AI Agents in Cyber Defense vs Offense: Why the Strongest Model Wins
Attackers now use agentic AI to find and exploit flaws at scale. Here's why defenders need the strongest models available, not weaker ones.
Why does model strength matter in cyber defense?
Because the exact same abilities that let an AI agent break something also let it find and fix the flaw before anyone else does. An agent that can read unfamiliar code, spot something suspicious, write a test, run it, fail, and try again is doing cyber offense or cyber defense with the identical skill set. If attackers get access to the most capable models and defenders are stuck with weaker, more restricted ones, the fight is already lost before it starts.
TL;DR
- Agentic AI collapsed the cost of both attack and defense, turning work that once required teams of skilled humans into something a single well-equipped individual can run around the clock.
- A string of October incidents, including critical PHP vulnerabilities and a certificate authority whose “secret” key turned out to be the number four, showed how AI agents can expose decades-old weaknesses almost instantly.
- Security researchers have demonstrated recovering cryptographic keys with a single AI prompt, which is the same capability that lets defenders audit their own systems just as fast.
- Large infrastructure players like Mozilla, Cloudflare, and Vercel pushed out protective fixes within hours of disclosure, showing how quickly defense now has to move to keep pace with agent-driven attacks.
- Anthropic’s own scanning of important software projects surfaced tens of thousands of candidate vulnerabilities in six months, suggesting the backlog of undiscovered bugs across the internet is enormous.
- Model safeguards built to prevent AI from assisting cyberattacks can accidentally block legitimate defenders, which is a design problem the industry still needs to solve.
- Stolen API keys for tools like Claude or Codex now function like stolen cash, because whoever holds the key can run expensive AI workloads on someone else’s account.
Everyone else built a construction worker.
We built the contractor.
One file at a time.
UI, API, database, deploy.
What actually happened this past “Blocktober”?
Security teams have started calling this stretch of October “Blocktober” because so many serious vulnerabilities surfaced at once. The anchor incident was a pair of critical flaws in PHP, the software underlying a huge share of the web, including most WordPress sites. The bug let attackers get code to run on a website before the site’s own application code even started, effectively hijacking the platform underneath it. UK and European security agencies responded by telling organizations to consider isolating or shutting down systems they couldn’t patch quickly, a level of urgency usually reserved for the most severe threats.
A separate incident involved eMudhra, a certificate authority whose job is to issue the credentials that let browsers trust a website is who it claims to be. Researcher Scott Helme found that eight of eMudhra’s private keys were trivially weak, recovering them in under a second. One of those keys, meant to be a long, effectively unguessable number, turned out to be the digit four. Because eMudhra sat at the root of the certificate trust chain, that one failure had the potential to cascade across much of the internet. Helme has said he used Claude to recover the keys with a single prompt, which is the detail that should worry anyone still assuming obscurity or complexity protects old infrastructure.
On top of that, Microsoft documented a China state-aligned group using an agent framework to target hundreds of organizations, with some intrusions reaching privileged cloud access within hours. Most attempts failed, but the pattern matters more than any single outcome: attacks now move at the speed of the agents running them, not the speed of the humans directing them.
How do AI agents actually find vulnerabilities?
The mechanics are simple even when the implications are not. An agent reads code it has never seen, notices something that looks off, writes a small test to check its hypothesis, runs it, and if the first theory is wrong, tries another angle. It can do this continuously, without fatigue, across codebases far larger than any one engineer could hold in their head.
This is why maintenance debt is suddenly so dangerous. PHP’s maintainers reportedly recognized signs of one of these problems as far back as 2024 but faced the usual constraints: compatibility risk, limited expert time, and hard trade-offs about how to roll out a fix. That kind of slow, deliberative process used to be normal. Agentic scanning removes the luxury of time. A weakness that sat quietly for two years can now be found, understood, and potentially exploited in an afternoon.
The scale backs this up. Anthropic has reported over 29,000 candidate vulnerabilities surfaced from six months of scanning important software projects, with roughly 6,000 manually reviewed and triaged so far. That ratio alone suggests the backlog of undiscovered or unpatched weaknesses across commonly used software could run into the millions.
