What attackers now hold: when AI runs the attack itself

This is part 2 of the series "Protect Your Own Service Yourself — Self-Defense Security in the Age of AI." Do the checks you can yourself; when it's hard, EarthLink Network can run the assessment for you, and fix the gaps you can't fix on your own.

Series contents

1. Anyone can attack now, with AI — check your own site first
2. What attackers now hold: when AI runs the attack itself (this article)
3. Before you start: the whole picture of checking, and how to test without breaking production (coming soon)
4. Testing from the outside (1): setup and the first run (coming soon)
5. Testing from the outside (2): attack tools and legitimate scanners find different things (coming soon)
6. Checking the code you wrote: static analysis (coming soon)
7. Checking the parts you depend on: libraries and packages (coming soon)
8. Checking your infrastructure settings for gaps (coming soon)
9. Collect every result in one place and decide what to fix first (coming soon)
10. How to fix what you found: three ways (coming soon)
11. When you cannot fix it yourself: a maintenance contract (coming soon)
12. Keep checking automatically every day — from building to protecting (coming soon)

The short version

Attackers now let an AI run the attack. A person writes one line, "check this site," and the AI decides what to probe, what to try, and what to do next based on what comes back. This is not a forecast. In November 2025, a company reported an intrusion campaign where the AI carried out 80 to 90 percent of the work itself, and a campaign where AI did almost everything is now on the public record.

This post explains, using only published reports, what these tools actually do, what has actually happened, and how widespread they are. It does not explain how to get them or how to run an attack. Once you know the adversary you are up against, the point is simple: use the same kind of AI on your own service first, before someone else does. And there is good news too: you do not need an expensive, perfect defense. Many of these attacks are automated and try every target they can find, so a service with ordinary, sensible protection is far less likely to be hit by them, and that level of protection is within reach of free tools.

Part 1 said attackers already have the tools. This post is about what those tools are.

A campaign where AI did almost all of it

Start with the strongest fact, because it is the one that changes how you plan.

On November 13, 2025, the AI company Anthropic reported that its own AI had been misused. A threat group used Anthropic's AI to attempt intrusions at about 30 organizations around the world, succeeding at a few. Anthropic assesses with high confidence that the actor was backed by the Chinese state.

The part that matters is how it ran. According to Anthropic, the AI carried out 80 to 90 percent of the work itself, and humans stepped in at only about 4 to 6 key decision points per campaign. The rest, the AI did on its own, at a request rate that Anthropic described as physically impossible for a human to sustain.

The AI was not flawless. Anthropic notes that it sometimes fabricated credentials that did not exist, or claimed it had extracted secret data when it had only found public information. You cannot yet hand it the whole job. But compared with an era when a human did every step by hand, the scale one attacker can reach is now orders of magnitude larger. Anthropic's own conclusion is that the barrier to sophisticated attacks has dropped substantially, so even groups with little experience or funding may now be able to attack at scale.

And this was not one company's one incident. In its September 2026 threat report, Anthropic wrote that AI's role in cyber operations had shifted "from assistant to orchestrator," with intrusions completing in 2 to 3 hours and a single operator handling dozens of victims in parallel. In September 2026, Google's threat intelligence group reported that one financially motivated actor planned, built, and ran a large credential-harvesting campaign in under six hours, using an AI coding chatbot and a single prompt plus agent instructions.

What it means for an AI to run the attack

So how does one of these tools actually work? The clearest public teardown is Villager, a tool from a Chinese company, analyzed by the security firm Straiker on September 11, 2025. Their report is the basis for what follows.

The biggest change is that the human's job shrinks to issuing one instruction. Older attacks had a person thinking through each move. This tool takes a goal, splits it into subtasks on its own, and tracks their order and dependencies. A model called DeepSeek acts as the brain.

