When did you last decide that a system was safe because nobody would bother attacking it? Maybe it is the old customer portal that only a few people still use. Maybe it is the small business that assumes criminals are busy with bigger targets. Maybe it is the internal tool that has run untouched since the team that built it moved on.
That reasoning has shaped security decisions for a long time, and for a long time it was not unreasonable. Attackers had limited hours and limited skill, so they spent both where the return was highest. Defenders leaned on a second assumption as well: that attacks gave themselves away. A phishing email with clumsy grammar, a scan that lit up the logs, an intruder who worked slowly and made mistakes. These were useful warning signs because polished, patient, targeted attacks were expensive to produce.
AI has changed that expense. This article looks at what has changed, what has not, and what defenders can rely on now, using documented cases rather than predictions.
Why obscurity used to work
Obscurity was never real protection, but it behaved like protection because of economics. An attacker’s attention is a scarce resource. Reading unfamiliar code, mapping an old system, or writing a convincing message in a second language all take skilled human time, and a target had to be worth that time.
So the safety people felt did not come from the system. It came from the cost of looking at it. When that cost falls, the protection disappears even though nothing about the system has changed.
What changed for old and obscure systems
In April 2026, Anthropic announced Project Glasswing, an effort with major technology and security companies to use an unreleased AI model, Claude Mythos Preview, to find vulnerabilities in critical software before attackers do. The reported results deserve a slow read. The model found a 27-year-old flaw in OpenBSD, an operating system built around security, that let a remote attacker crash a machine just by connecting to it. It found a 16-year-old flaw in FFmpeg, a media library used across a huge range of software, in a line of code that automated tests had already run five million times without catching the problem. It also linked several Linux kernel weaknesses into a path from ordinary user access to full control of a machine.
Two cautions are fair. The model is restricted and used by defenders under controlled conditions, so this is not proof that an average attacker can do the same today. And a bug found is not a system compromised. Still, the direction is hard to argue with. Code that survived decades of human review and conventional testing was not safe because it was flawless. It was safe because looking at it properly was costly and nobody had a cheap way to do it. That second kind of safety is exactly the kind AI erodes.
The practical consequence is that “old” and “obscure” are no longer reasons to postpone attention. Forgotten, unpatched and unowned systems are the ones whose protection depended most on being ignored.
The warning signs that stopped being reliable
In January 2024, a finance employee at the Hong Kong office of engineering firm Arup received a message, apparently from the company’s chief financial officer in the UK, about a confidential transaction. He was suspicious, because it looked like phishing. Then he joined a video call in which the CFO and several colleagues appeared and spoke. Every one of them was a deepfake. Reassured, he made 15 transfers totaling HK$200 million, about US$25.6 million. The fraud came to light only when he later checked with head office, and Arup confirmed the incident publicly in May 2024.
The detail that matters is the order of events. The email raised his doubts and the video call removed them. For years, seeing and hearing a colleague worked as a form of verification. By itself, it no longer does.
The pattern is visible closer to home. Interpol’s 2026 African Cyberthreat Assessment Report, which covers 2025, found AI involved in 55% of reported cybercrime cases across the continent. It describes East Africa as a hub for mobile money fraud, and it records cases in Kenya and Tanzania where criminals combined stolen personal data with deepfaked faces to build synthetic identities convincing enough to get past bank verification.
IBM’s 2026 Cost of a Data Breach Report, published in July and based on 602 organizations that suffered incidents between March 2025 and February 2026, points the same way. About one in four malicious breaches involved attackers using AI. Deepfake impersonation made up the largest share, followed by AI-enabled malware and AI-generated phishing. These breaches averaged roughly US$6 million, against US$4.99 million for breaches overall.
The old warning signs all tested the quality of the attack. Quality is now cheap, so defenders have to test something else.
A fair look at the hype
A serious reading has to separate what is documented from what is promised. IBM’s figures say AI-driven attacks added about US$1 million per breach. That is significant, but it is not the end of the world, and the dramatic Glasswing results come from defenders working with a restricted tool.
It also helps to remember how most breaches begin: stolen credentials, misconfigured systems, unpatched software, and people persuaded to act. AI has not replaced those weaknesses. It finds them faster and exploits them with less effort. IBM found that organizations took an average of 247 days to identify and contain a breach, and that is the window in which faster attackers do the most damage.
So the answer is rarely a new product. It is treating basic hygiene as more urgent, because the time between a weakness existing and someone finding it is shrinking.
Your own AI tools are now part of the attack surface
Many businesses are adding AI assistants that read email, answer customers or search internal documents. Each one is a new place where an attacker can try to slip in instructions.
In 2025, researchers at Aim Security disclosed a flaw called EchoLeak in Microsoft 365 Copilot, tracked as CVE-2025-32711 and rated 9.3 out of 10 for severity. A single crafted email, which the user did not need to click, could lead the assistant to expose data from the user’s own context. The message was worded to read like ordinary instructions to a person, which helped it slip past a filter built to catch attacks of that kind. Microsoft fixed it on its side in May 2025, before details were published.
The lesson applies well beyond one product. When an AI system can read content from outsiders and also reach private data, that content can start acting like instructions. IBM’s 2026 report found that more than 20% of organizations had a breach involving an AI model or application, up from 13% the year before. A company that connects a chatbot to customer records should be able to say what it can see, what it can do with that, and who checks.
What defenders can trust instead
The shift is from trusting appearance to trusting process and permissions.
Start with money and access. Any request that moves funds or changes who can get in should be confirmed through a second channel, such as a call to a number you already hold, never one supplied in the message. A rule like that works whether or not the person on the screen looks real.
Next, know what you own. Keep an inventory that includes the old systems, give each one a named owner, and patch on a schedule. That answers the obscurity problem directly.
Then limit what AI tools can reach. Give assistants and agents only the access their task needs, and keep logs of what they do.
Finally, use AI on the defensive side. IBM found that organizations using AI and automation extensively in security operations had breaches costing about US$1.93 million less on average and contained them 65 days faster. Only about a third reported using it that extensively.
Five questions to take back to your team
Which of our systems has no named owner?
If a message from a director, by text or on video, asked for an urgent payment today, what would staff be required to do before paying?
What can our AI assistants read, and what can they do with it?
How long would we take to notice a breach, and what would shorten that?
Which of our “nobody would bother” assumptions have we never actually tested?
Join the conversation
These questions sit at the center of our upcoming webinar, Weaponized AI: Inside Modern Cyber Attacks, on Saturday, 7 November 2026, from 3:00 PM to 4:00 PM EAT. Blessing Akaso, Penetration Tester and Trainer at O-range Cyber Security, Jasnoor Singh, Security Engineer at TAC Security, and Nicholas Bonny, CTO and Co-Founder of Tubayo Group, will cover the attacker’s view and the business view, and there is live audience Q&A, so bring a question of your own.
Reserve your place for the webinar
To see what else is coming, browse all our upcoming webinars.
