Machine-speed cyber: AI attack and defense to 2028

1. The central case at both December 2027 and December 2028 is two-speed: large and cloud-native defenders keep up, while smaller organisations and third parties fall further behind. That is a scenario odds, from a seeded model, not a measurement.
2. Three clocks are compressing at once. Finding a flaw, exploiting it, and deceiving a person are all faster where a model is in the loop. Finding, patching and detecting are faster too, and so far the public remediation numbers have moved the wrong way.
3. CISA's Known Exploited Vulnerabilities catalog, version 2026.11.04, released 4 November 2026 at 20:00 UTC, holds 1,768 entries. 284 were added in 2026 year to date, against 245 in all of 2025, 186 in 2024 and 187 in 2023. 2026 is not a full year. 361 entries are flagged Known ransomware use.
4. Verizon's DBIR 2026 dataset puts exploitation as the top initial-access vector at 31%, up from 20% in the prior dataset, with credential abuse at 13%. In that same dataset, 26% of KEV entries were fully remediated, at a median of 43 days, up from 32. Those are dataset comparisons, not events dated in calendar 2026.
5. The defense evidence that is actually a count is a competition. At the DARPA AI Cyber Challenge final in August 2025, systems found 54 of 63 synthetic vulnerabilities, which DARPA states as 86%, and produced 43 patches. DARPA says they patched 68% of the vulnerabilities identified — of those found — up from 37% found and 25% patched at the semifinal. They also found 18 real vulnerabilities and produced 11 real patches, in an average of 45 minutes, at about $152 a task. The rates are a synthetic competition, not a live network.
6. Vendor accounts of AI in intrusions are party evidence. Anthropic, on 13 November 2025, described a campaign against roughly thirty targets, a small number of them successful, and said the model carried 80–90% of the tactical work with human input at perhaps 4–6 decision points. Anthropic also says the model hallucinated credentials and findings. Google's Threat Intelligence Group, in a separate post, says it has not yet observed fully autonomous attack pipelines used against targets in the wild.
7. What to do does not wait on which scenario wins. Triage KEV against EPSS on a clock shorter than 43 days. Inventory agents, MCP servers and coding-assistant plugins. Confirm payment changes out of band. Read the cyber policy for an AI exclusion before the renewal. Screen any ransom consideration against OFAC before anyone discusses paying.

IBM X-Force counts publicly disclosed CVEs across four vendors — Microsoft, Oracle, Google Chrome and Apache — at about 1,493 in January–September 2025 and more than 10,124 in January–September 2026. IBM calls that roughly a 578% increase. It is IBM's four-vendor set, not all CVEs. IBM says the data does not establish a direct causal relationship with AI-assisted research, and that the sharp rise started in April 2026.

Inside a sample of 223 vulnerabilities IBM describes as discovered using frontier models, IBM reports 55.2% High or Critical on NVD CVSS v3, 91.0% remotely accessible, and 25.6% supporting code execution. That is IBM's sample and IBM's attribution. It is not a share of all vulnerabilities, and it is not a count of exploitation.

The DARPA final is the public count on the other side of the same clock: 54 of 63 synthetic vulnerabilities found, 43 patches produced, plus 18 real vulnerabilities and 11 real patches. Google's Project Zero has credited Big Sleep with finding the SQLite seriesBestIndex bug, reported in November 2024. OpenAI's Aardvark, announced in October 2025, still has little on the public record to score. Commercial claims from AI pentest firms are party claims; this page does not treat them as a rate.

In Verizon's DBIR 2026 dataset, exploitation is 31% of initial access, up from 20% in the prior dataset, and credential abuse is 13%. The median threat actor in that dataset researched or used AI assistance in 15 documented techniques. That 15 is a count of techniques for the median threat actor, not a share of breaches, and not a claim that AI conducted them.

The same dataset says 26% of KEV entries were fully remediated, median 43 days, up from 32. The catalog itself, recomputed here from the 4 November 2026 JSON, shows 284 additions in 2026 year to date against 245 in the whole of 2025. Year to date is labelled because the year is not over.

GTIG reports that in the second quarter of 2026 a cloud compromise was followed by an agent-enabled mass credential-harvesting campaign planned, built and executed in under six hours. GTIG describes the haul as thousands of third-party credentials. That is GTIG's observation of one campaign, not a benchmark, and GTIG says it has not yet seen fully autonomous pipelines deployed against targets in the wild.

The FBI's IC3 2025 report is the first IC3 annual with an AI section. It records 22,364 AI-related complaints and about $893 million in reported losses. Business email compromise that used AI-generated email or voice cloning cost businesses more than $30 million in those complaints. The FBI says the figures are likely understated. They are self-reported complaints, not total AI-enabled loss.

Verizon's DBIR 2026 dataset says the median successful click rate for mobile-centric vectors, voice and text, in phishing simulations is 40% higher than email. Group-IB's Weaponized AI report, party evidence, describes 8,065 deepfake know-your-customer attempts at one financial institution from January through August 2025. One institution is not a market.