For each subtask, it chooses what to try. Villager ships with 4,201 written prompts for directing the AI, and it picks the ones that fit the target. Then it runs real tools, again choosing based on the target: if the site runs on WordPress, it reaches for a WordPress scanner; if it finds an API, it switches to driving a browser. Finally, the AI reads what came back, decides the next move, and loops. It keeps that loop going without a human steering each step.

One more property matters for defenders. The working environment this tool uses deletes itself after 24 hours, taking its activity logs with it, and it randomizes its connection ports each time. So even if the target notices and tries to investigate, the evidence is hard to recover.

Villager was uploaded to a package registry anyone can download from, free, and was pulled down about 10,000 times in roughly two months after release. Straiker frames it as a tool that, though built for legitimate penetration testing, could follow the same path as Cobalt Strike, a legitimate tool that became a favorite among attackers.

Half a day from disclosure to attack plans

Here is the fact that changes your clock. On September 2, 2025, the security firm Check Point published what it observed around a tool called HexStrike AI.

This tool, too, directs more than 150 security tools through an AI, and it was built for defenders to test their own systems. But Check Point observed attackers, within 12 hours of a vulnerability being disclosed in a product (Citrix NetScaler), already discussing using this tool against it in underground channels.

In Check Point's words, preparation that used to take a human days or weeks can be started in under ten minutes with this tool, and parallelized across thousands of targets at once. BleepingComputer (September 3, 2025) likewise reported that the time from a flaw being disclosed to it being exploited could shrink from days to minutes.

What changes for defenders: there used to be a grace period between a flaw being disclosed and your having to fix it. "I'll patch it over the weekend" worked. When the adversary moves within half a day, that grace period is gone. You now have to check, the same day a flaw is announced, whether your own service has it too.

Confirmed in Japan too, and backed by public agencies

This may sound like an overseas problem, but the same thing has been confirmed in Japan. JPCERT/CC, Japan's national coordination body for security incidents, reported on October 15, 2026 that, while investigating a run of unauthorized-access cases in the country, it confirmed attackers were using AI to scan for known vulnerabilities and attack through APIs. The attack infrastructure spanned several servers and was hitting services outside Japan as well.

The broader public assessment points the same way. In the United States, Verizon's 2026 Data Breach Investigations Report (May 2026) found that exploitation of vulnerabilities overtook stolen credentials as the top way attackers break in, and said the defender's window had shrunk "from months to hours" as attackers use AI to speed up exploitation. Google's threat intelligence group reported in September 2026 that 141 vulnerabilities had already been exploited in the first eight months of 2026, against 127 in all of 2025. This is not one country's or one big company's problem. A small service in Japan, or anywhere, is on the same list, probed by the same adversary in the same way.

How widespread is this

The ones named so far are the prominent examples. How common are tools of this "let an AI direct everything" kind? On GitHub, the "AI penetration testing" topic listed 52 public repositories as of October 18, 2026, and the top ones carry tens of thousands of stars. When one draws attention, dozens of similar ones appear. That is the reality of software given away for free.

An important distinction: most of these are, by design, defenders' tools, meant to find the gaps in your own app. Strix, one of the top ones, states plainly in its description that it should be used only on targets you own or have written permission to test, and that unauthorized testing is illegal in many jurisdictions. The problem is that the same tool can be turned toward attack depending on the user's intent. That is exactly why, from part 4, this series uses both legitimate tools and the same kind of tools attackers use, only against a copy of our own service, and compares what each one finds. A defender's tool is used to defend. An attacker's tool is used only to see, on our own copy, what it could do to us. That is the proper use.

Plan for this adversary

This ran long, so here are the three things to assume as a defender. These three are the starting point when you check your own service from part 3 onward.

1. It probes services that do not stand out, too. Being targeted has nothing to do with fame or size. Public and happens to have a gap is enough. "We're too small to bother with" does not hold.
2. It targets a flaw within half a day of its disclosure. The grace period to fix is gone. On the day a flaw goes public, you need to have checked whether your own service has it.
3. It changes tactics based on what it sees. If one entrance does not open, it finds another on its own. Hardening one spot is not enough; you have to count up every entrance and check them.

