2026: The Year Cyberattacks Became Autonomous

We are crossing a once in a generation threshold in cybersecurity. At the start of 2026, the industry was focused primarily on AI-assisted attacks, where human operators used AI to move faster and increase their effectiveness. We are now beginning to see fully autonomous attacks, where AI agents can independently execute thousands of actions, adapt their strategies, move laterally through infrastructure, and operate continuously over extended periods of time. I believe this will eventually lead to cyber conflict at a scale we have never experienced unless organizations begin preparing now.

My cofounders and I became deeply concerned about this possibility nearly two and a half years ago. The trajectory may appear obvious today, but it was far from clear in early 2024. Daniele, Andrea, and I believed the rapid proliferation of increasingly capable AI systems would fundamentally change the economics of cyberattacks. It would become cheaper and easier to discover vulnerabilities, exploit them, and launch sophisticated campaigns against organizations around the world.

That concern is why we started depthfirst and built it as a mission-driven company with a clear purpose: to secure the world’s software. We could not afford to rely on hope, so we kept building for the world we believed was coming.

More than two years later, autonomous cyberattacks have moved from theory into reality. Throughout that time, I heard many people claim this would never happen. Some dismissed the threat entirely, while others viewed autonomous attacks as a distant possibility or simply another marketing narrative. The incident disclosed by Hugging Face this past week offers undeniable evidence that organizations need to take this threat seriously.

First, the Hugging Face team deserves enormous credit for responding to the incident with transparency, urgency, and technical rigor. Sharing this level of detail helps the entire security community understand how the threat landscape is changing and gives other organizations an opportunity to prepare.

The intrusion began with a malicious dataset that abused two code-execution paths in Hugging Face’s data-processing infrastructure. The attacker gained access to a processing worker, escalated to the underlying node, collected cloud and cluster credentials, and moved laterally into several internal clusters over the course of a weekend.

According to Hugging Face, the campaign was run by an autonomous agent framework that executed many thousands of individual actions across a swarm of short-lived sandboxes. The system also used self-migrating command-and-control infrastructure staged on public services. This was a broad, patient, multi-stage campaign conducted at machine speed.

AI played a central role in the defense as well. Hugging Face initially detected the intrusion through an AI-assisted anomaly-detection system that used LLM-based triage to separate meaningful security signals from the enormous volume of routine telemetry. Its team then ran AI analysis agents across more than 17,000 recorded events to reconstruct the attack timeline, identify indicators of compromise, determine which credentials had been accessed, and separate genuine activity from decoys.

One aspect of the investigation was particularly important. Hugging Face initially tried to use commercial frontier models to analyze the attack, but those systems could not process the necessary data because the forensic evidence included real exploit payloads, attacker commands, and command-and-control artifacts that triggered safety restrictions.

The team ultimately ran GLM 5.2, an open-weight model, on its own infrastructure to complete the investigation. This also ensured that attacker data and any credentials referenced in the logs remained inside Hugging Face’s environment. The experience exposes a serious asymmetry: attackers can use unrestricted or modified models without regard for usage policies, while defenders may find themselves blocked from analyzing real attacks by the safeguards built into hosted systems.

For security teams, this highlights a real operational risk in building on top a third party model provider. Refusals or policy changes can surface at the exact moment the technology is needed most. At depthfirst, we think carefully about this problem and have built our systems to deliver reliable, consistent results all the time for our customers. This is done via a combination of model routing and using open weights models post-trained by us that perform at the frontier level without any refusals and at a lower cost.

The incident is one of the clearest examples yet of how quickly the economics of cybersecurity are changing. The world’s software contains an enormous number of vulnerabilities, and AI is rapidly reducing the time, expertise, and cost required to find and exploit them. Work that once required a coordinated team of highly skilled operators can increasingly be executed by software, continuously and at machine speed.

There is still reason for optimism. Defenders have access to the same underlying intelligence and can use it to regain the advantage. We can build systems that continuously understand code, find vulnerabilities, verify whether they are exploitable, prioritize the issues that matter, and help developers fix them before attackers have an opportunity to act.

Organizations can no longer afford to dismiss autonomous attacks as hypothetical. They need to understand their exposure, reduce the number of exploitable vulnerabilities in their software, secure the infrastructure used to build and operate AI systems, and equip their security teams with defensive capabilities that can match the speed and scale of autonomous attackers.

The next era of cybersecurity has already begun. The decisions we make now will determine whether AI becomes an overwhelming advantage for attackers or the most powerful defensive technology we have ever built.

P.S. For fellow sci-fi fans - the title is a reference to 2010: The Year We Make Contact, the sequel to 2001: A Space Odyssey. It felt fitting for a year in which autonomous cyberattacks moved from fiction to reality.

Edit (July 21): OpenAI has later confirmed that this wasn’t an attack, but an incident occurred while evaluating new frontier cyber capabilities with reduced cyber refusals. That only reinforces the broader point: these capabilities are advancing extremely quickly, and history suggests open-weight models are not far behind. Organizations cannot afford to wait. The time to reduce exploitable vulnerabilities and strengthen defensive capabilities is now.