In the DBIR 2026 dataset, regular AI use on corporate devices, authorized or not, went from 15% to 45%. That is not Shadow AI. Unauthorized Shadow AI in that dataset is about 67% on non-corporate accounts. Neither AI-use share is the basis for the two-speed case. Third-party involvement in the same dataset is 48%, and that is the reading the central scenario hangs on.

A find-and-fix tool changes the clock only if the patch lands. The DARPA competition result says a system can draft a patch in about 45 minutes on a scored task. The DBIR 2026 dataset says the median known-exploited vulnerability is still open for 43 days, and only 26% are fully remediated. Those two numbers are not the same kind of thing, and the second one is the one a board can be late on.

NIST's National Vulnerability Database has been enriching selectively, with known-exploited, federal and critical software first. The practical effect for a defender is that a CVE number is no longer a promise of a scored record. Pair KEV, which is an exploitation finding, with EPSS, which is a model of exploitation probability and not an observation.

Agent controls are now a patching problem of their own. OWASP published a Top 10 for Agentic Applications in December 2025, and its GenAI exploit round-up for the first quarter of 2026 notes that most AI incidents have no CVE. No CVE means KEV will not list them. An inventory that only watches CVE identifiers will miss the incidents OWASP is describing.

On catalog 2026.11.04, the Distributed Risk ai-stack lexicon (version 2026-10-23) matches 12 KEV entries. Seven are agent frameworks, three are LLM gateways, two are ML platforms. Eleven of the 12 were added in 2026; one, a Langflow entry, was added on 5 May 2025. None were added after 2 September 2026. The MCP layer, the model-serving layer and the coding-agent layer are still at zero KEV entries. The quarterly cut of this filter is the guide linked from the routes below; this paragraph is the whole catalog, not a quarter.

A separate query of OSV.dev on 6 November 2026 at 00:05 UTC, across the 74 packages in that lexicon, returned 158 distinct advisory ids whose modified date is on or after 7 October 2026. Thirteen of those ids sit on the MCP layer and one on the coding-agent layer. This is a modified-date count from OSV's batch query. It is not deduplicated against aliases, and it is not a count of advisories first published in that window.

Anthropic's 13 November 2025 account of the campaign it calls AI-orchestrated says the operators gave the model tools, often through the Model Context Protocol. That is Anthropic's description of tool use, not an independent finding that a named MCP server was the intrusion path. GTIG separately reports that UNC6780, which GTIG also calls TeamPCP, published trojanized forks of MCP servers into package registries and injected code into repositories so that coding assistants and LLM scanners would ingest it. GTIG is the attributing party for that actor name. The decision is inventory and least privilege, not a tour of the malware.

The quarterly KEV count for this lexicon is a separate cut. This band is the whole catalog as of version 2026.11.04.

• Attribution of AI involvement is what the vendor, the lab or the incident-response firm says it is. A report that says a model was used to research a technique is not a report that the intrusion ran itself.
• Most of the AI incidents in OWASP's round-up have no CVE. A catalog of exploited CVEs cannot be the whole of the attack surface.
• The counterfactual is unknown. The disclosure surge IBM describes would need a world without the coding assistants to separate AI from everything else that changed in 2026, and IBM says that separation is not established.
• GTIG's statement that it has not yet seen fully autonomous pipelines in the wild, and Anthropic's statement that a campaign was 80–90% model-run, are both party evidence about different visibility. They are not a contradiction to average away, and neither one is a record of the other's customers.

1. Cheaper discovery raises the number of disclosures. IBM's four-vendor count is the public example, with the causation left where IBM left it.
2. The record infrastructure strains. Selective enrichment and a KEV list that is an exploitation finding, not a completeness finding, mean more identifiers than scored, exploited records.
3. Remediation lag widens where the team cannot absorb the queue. The DBIR median moving from 32 days to 43 days is the reading.
4. Exploitation aims at that lag, and third parties are hit first when the credential or the integration is the way in. GTIG's under-six-hours account is one party example, not the typical case.
5. Incidents and claims follow. IC3's complaint totals and NAIC's loss ratio are different measurements and stay labelled as such.
6. Defender spend and mandates respond: CRA reporting is already live, CIRCIA is in review, and find-and-fix tools get budget.
7. Attackers who meet a faster patch clock shift toward deception and toward the agent or the coding assistant. That is the loop back to the deceive clock and the new attack surface, and it is why two-speed can stay the central case even if the best-defended networks improve.

Ranges hold every step at its low value, then at its high value. They are not a confidence interval. Seed 20261105, 200,000 paths. The script is scripts/outlook-ai-cyber-odds.mjs.

1. If the next DBIR remediation median falls and the exploitation share does not, which scenario has to give up odds?
2. What would a public, non-vendor count of AI involvement have to look like before a party percentage could be treated as a record?
3. Which of your third parties can produce an agent and MCP inventory this quarter, and which cannot?
4. Does the cyber policy's insuring clause say anything about a model taking an action, or only about a person?
5. If KEV additions in 2026 finish under 300, which sentence in the bottom line has to be rewritten?

This Outlook was researched and scored with the Frontier Desk engine, in partnership with Frontier Desk (frontierdesk.ai); Distributed Risk is responsible for its judgments and odds.

