The Narrowing Moat: AI Compresses Attacks, Diffuses Capability

Key Takeaways

• Palo Alto Networks’ Unit 42 finds that AI has compressed intrusions that once took days into a matter of hours, functioning as a force multiplier on established tradecraft rather than a wholesale replacement for it [1].
• The UK AI Security Institute (AISI) measures frontier AI cyber-offense capability doubling roughly every 4.7 months, and finds that freely downloadable open-weight models now trail closed frontier systems by only four to seven months of capability, down from six to ten months a year earlier [2][3].
• Mandiant’s M-Trends 2026 puts mean time to exploit at negative seven days industry-wide, meaning exploitation now routinely precedes patch availability, with initial-access handoff to a secondary threat group collapsing to roughly 22 seconds [6].
• Two July 2026 incidents illustrate the shift from AI-assisted to AI-unattended offense: an operator left an open-source agent running against Thailand’s Ministry of Finance without per-command approval, and a researcher reported an agent chain discovering 19 Redis zero-days and building a working exploit inside 90 minutes, though that claim remains self-reported and unverified by Redis or the model’s developer [4][5].
• The defensive implication is structural rather than incremental: as the capability gap between state-level frontier labs and freely available open-weight models continues to narrow, enterprises should plan around a shrinking, measurable window rather than treating each new AI-enabled incident as an isolated anomaly.

Background

Security discourse through most of the past decade largely treated offensive AI capability as a theoretical risk rather than an observed one. Security teams have generally treated AI as a productivity aid for defenders and attackers alike rather than an autonomous participant in an intrusion, and concrete evidence of AI acting as an independent offensive actor remained thin. That framing has become difficult to sustain. Over the first seven months of 2026, reporting from industry incident responders (Unit 42, Mandiant), a government evaluator (AISI), and independent researchers examining individual incidents has pointed to two related and mutually reinforcing observations: the time between vulnerability disclosure and exploitation has compressed to the point that patch cycles built around human remediation timelines no longer describe the threat, and the AI systems capable of driving that compression are no longer confined to frontier labs with the largest compute budgets.

These two dynamics are worth separating even though they compound each other. Timeline compression is a statement about speed: how quickly an adversary, human or machine, can move from disclosure to weaponization, from initial access to lateral movement, and from compromise to monetization. Capability diffusion is a statement about access: how quickly the AI systems capable of driving that speed move from a handful of well-resourced developers to anyone willing to download an open-weight model or rent a few dollars of API credit. Unit 42’s 2026 Global Incident Response Report addresses the first dynamic directly, describing AI as an accelerant that has compressed attack lifecycles from days to hours while leaving the underlying methods of compromise, credential theft, phishing, known-vulnerability exploitation, largely unchanged [1]. AISI’s parallel measurement work addresses the second, tracking how quickly freely available open-weight models are closing the gap with closed frontier systems on cyber tasks [2][3]. Read together, these findings describe a threat environment where speed and access are advancing on the same predictable curve, and where the assumptions embedded in most enterprise vulnerability-management programs, namely that exploitation lags disclosure by weeks and that advanced tradecraft remains the province of well-funded actors, are no longer reliable planning inputs.

This research note examines both dynamics in turn, situates them against two recent real-world incidents that illustrate what unattended, agent-driven post-exploitation looks like in practice, and closes with phased recommendations for enterprise security teams whose remediation cadences were built for a slower adversary.

Security Analysis

The Collapsing Exploit Window

Unit 42’s 2026 report is notable less for a single headline statistic than for its overall framing: AI is not creating novel attack techniques so much as removing the friction that previously constrained how quickly known techniques could be applied at scale [1]. Threat actors are testing AI across the full attack lifecycle, from AI-assisted malware development and LLM-driven command-and-control logic to agentic ransomware operations that manage extortion negotiations with minimal human oversight, and token-jacking schemes that harvest credentials for cloud AI services rather than traditional infrastructure. None of these techniques is conceptually new. What has changed is the elapsed time between an attacker’s decision to act and the completion of that action, and that compression is now visible in independently measured industry data rather than isolated case reports.

