Is AI making cyber attacks worse?

The institutions that watch this for a living now say yes, and in September 2026 they said it close together. Three of the four warnings below landed inside three weeks, from bodies with no shared agenda.

And in September 2026 one source went past warning, to documented cases. Anthropic's September 2026 threat intelligence report documents operations it disrupted, under its own heading that sophisticated attacks no longer require sophisticated attackers. Its conclusion is the useful part for anyone defending a small surface: none of the operations depended on a technique defenders had never seen. The ways in were the familiar ones - stolen credentials, unpatched gateways, exposed services, SQL injection, phishing - and what changed was the economics. One case went from a single stolen developer login to full administrative control of a company's cloud in about three hours. Another group ran a loop that reads a security product's code, guesses where the weakness is, writes an attack to test the guess and repeats, and produced more than a dozen candidate flaws in a month.

• Google Threat Intelligence Group, 9 September 2026, on adversarial AI moving from prompting to autonomy: the GTIG post.
• A joint advisory from five US agencies - NSA, CISA, FBI, the Department of Energy and the EPA - 19 August 2026: advisory AA26-231A.
• Andrew Bailey, chair of the Financial Stability Board and Governor of the Bank of England, in a letter to G20 finance ministers, 28 August 2026 - frontier AI is showing increasingly sophisticated autonomy and threat capability, and may materially alter the speed, scale and economics of cyber risk: the letter.
• A researcher leaving frontier AI work made the same argument publicly on 9 September 2026, and was not contradicted from inside - an alignment lead at one of the labs said the same day that there is no plan yet for aligning superintelligence.

What actually changed, in one line: the concern is no longer AI helping an attacker write something. It is AI running the operation - finding the surface, adapting when refused, and continuing without a person in the loop. That is a change in the ECONOMICS of attacking you, which is why a financial-stability body is writing about it at all: cheap and tireless is a different threat model from skilled and scarce.

What it looks like from a small public surface, which is the part rarely written down. Running 40+ tools live on the internet with no auth, the visible change over nine months has been in all four of frequency, scope, volume and sophistication, on every surface at once. Watching a dashboard stopped being fast enough some time ago; the posture that replaced it is continuous automated monitoring with a graded response, and more time spent on drills than on new features.

What follows for you, if you are building: assume any public endpoint is being probed continuously by something that does not get bored, treat a refusal as an event worth recording rather than a thing that quietly worked, and rehearse the response before you need it. The concrete controls are a separate question: the security checklist is the list we actually work from, and securing a database exposed to an AI agent is the case that comes up most.

Later in September 2026 the capability reached a free download. Anthropic found that the open-weight GLM-5.3 builds working exploits at close to the rate of Claude Mythos Preview: can a freely downloadable AI model build cyber exploits?

Related, on the financial side of the same story: what central banks are warning about AI valuations. Full write-up with all four sources: https://www.tigzig.com/post/four-warnings-ai-cyber-risk-sep2026.