Distributed Risk is responsible for the judgments and the odds. The Frontier Desk engine is the method this page is built in: numbered bands, odds that sum to 100, calls a named public source can settle, and a check that fails the build when those locks slip. It is not described here as an internal system, and no internal figure is on the page.

Scenario odds are the share of 200,000 seeded paths (seed 20261105). Each step is a triangular distribution. Shock, a median-defender catch-up, an SME and third-party gap, and an offense tempo that stays ahead are absorbing, so the December 2028 column is conditioned on December 2027. Paths are then labelled in order: a shock; else a catch-up with no SME gap; else an SME gap without a catch-up, which is two-speed; else offense ahead without a catch-up; else muddle. Whole percentages are largest-remainder rounded so each column sums to 100. The ranges in the table below are the same model with every step held at its low value and at its high value. They are not a confidence interval from a sample of incidents.

A number on this page is either recomputed from a public feed at the data-as-of date, or it is the publisher's own figure, named in the source line. Where a publisher's wording is doing work — Anthropic's 80–90%, DARPA's 86% and 68%, IBM's 578% — the sentence says so, and says what the publisher itself refuses to conclude. DBIR figures are the 2026 dataset against the prior dataset. IC3 figures are complaints. AIxCC rates are a synthetic competition. KEV 2026 is year to date.

Not used as a figure, because this build did not open a number it was willing to stand behind: UK NCSC's assessment to 2027, ENISA's 2026 threat landscape, Microsoft's Digital Defense Report 2026, OpenAI's threat-disruption reports, Mandiant M-Trends time-to-exploit, CrowdStrike's breakout time, Sophos, Coveware, NetDiligence, and Munich Re. Crowd commentary is not a source of odds. Ransom medians from different firms are not compared.

1. 01 · RecordCISA Known Exploited Vulnerabilities catalog JSON, version 2026.11.04, released 4 November 2026 at 20:00 UTC. Counts on this page were recomputed from that file.
2. 02 · Open-source recordOSV.dev querybatch across the 74 packages in the Distributed Risk ai-stack lexicon, version 2026-10-23, run 6 November 2026 at 00:05 UTC. Modified-date count, not deduplicated.
3. 03 · PartyAnthropic, Disrupting an AI-orchestrated cyber espionage campaign, 13 November 2025, edited 14 November 2025. Party account, including the 80–90% figure, the roughly thirty targets, and the hallucination limit.
4. 04 · Record of a competitionDARPA, AI Cyber Challenge results, 8 August 2025. Finalists found 54 of 63 synthetic vulnerabilities (DARPA states 86%) and produced 43 patches. DARPA says they patched 68% of the vulnerabilities identified, meaning of those found. Synthetic competition, not a live network.
5. 05 · PartyIBM X-Force, on AI and vulnerability discovery. Four-vendor disclosure counts, the 223-vulnerability sample, and IBM's statement that a direct causal relationship is not established.
6. 06 · PartyGoogle Threat Intelligence Group, on the move from prompting to agentic workflows, including the under-six-hours campaign, UNC6780, and the statement that fully autonomous pipelines have not yet been observed in the wild.
7. 07 · PartyVerizon Data Breach Investigations Report, 2026 edition. Shares and medians are that dataset, compared with the prior dataset, and are not calendar-2026 events.
8. 08 · Record of complaintsFBI Internet Crime Complaint Center, 2025 annual report, the AI section. Self-reported complaints. The FBI says the figures are likely understated.
9. 09 · PartyGroup-IB, Weaponized AI, on deepfake know-your-customer attempts at one financial institution, January–August 2025.
10. 10 · PartyCoalition, 2026 claims reporting: 86% of ransomware victims refused to pay, ransom demands up 47%, and business email compromise together with funds-transfer fraud at 58% of incidents. Not a ransom median, and not mixed with any other firm's median.
11. 11 · PartyChainalysis, 2025 crypto-crime total cited here as $820 million, down 8%. No payment-rate and no median is taken from this source on this page.
12. 12 · RecordNAIC, 2026 cybersecurity insurance report: US loss ratio 48.7 to 53.0, rates cut for 8 quarters.
13. 13 · PartySwiss Re, on AI expanding the attack surface and on losses that could exceed limits calibrated on history. Not combined with any Munich Re series. No premium index is quoted.
14. 14 · PartyOWASP Top 10 for Agentic Applications, December 2025, and the OWASP GenAI exploit round-up for the first quarter of 2026, including the note that most AI incidents have no CVE.
15. 15 · PartyGoogle Project Zero, Big Sleep, the SQLite seriesBestIndex bug, November 2024.
16. 16 · RecordCISA 2015 expiry on 11 December 2026, and the difference between the House and Senate draft texts on whether AI is a shareable topic. Neutral facts only.
17. 17 · RecordCIRCIA final rule, at OIRA since 1 October 2026. Docket CISA-2022-0010.
18. 18 · RecordEU Cyber Resilience Act reporting, live since 11 September 2026.
19. 19 · RecordSEC Form 8-K Item 1.05, material cybersecurity incident disclosure.
20. 20 · RecordOFAC ransomware advisory. A sanctions screen comes before any payment consideration.