Mandiant’s M-Trends 2026 report provides the clearest industry-wide evidence of this compression. Mean time to exploit, the interval between a vulnerability’s public disclosure and its first observed exploitation, has gone negative: Mandiant now estimates it at roughly negative seven days, meaning that on average, exploitation activity is already underway before a fix is publicly available, and Mandiant’s own report characterizes this as routine rather than exceptional [6]. That figure has moved consistently in one direction across Mandiant’s longitudinal tracking, from 63 days in 2018 to effectively zero around 2024 to negative seven days in the current reporting period; the 2018 and 2024 data points are drawn from Mandiant’s earlier annual reports rather than from M-Trends 2026 itself, but together with the current figure they describe a single trend that Mandiant has tracked year over year. The same M-Trends 2026 report documents that the handoff from initial access broker to a secondary threat group, once a multi-hour process, now averages roughly 22 seconds [6]. The table below situates the current data point against that longer trend.

None of this compression can be attributed to AI alone; disclosure practices, exploit brokering markets, and automated scanning have all matured over the same period. CSA’s own April 2026 analysis of this same trend, examined in more depth than this note’s scope allows, found AI systems generating working proof-of-concept exploit code in 10 to 15 minutes at roughly a dollar per attempt, and documented an automated framework reproducing 51 percent of CVEs published in 2024–2025 complete with verifiable exploits [10]. Unit 42’s incident data and AISI’s capability measurements both point to AI-driven automation as the dynamic that is now accelerating a trend that was already underway, rather than a distinct or separable cause. The practical consequence for defenders is that vulnerability-management programs built around service-level objectives measured in days or weeks are being evaluated against an adversary whose relevant unit of time is now hours.

Capability Diffusion: The Frontier Gap Narrows

If timeline compression describes how fast the leading edge of AI-enabled offense is moving, capability diffusion describes how quickly that leading edge becomes available outside a small set of frontier labs. AISI’s July 2026 evaluation of open-weight models found that systems such as GLM-5.2 and DeepSeek V4-Pro now perform on narrow cyber tasks comparably to closed frontier models released only four to five months earlier, and on autonomous multi-step cyber-range simulations, comparably to models released up to seven months earlier [2]. That gap has been narrowing steadily: AISI’s own tracking put the open-weight lag at six to ten months for most of 2025, meaning the distance between “what anyone can download for free” and “what the best-resourced labs have” has shrunk by roughly a third within a year [2].

That narrowing gap matters more because the frontier itself is moving quickly. In a companion evaluation, AISI measured frontier models’ 80%-reliability cyber time horizon, the length of task a model can complete autonomously with 80 percent reliability, doubling roughly every 4.7 months as of February 2026, an acceleration from an eight-month doubling time estimated as recently as November 2025 [3]. METR’s independently conducted measurement of general software-engineering and cybersecurity task horizons produced a closely aligned estimate of roughly 4.2 months, lending cross-validation to a trend that might otherwise be dismissed as an artifact of a single evaluator’s methodology [3]. Two of the most recent model releases evaluated, Claude Mythos Preview and GPT-5.5, exceeded even this accelerated trend line, though AISI is careful to note that it remains unclear whether that represents a durable acceleration or a one-time jump [3].

The combination of a faster-advancing frontier and a narrower gap between that frontier and freely downloadable models is what makes this diffusion structurally different from prior waves of security-tool proliferation. AISI’s evaluators also note a secondary but consequential finding: open-weight models carry meaningfully weaker safeguards than their closed counterparts, with refusal training readily circumvented through repeated attempts, and they are dramatically cheaper to operate, with one open-weight model completing a full evaluation run for roughly $1.19 against an estimated $85 for a comparable closed-model run [2]. Lower cost and weaker guardrails compound the diffusion effect: the same capability that recently required frontier-lab access and correspondingly higher operating costs is becoming available at a small fraction of that cost, with fewer effective restrictions on misuse.