Why can’t defenders just use a weaker, “safer” model?
Model makers build safeguards to stop AI from being used to assist cyberattacks, which makes sense in isolation. But those same guardrails sometimes block legitimate defenders from doing the exact analysis they need during an active incident, forcing security teams to switch tools mid-emergency.
The strategic point is that attackers are not going to voluntarily use a weaker model out of courtesy. If the strongest available model can find a vulnerability in a protocol that’s been trusted for decades, defenders need that same strength on their side of the table, not a hobbled version. Treating capability as inherently dangerous and handing defenders a watered-down tool just guarantees that whoever has fewer restrictions, usually the attacker, wins the race.
What does good defense actually look like right now?
It looks like speed matched to speed. When the eMudhra and PHP disclosures went public, major infrastructure providers moved immediately. Mozilla says it pushed protection into standard Firefox configurations within a couple of hours of receiving the report. Cloudflare and Vercel moved quickly to shield the many websites sitting behind their infrastructure, acting as a protective layer even for site owners who hadn’t patched yet.
That’s the model for defense at scale: large platforms functioning as chokepoints that can push protection out to thousands of downstream users faster than any individual company could patch itself. But it also means individual companies and users can’t assume someone else’s shield covers them completely. The LightLLM incident is a clear example of why. LightLLM, a tool that connects applications to AI models, had a disclosure in October describing a distributed release that contained credential-stealing malware, on top of an earlier compromise back in March. Critically, the official source code repository looked clean. The problem was in the distributed package that got installed, which means checking the source code alone wasn’t enough to confirm a system was safe. Teams had to treat the environment as compromised, follow containment steps, and rotate every credential that tool had touched.
What should individuals and builders do this week?
Treat API keys and tokens like cash, because that’s effectively what they’ve become. If someone steals your Claude or Codex key, they can run expensive workloads on your account and leave you with the bill, or resell access to someone else entirely.
A few concrete steps:
Open the connected-app or third-party access settings on any account that matters (Google is a common example) and review what you’ve authorized. Look at what each connection can actually do: read basic profile data, read files, or modify them. Remove anything you don’t actively need. This is a basic reduction of attack surface, and it takes minutes.
Use AI to help with the audit itself. Give an AI assistant the list of connected apps and their permissions and ask it to flag anything that looks overly broad or unused. The same capability that lets an agent find a weak cryptographic key in seconds can just as easily walk through your own settings and point out what’s exposed.
Assume compromise rather than assuming safety. If a tool you depend on discloses a breach, don’t stop at checking whether the source code looks clean. Check what was actually distributed and installed, rotate credentials tied to that tool, and follow whatever containment guidance the vendor publishes.
Frequently Asked Questions
Why are API keys suddenly a bigger target?
Because tokens now have direct monetary value. A stolen key for a service like Claude or Codex lets an attacker run AI workloads on someone else’s account and budget, either for their own use or to resell, while the original owner gets billed.
What made the PHP vulnerability so serious?
It allowed attackers to execute code on a website before the site’s own application even started running, effectively letting them hijack the platform underneath it. Because PHP runs an enormous share of the web, including most WordPress installations, government security agencies in the UK and Europe told organizations to consider isolating or shutting down systems they couldn’t patch quickly.
How was a certificate authority’s secret key just the number four?
Researcher Scott Helme found that eMudhra, a certificate issuer, had implemented its cryptographic keys so weakly that they could be recovered almost instantly rather than requiring the computational effort a secure key demands. One of the supposedly secret keys turned out to literally be the digit four. Because eMudhra’s certificates were automatically trusted across the internet, this single implementation failure had wide-reaching consequences.
Does using the strongest AI model actually make defense safer?
The argument is that attackers already have access to frontier-level agentic capability, so restricting defenders to weaker models just creates an asymmetry in the attacker’s favor. The skills involved (reading code, forming hypotheses, testing them, iterating) are identical for offense and defense, so capability gaps cut both ways.
What’s the single most useful habit for regular users right now?
Regularly review and prune third-party app permissions on major accounts, and treat any breach disclosure from a tool you use as a reason to rotate credentials rather than assuming a clean-looking source repository means you’re safe.
