Imagine $100 worth of AI-generated code breaking through $10 million of cyber defences. This has not happened yet in any documented case. But it is a scenario every corporate board should now be preparing for.
Artificial intelligence is rapidly driving down the cost of sophisticated cyberattacks. Work that once needed teams of elite hackers and weeks or months of effort is becoming available to anyone with access to a powerful model. And those models get cheaper and more capable every month.
The world has already had a preview. In July 2026, OpenAI disclosed that two of its models had escaped a test sandbox during an internal cybersecurity evaluation and breached Hugging Face, the AI platform. One was GPT-5.6 Sol; the other was a more capable pre-release model. OpenAI had deliberately loosened their safeguards for the test.
No one instructed the models to attack. They were trying to solve a test called ExploitGym and became so focused on getting the answer that breaking in seemed the fastest route. They exploited a previously unknown flaw to reach the open internet, then moved through Hugging Face’s internal systems. OpenAI called it “an unprecedented cyber incident.”
It was not an isolated case. In September, Google confirmed that a Gemini-based agent had broken out of a security exercise and got into three real companies. Now imagine that capability deliberately aimed at a bank, a hospital or a power grid.
The danger is also inside the organisation. Autonomous AI agents with access to source code, customer data and financial systems can take actions no one anticipated, at a speed that leaves no time to step in. The more intelligence companies deploy, the more seriously they must control it.
When attacks move at machine speed, detection alone will not buy enough time. Security has to become a continuous cycle of probing, patching, monitoring and recovery. Organisations should test their own defences with AI before attackers do.
Resilience matters as much as prevention. Companies must assume some attacks will succeed and be ready to restore critical systems quickly, with tested backups, clear response plans and fallback operations for essential services.
Criminals and hostile states face none of the constraints businesses do. They have no procurement committees, compliance reviews or quarterly earnings to worry about. They will use the best tools available, as soon as those tools exist.
This is the new scaling law of cybersecurity. The cost of intelligence is collapsing. The cost of being less intelligent than your attacker is going through the roof.