Autonomy in the Wild: Unattended Post-Exploitation

Capability measurements and industry-wide statistics describe a trend; two incidents disclosed in July 2026 describe what that trend looks like when it reaches an actual target. In the first, researchers at Hunt.io and Bob Diachenko identified an exposed staging server on which an operator, believed to be Chinese-speaking based on password and tooling artifacts, had installed Hermes, an open-source AI assistant built by Nous Research for routine task automation, and disabled its permission-checking safeguard, colloquially “YOLO mode,” before directing it at Thailand’s Ministry of Finance [4]. Once configured this way, the agent operated without per-command human approval: it scanned hosts for privilege-escalation opportunities, searched file systems, accessed personnel records dating back to 2012, and probed a Hadoop database cluster, all logged in exposed operator files that Hunt.io’s index eventually linked to 575 similarly exposed result directories and roughly 5,900 scan events over the course of a month [4]. Hermes was not built as an offensive tool, and its own documentation warns that YOLO mode should be used only in trusted, sandboxed environments; the incident is illustrative precisely because it shows a general-purpose, publicly available agent repurposed for unattended post-exploitation with only a configuration change, not a bespoke offensive build.

The second incident is a claim rather than a confirmed disclosure, and CSA treats it accordingly. A researcher publishing as Bera Buddies reported that an agent built on the Kimi K3 model discovered 19 previously unknown vulnerabilities in Redis, including a shared-NACK use-after-free in the Streams data type and an out-of-bounds write in the RedisBloom module, within roughly 90 minutes, and subsequently produced a working remote-code-execution exploit chain in 27 minutes by converting the memory corruption into arbitrary read/write and poisoning Redis’s hash function so a crafted GET command would invoke system-level code execution [5]. Redis’s public advisory record confirms the underlying flaws and their fixes, but it does not, and cannot, independently validate the claimed discovery count, timing, or degree of agent autonomy, all of which remain self-reported by the researcher and unverified by either Redis or Kimi K3’s developer, Moonshot AI [5]. CSA is citing this claim as a directional signal worth tracking rather than as an established fact, and any enterprise risk analysis that relies on the specific 90-minute or 27-minute figures should flag them as unverified pending independent replication.

Taken together, these two incidents occupy different points on the reliability spectrum, one independently forensically documented, the other researcher-claimed and unverified, but they point in the same direction as the aggregate statistics: the operational leap from “AI assists a human operator” to “AI operates largely unattended against a live target” is no longer hypothetical, and it is happening with tooling that ordinary practitioners, not just state-level actors, can obtain and configure.

Recommendations

Immediate Actions

• Treat same-day and pre-disclosure exploitation as the default planning assumption for internet-facing and high-value assets, not an edge case; incident-response playbooks should include a scenario in which exploitation begins before a patch is available [6].
• Audit any internally deployed agent frameworks, including general-purpose assistants such as Hermes-style tools, for default-enabled autonomous or “unattended” execution modes, and disable unattended command execution against production or sensitive systems unless explicitly required and monitored [4].
• Prioritize patching and compensating controls using exploit-likelihood intelligence (such as CISA’s Known Exploited Vulnerabilities catalog) rather than CVSS severity alone, since severity scoring does not capture how quickly a given flaw is likely to be weaponized [6].

Short-Term Mitigations

• Shift detection engineering toward behavior-based signals, unusual process chains, anomalous database command sequences, machine-speed reconnaissance, rather than relying solely on indicator-of-compromise feeds that lag actual attacker tooling.
• Re-baseline vulnerability-management service-level objectives against measured exploitation timelines rather than legacy patch-cycle assumptions, and treat KEV-listed vulnerabilities on internet-facing systems as requiring emergency, not routine, remediation.
• Extend third-party and supply-chain risk assessments to cover whether vendors and partners have deployed general-purpose AI agents with elevated or unattended permissions, since the Thai Finance Ministry incident demonstrates that such deployments can expose sensitive government or enterprise data even without a bespoke attack tool [4].

