Microsoft warns AI is accelerating cyberattacks

Microsoft says the threat landscape has shifted from AI assisting human operators to AI directing attacks and moving toward autonomous execution.[2] The report describes attackers applying AI to vulnerability discovery, reconnaissance, phishing, malware and exploit development, data analysis, and post-compromise activity.[2] Microsoft also says attacks are increasingly automated at scale with limited operator intervention.[2] For security teams, the report frames AI not simply as a tool for producing messages or code, but as part of a broader attack process. That framing makes it important to assess how quickly existing detection and response processes can react.

The median time from vulnerability discovery in the wild to weaponization has fallen well below 24 hours, Microsoft reports.[2] By comparison, Microsoft says enterprise remediation of critical external vulnerabilities can take 30 to 60 days.[2] The report also says nearly 40,000 CVEs were published in the first half of 2026, putting the year on track for roughly twice that total.[2] In incident investigations covering July 2025 to June 2026, phishing was the entry point for 23% of intrusions, up from 7% a year earlier; exploitation of public-facing applications rose from 15% to 24%.[4] Microsoft says AI helps attackers personalize phishing at scale and overcome language and skill barriers.[4]

Microsoft says Anthropic’s Mythos and OpenAI’s GPT-5.5 demonstrated the potential to orchestrate complex attacks independently.[4] In a test against an emulated enterprise with no defenders, the models took control of the domain through a 32-step attack chain, according to Microsoft.[4] The report says open-weight models trail closed models in attack orchestration by seven months.[4] Microsoft also reports observing low-volume AI-orchestrated intrusions sharing elements with JADEPUFFER activity.[4] The test is a warning about capability, but its stated conditions matter: it used an emulated environment without defenders, rather than measuring performance against a defended enterprise.[4] Microsoft says identity and authorization, data protection, least privilege, monitoring, testing and secure software development remain relevant.[1]