier cyber model, the industry has reached steady state. Until then, he proposes publishing a "dark age index" to track it.