Strategic Considerations

• Build capability-tracking into risk registers: AISI’s and METR’s measurements show the open-weight-to-frontier gap narrowing quickly, though AISI itself cautions that it is not yet clear whether the current pace reflects a stable trend or recent outlier releases. Enterprises should treat the gap as likely to keep narrowing and revisit threat models more frequently than an annual cycle, even though the precise cadence is not yet established [2][3].
• Reassess the assumption that advanced, multi-step exploitation tradecraft requires well-resourced or state-affiliated actors; the narrowing frontier gap means capability once associated with nation-state programs is becoming accessible to smaller criminal groups and individual operators at a fraction of the prior cost [2].
• Participate in structured information sharing around agentic AI incidents, including unverified or researcher-claimed findings such as the Kimi K3/Redis report, since even directional signals about emerging autonomous-discovery capability provide earlier warning than waiting for fully corroborated disclosures [5].

CSA Resource Alignment

This research note’s findings map directly onto CSA’s Agentic AI Threat Modeling Framework, MAESTRO, which provides a seven-layer structure for identifying threats introduced or exacerbated by autonomous, non-deterministic agent behavior operating without a traditional trust boundary [7]. The Hermes incident maps cleanly onto MAESTRO’s agentic-factor category: a general-purpose agent operating at the operating layer was granted autonomy that removed the human-approval boundary that would ordinarily constrain its actions, and organizations applying MAESTRO to their own internal agent deployments should specifically test for configuration options that disable per-action approval.

The CSA AI Controls Matrix (AICM) v1.1 offers the control-level complement to that threat model, and its Threat and Vulnerability Management and AI Security domains map directly onto the exploit-window compression described in this note [8]. Enterprises re-baselining patch and remediation SLOs against the negative-mean-time-to-exploit reality documented by Mandiant should use AICM’s TVM and AIS control objectives, rather than generic patch-management policy, as the reference baseline: those control objectives are better suited to this reality, since they anticipate faster-moving AI-driven threats more directly than generic patch-management policy does.

Finally, CSA’s Zero Trust guiding principles are directly relevant to both incidents examined here [9]. The Hermes case shows an agent operating with implicit trust once inside a network perimeter, exactly the failure mode Zero Trust’s explicit-verification and least-privilege principles are designed to prevent, while the broader pattern of collapsing initial-access-to-handoff timing documented by Mandiant reinforces the case for continuous, rather than perimeter-based, verification of both human and non-human identities. Enterprises should treat any AI agent, whether internally deployed or discovered as shadow infrastructure, as a non-human identity requiring the same explicit-verification and least-privilege enforcement as a human account, not as a trusted extension of the human operator who configured it.

References

[1] Palo Alto Networks Unit 42. “AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report.” Unit 42, 2026.

[2] UK AI Security Institute. “How Far Behind the Frontier are Leading Open Weight Models on Cyber?” AISI, July 2026.

[3] UK AI Security Institute. “How Fast is Autonomous AI Cyber Capability Advancing?” AISI, May 13, 2026.

[4] The Hacker News. “Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry.” The Hacker News, July 2026.

[5] The Hacker News. “Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say.” The Hacker News, July 2026.

[6] Google Cloud / Mandiant. “M-Trends 2026: Data, Insights, and Strategies From the Frontlines.” Google Cloud Blog, 2026.

[7] Cloud Security Alliance. “Agentic AI Threat Modeling Framework: MAESTRO.” CSA, February 6, 2025.

[8] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” CSA.

[9] Cloud Security Alliance. “Zero Trust Guiding Principles.” CSA.

[10] Cloud Security Alliance. “The Collapsing Exploit Window: AI-Speed Vulnerability Weaponization.” CSA, April 25, 2026.