Big surprise! Cybercriminals are taking advantage of AI!

SCWorld.com reported that “The biggest change we have seen so far in 2026 was not a single new attack technique. It’s the way several trends have come together. AI now helps attackers move much faster than before, identities are becoming more important than malware, and legitimate tools and trusted platforms are increasingly becoming the attack path themselves. The October 9, 2026 article entitled “Cybersecurity predictions that came true in the first half of 2026” included these comments about “Cybercriminals gained a tactical advantage with AI”:

Our prediction that attackers would gain a tactical advantage from AI was confirmed and, in some areas, even exceeded.

We saw AI helping to reduce the time and effort required to turn vulnerabilities into working attacks. The Copy Fail Linux kernel vulnerability, for example, generated more than 140 public exploit variants within weeks. Many were based on AI-assisted modifications of the original proof of concept. At the same time, AI-assisted security research has been finding vulnerabilities at a scale that would have been very difficult to achieve manually. Project Glasswing, using Claude Mythos, reported more than 10,000 high- and critical-severity vulnerability findings during its early deployments.

But this was not the part of the prediction that surprised me the most.

AI infrastructure itself has become an attack surface. MCP servers, LLM gateways, and other components connecting AI agents to enterprise systems increasingly have access to credentials, data and business applications. One exposed MCP setup, used in AI-assisted intrusion activity, contained more than 1,000 operational files: firewall configurations, credential dumps, vulnerability scanning templates and attack planning data.

We should therefore stop thinking about AI only as a tool attackers might use. AI systems are becoming infrastructure that we need to secure.

Not a surprise at all!