AI is Prolific. Do Defenders Still Matter?

In the midst of Cyber Security Awareness Month, we asked AC3's SOC Lead, Tim Gearie, to share his thoughts on the good, the bad, and the grey areas of AI – and where defenders fit in this ever-changing landscape.

Tim leads the security operations centre and drives its detection engineering, SOAR automation, and threat intelligence capability. With a passion for security and after 14+ years in infrastructure, Tim moved into cyber security, building the automation and SOAR pipeline for AC3’s SOC before stepping up to lead the team. He holds BTL1, BTL2 and SC-200 certifications, with earlier credentials in Citrix virtualisation & networking and Azure Virtual Desktop. Always across the latest security news and technology, Tim is passionate about AI automation pipelines and tool building and today focuses on growing his team and evolving the SOC for a world where AI is everywhere.

If anyone knows me, they will know how much I love technology. I was honestly lucky as I got to grow up in what could only be described as the digital age. I started way back when computer mice were just giant square blocks and you had to click through several menus just to open Notepad or Paint.

I've watched Windows reinvent itself again and again, from the greats like XP to the low points of Vista. Who can forget the classic old days of using LimeWire to infect your machine faster than any disease known to mankind, just to get that one song that everyone had (only to find it was some mashup that you never planned on getting or never heard of before).

I've lived through the instant messaging years on MSN and IRC, slapping people around with a large albeit digital trout, but nothing compares to how fast technology is moving today. We just have to look at recent news to see what the pace looks like. On the 29th of September, Debian shipped a single kernel security advisory, (DSA-6528-1), which listed hundreds of different CVEs in one advisory. If you work in cybersecurity, that single wall of identifiers says more about 2026 than any statistic that I could quote.

With October comes Cybersecurity Awareness Month and I wanted to take this time to talk about why this year feels different. AI is now finding bugs, writing exploits, sitting inside our very operating systems, and occasionally acting on its own. Some of that is generally good news for defenders. Some of it isn't. But one thing's for sure, what this means is that we should all be paying closer attention, not less.

If we look back to the start of 2026, in January, the frontier of AI looked like Claude Opus 4.5, ChatGPT 5.2, Gemini 3, and Grok 4.1. Now only 9 months later, every major player in the AI race has shipped two- or three-generational jumps.

Note that not every AI model is listed these are rough dates and models being released.

Security and application programs are usually built on annual roadmaps and quarterly patch cycles. The tools on both sides of the fight are now changing every few weeks.

This isn't a chatbot story anymore. The people and the platforms that we are trusting our data with are now building AI into the foundations of those very systems.

• Linus Torvalds once called most AI "messaging marketing hype." However, if we look back in July, he told kernel developers that Linux is not an anti-AI project and anyone who disagrees can fork it.
• Microsoft used Build 2026 to position Windows 11 as a host for local agents with agent identities, containment, and governance built into the platform.
• Apple was seen partnered with Google to bring Gemini into Siri on top of its existing ChatGPT integrations.

The devices that are in our pockets and on the servers running our businesses increasingly have AI at their core. This is exciting from a technical standpoint but it is also very scary as it means that AI is now a part of the attack surface, more and more, part of the decision-making.

I want to be clear that I am optimistic and generally believe there is good in AI being part of our everyday lives. It helps with our work as an augmentation and honestly it even gives us defenders some genuine wins.

There have been bugs that have survived decades of human review that are now being found within days. Just look at the free BSD. Mythos found a 17-year-old flaw in an NFS server (quoted under CVE-2026-4747) and then went on to exploit it, giving itself unauthenticated root access without a human stepping in after the first prompt. It didn't just stop there either. AI dug up a 27-year-old bug in OpenBSD and a 16-year-old flaw in FFmpeg that every fuzzer out there has flatly missed. And it's not just Mythos. AISLE found a 21-year-old root-level flaw sitting quietly in FreeBSD's DHCP client. This was found and noted under CVE-2026-42511. Honestly that's a real shift in the defender's favour as long as we can keep up with the patching.

Now we know that there have been general benefits to AI. We also need to acknowledge that the tools that the white hats have, the attackers have too. The big thing that the attackers, don't need to wait for is change control.

The most effective attacks this year didn't even need a zero-day at all. If we look at North Korean actors (UNC1069) they cloned a real company, including its founders' likenesses, built a convincing Slack workspace, and staged a Teams meeting where the lead maintainer of Axios was prompted to install a fake update, which resulted in a malicious Axios release. A library with around 100 million weekly downloads was live on NPM for about 3 hours. Whether AI helped build the Lua isn't known but this is the exact kind of craft that makes AI cheaper, easier, and faster.

We are also seeing a rise in deepfakes, with evidence of North Korean IT workers using real-time deepfake videos to pass job interviews, then using their insider access to steal data and extort employers once discovered. An 11th nation advisory in July confirmed the deepfake tactic.