You don't need a perfect defense: many of these attacks are automated and indiscriminate

After all that, you might be wondering: against an adversary that targets a flaw within half a day and changes tactics on its own, are free tools really enough? Don't you have to buy every protection there is?

Think about the locks on a house. A plain deadbolt, a keypad, a fingerprint reader, a smart lock that pings your phone, an alarm system on top. You can stack them so a door only opens with a fingerprint and a code. Protection can be made as strong as you are willing to pay for.

Many people assume they need all of it, the keypad and the fingerprint reader and the alarm. Not quite. If someone has picked you out by name, that is a different story. But that is not what changed. What AI changed is that attacking became cheap, easy, and endlessly repeatable on autopilot.

Picture someone walking down a street at night, trying every front door. Now hand that job to a machine. For the machine, spending an hour forcing one lock is a waste. Trying a handle, moving on in seconds if it is locked, and covering hundreds of doors in a short time until one simply opens is far more efficient.

So the difference that matters most is locked versus unlocked. The lock does not have to be shiny and new. An ordinary locked door is enough for the machine to give up in seconds and move to the next house. The house that did nothing and the house with ordinary protection end up in very different places. You do not need perfection: being reasonably well protected makes you a much less likely target for these indiscriminate attacks.

What free tools can check, and what paying adds

So what does paying actually change?

It changes how deep the checks go, how much runs automatically, and how much effort it takes. Paid services dig deeper and save you work. But whether the door locks at all is something free tools can check. Find the ordinary weaknesses with free tools, fix them, and you are the locked house in the story above.

The tools this series uses from part 4 onward are mostly free. Part 3 lays out the kinds of checks there are and what each one offers for free. You do not need a paid product to be protected. Start with free tools and do a reasonable job; that is the step that pays off most.

One caveat. "Free is enough" assumes you keep up with routine upkeep. In October 2026, serious flaws and data breaches were disclosed one after another around the world. What you do when a sudden, critical flaw lands is a separate question, an operational one, and the series comes back to it later. The point here is narrower: with routine upkeep in place, most of your defense is within reach of free tools.

Starting in part 3, the series works through what you should actually do, step by step.

Defenders have the same AI too

By now it may feel as if only attackers got stronger. But the same AI is on the defenders' side, and the results there are already in the numbers.

An AI beat human hackers to the top of a vulnerability-reporting leaderboard (XBOW, June 2025). Google's AI found a flaw that only attackers had known about and got it fixed first (July 2025). Anthropic's AI found and verified more than 500 high-severity vulnerabilities in open-source code, some that had gone unseen for years (February 2026). If defenders use the same AI, they can get ahead of attackers and find their own gaps first. This is not hypothetical; it is already happening.

If attackers can try with one click, defenders can try with the same one click. Instead of learning about a gap after you are breached, use the same tool on your own service first, find the weak spots, and fix them. That is the spine of this series.

Next

Part 3, "Before you start: the whole picture of checking, and how to test without breaking production," comes before any hands-on work. It lays out the whole picture of checking: besides attacking from the outside, what other kinds of checks there are, and where to draw the line so the checks do not break the live service. The hands-on work starts in part 4. To say it again: we use these tools only against our own service.

In this series, in an age when attack tools are free and one click away for anyone, I show step by step how to check your own service yourself and close the gaps before someone else finds them. The target is always our own service; the series does not cover attacking anyone else's site.
If running the checks yourself is hard, EarthLink Network can do the assessment for you. Found a gap you can't fix? We'll handle the fix. Feel free to reach out.
If this was useful, please like and follow.

Our products are listed at https://www.eln.ne.jp/products

EarthLink Network builds its own products to run the whole company on AI — each one born from a need along the way. See the full index of what we build:

→ The 18 products EarthLink Network builds in-house

For more about the company and each product, visit www.eln.ne.jp.