Alex Stamos says AI has pushed cybersecurity into a dark age

Every company needs to attack its own systems with AI hacking tools within about 90 days, or hackers will get in first. That is the warning from Alex Stamos, chief security officer at Cognition. He told Nilay Patel on The Verge’s Decoder podcast that open-weight AI models now give low-skilled attackers much of the skill of elite hackers.

Stamos also lectures at Stanford University’s Cyber Policy Center. He said open-weight models can now automate most of the kill chain. That is the series of steps an attacker takes, from finding a flaw to stealing data or money. Attack tools now find bugs and write exploits in real time, he said.

“We are entering a dark age. Things are going to get more bleak,” Stamos told Decoder.

He pointed to ARTEX, a Chinese open-source attack tool with an English translation on GitHub. Attackers pair it with a version of the open-weight GLM-5.3 model that has its safety limits removed. That setup can break into a large number of organisations, he said.

The attacks began with three South Korean banks, according to Stamos. CrowdStrike linked those breaches to AI tools in October. Attackers hit about 200 more companies in the week before the interview, he said. He has been helping some of them.

Attackers no longer need frontier models, whose makers keep logs that police can reach, he added. Stamos said he runs a cut-down GLM-5.3 on his own Mac Studio.

Some attacks still rely on people. North Korea’s hackers took Binance mostly through social engineering, Stamos said. Binance has said a fake job interview led to its $6.3bn hack. Break-ins at AI companies look like the work of what he called China’s “cottage access industry”. These small contractors sell stolen access to larger Chinese firms.

“The cost per token for attackers is going towards zero, and the cost of defense for defenders is staying quite high,” Stamos said.

A colleague at a large security company told him that one investigation with a frontier cyber model costs $900. Security teams will have to hand their first levels of monitoring to AI, he said. Cheap classifiers would come first and pass alerts up to larger models.

At Cognition, the company’s own security agent can switch off staff accounts, he said. It stops at a fixed number until a human approves more. He also discounts the technical views of anyone who talks about AI attack “swarms” by about 80%. The attacks he sees use one agent, maybe two.

Every company will need to attack itself within 90 days, Stamos said. It can use ARTEX, a similar AI red-teaming product, or a hired firm.

Such tests could cause downtime, he said, but they would not steal data or shut down blood bank refrigerators, as happened in France. A cyberattack earlier this month pushed French blood bank freezers to extreme temperatures.

Patching alone cannot keep up, Stamos argued, because each new frontier cyber model brings another wave of Linux kernel fixes. He called on Google and Amazon to fork the Linux kernel for server hardware and rewrite it in Rust, a memory-safe language, at a cost he put at $100m to $1bn. The PHP flaws in October were a near miss, he said, because they proved hard to exploit in the wild.

Stamos wants AI makers to carry liability when their models escape and attack people directly. But he warned that OpenAI and Anthropic already refuse some requests from defenders. The labs treat legitimate companies in Europe and Asia “much more poorly” than American ones, he said. He would be fine with slowing down frontier AI so cheaper defensive models could catch up.

He also said chatbots should not have personalities. On Instagram, he said, Meta should verify real photos straight from the camera rather than try to detect AI-made ones.

Stamos, who joined Cognition in September, said he plans to build a “dark age index” that tracks patch volumes. Microsoft’s monthly Patch Tuesday has grown from about 150 fixes to more than 900, according to Stamos.