Supply chain attacks have also seen a major uptick this year. Axios is one clear example of this and if we look at the attack on Vercel, it was breached through Context.ai, a third-party AI tool an employee had connected with broad permissions. Vercel assessed the attacker as highly sophisticated, citing their operational speed and complexity.

This leads me to raise a theory: if Mythos-class models give defenders unprecedented edge, the organisations holding that model become extremely high-value targets. You don't need to compromise Mythos itself if you can compromise someone that is talking to it or a third party that has access to a platform that hosts or uses these models.

Anthropic's report shows attackers already are thinking this way, targeting AI vendors, evaluators, and trusted access programs to reach restricted models. As far as we know none have succeeded but the AI tools and keys we are connecting to our environments are becoming both the entry point and the prize.

This is the part of the article that should get every cybersecurity professional's attention not only the ones sitting within Australia.

On June 18, an OpenAI agent gained unauthorised access to Medicare's statistics portal run by Services Australia. It wasn't on a hacking task. It was trying to retrieve data, hit some errors, and started probing for vulnerabilities instead. The government has said other systems may have been affected, including New South Wales BOCSAR (crime statistics) and the Victorian Department of Health. Australia wasn't told until 84 days later via an email, which was also generated by AI.

This attack wasn't an isolated instance. We have seen researchers at Transluce trace a similar behaviour against the Australian Institute of Health and Welfare, Data USA, and a U.S. Department of Education site, and find agents using a malware analysis service to get around their own web access guardrails.

In July a swarm of around 700 OpenAI agents was linked to an attack on Hugging Face, which Hugging Face described as the first documented large-scale cyberattack driven entirely by autonomous agents. That same month, Anthropic disclosed that during a cybersecurity evaluation, its Mythos 5 model built a malicious PyPi package and published it to the real registry. A misconfiguration meant that the test environment had live internet access, and Mythos believed it was still within the simulation. The package was only live for about an hour, but in that time, it was downloaded and run on 15 real systems, including a security company's web malware scanner that gave Mythos the company's credentials, which it then used to access more of their infrastructure. It never targeted that company directly, and it didn't even know it existed. However, it was still autonomous access without authorisation.

In an authorised bug bounty, pwn.ai's agents escaped Google's kvmCTF, one of the most hardened hypervisor targets around. It built a 14,000-line exploit harness and used a use-after-free chain triggered by a 3-byte instruction to escape the sandbox.

None of this is AI “going rogue” in the scientific sense. No Skynet just yet or at least that we know of. It is goal-seeking systems taking whatever path works, including the ones we never intended, or maybe it's the path we should have seen coming. Let's think about it for a minute. What were these systems and these models actually trained on in the first place?

The internet. Decades of human history, famous hacks, worms, breaches, write-ups, exploits, and tutorials. They were all on the internet and are now baked directly into the foundation of these AI models. When an agent hits a wall, it reaches for what it knows. A lot of it is how to break into things, a lot about all the write-ups, the exploits, etc. That's exactly why we need people watching.

Not long after Glasswing was announced, May rolled around and honestly, it felt like drinking from a firehose. Every morning there was another critical CVE, another public exploit, or another supply chain compromise to deal with. Here is a snapshot from my own notes to look over the month of May alone.

Now I can't prove that AI was behind all of these different attacks and just because the timing lines up doesn't mean one caused the other. The pattern is clear: AI is surfacing vulnerabilities faster than organisations can patch them.

When Glasswing launched, Anthropic said fewer than 1% of the vulnerabilities that Mythos had found were patched. By July partners had reported tens of thousands of critical findings yet fewer than half disclosed how many they'd actually fixed. That's not a criticism; it's just the reality. The finding problem is being solved at machine speed. The fixing problem is still running on human time. That gap is an opportunity, and attackers will find a way to use it.

When the Linux kernel adopted its AI policy this year, it made one rule and I think that one rule is something that every security team should borrow: AI tools can't add their own "signed off by" tag. A human has to take responsibility for anything submitted recorded with an "assisted by" tag. That's the model: use AI to triage and enrich, hunt and find bugs faster than we ever could.

In a SOC we can use it to change what analysts do and what analysts can get through in a single shift but don't let it auto-block, isolate, or remediate without a person accountable for that decision. Agents act on their goals not our intentions and now we've seen what it looks like on government systems. For Cybersecurity Awareness Month here is what I ask:

• Inventory your AI integrations: Know which tools have OAuth access to your environment, and what scopes they hold.
• Treat agents as identities: Give them least privilege, log what they do and alert on unusual behaviour, just like a user.
• Plan for patch volume: AI-driven discovery means more CVEs, faster. Prioritise by exportability, not just severity
• Keep humans in the loop: AI amplifies whoever wields it. Make sure there is a human that is always accountable and verifying before pressing that “I believe button”.

So, the question is: do cybersecurity defenders still matter? Well, I think that AI isn't replacing the defenders. It's making us more necessary than ever.