On the last day of August, a single operator pointed a few hundred AI agents at a print-management server used by schools and offices around the world. The agents built a test lab, wrote exploits for 2 bugs disclosed 4 days earlier, pulled a target list from an internet scanning service, and went to work. From an empty workspace to the first break-in at a real victim took under 4 hours. When the campaign launched the next morning, 11 organizations fell in 26 seconds. By the time GreyNoise finished counting, 395 organizations in 48 countries had been compromised, half of them schools. The model doing the work was a cheap, open-weight one, not a frontier model from a US lab. The agents even ignored a list of 28 countries they were instructed to avoid.
7 weeks later, 2 critical bugs in PHP, the language used by 70% of websites, leaked ahead of their patch. Exploit attempts were hitting Amazon’s decoy servers, set up to catch attackers, 4 days before disclosure and 12 hours before the fix with working shells following within 3 days. CJ Moses, Amazon’s CISO, wrote that AI “makes it cheaper to turn a patch diff or advisory into a working exploit” and that “a 7-day or 30-day SLA assumes a delay that no longer exists.”
Inside our firm, these events started a debate: One camp sees the start of a bad decade where agents exploit every published vulnerability within hours, attack power grids, water systems and hospitals where patches take months or even years. The other has been here before. In 2003 Metasploit threatened to arm every amateur and in 2009 Shodan was supposed to expose every industrial controller and IoT device on earth. Neither ended the internet.
Here is where we landed
For twenty years, the bottleneck in offensive cyber was the expertise and time required to turn a vulnerability into a working exploit. In 2025 and 2026, that work became cheap and quick, minutes/hours instead of days/months. Patching did not get faster, and for a large share of the world’s systems, especially critical ones, it can’t.
However, that doesn’t mean it all adds up to a catastrophe. We believe the grid is not about to go dark, and the internet is not about to go down. We do think it leads to outbreaks like those of the 2003 worm era and the 2017 WannaCry outbreak, landing hardest on systems that cannot be updated quickly, and on the few targets where a single break-in is worth billions.
The exploit is the part we can measure across 23 years, so it is where our data starts. But the cost of a skilled attacker’s time mattered at every step. Scouting a network, adapting an exploit to an unusual setup, moving inside, getting paid: each step needed a person, and a person’s days only made sense against a target that could pay them back. That is what “too small to target” meant. Small organizations were never spared the mass attacks, but they were spared the hands-on ones, because they weren’t worth anyone’s time.
AI is cutting the cost of every one of those steps, not just the exploit. That is why 2 of the largest incidents this fall needed no new vulnerability at all: the supermarket refrigeration attacks hit controllers that no longer get updates and whose weaknesses had been public for months, and the Binance theft went through one engineer’s laptop.
Mandiant’s data shows the average time from disclosure to attack falling from 63 days in 2018-19 to 44 in 2020-21, 32 in 2021-22 and five in 2023. By 2024, attacks came an average of one day before disclosure. By 2025, seven days before.
One caveat matters: the lines crossed before agentic AI existed. Professional attackers, mostly state groups and ransomware crews, were already hitting internet-facing appliances before patches shipped. What AI changes is who can operate inside that window, and how fast known bugs, not only zero-days, get weaponized.
Why exploitation was the bottleneck
An exploit is a program that turns a vulnerability in the code or logic into access. For two decades, building one was expensive. RAND’s 2017 study of more than 200 zero-days found a median of 22 days for a professional to build a working exploit. Brokers paid thousands to millions of dollars each and the skill sat inside intelligence agencies and a few well-funded criminal groups.
The expertise required may help explain the most-cited statistic in the vulnerability management space: only about six percent of published vulnerabilities had ever been seen exploited in the wild. Epoch’s Timothée Chauvin attributes most of that gap to attackers “not having enough time to exploit all the vulnerabilities.”
This is also why Metasploit didn’t end the internet. Metasploit made it cheap to use an exploit someone had already written. But someone still had to write it, choose a target and run the attack. AI agents are starting to take on those jobs too.
At the time defenses also improved. Microsoft halted Windows feature work for two months to focus on security, then shipped Service Pack 2 with a firewall on by default and stronger update controls. Crime professionalized, giving attackers more reason to preserve access they could monetize. And Metasploit became a tool defenders used to test themselves. Those last two forces still matter. But Microsoft could change the software running on much of the world’s computers. Today’s exposed systems span thousands of vendors and millions of unsupported installations.
The better precedent is the one time the scarce step became free - EternalBlue. Microsoft patched the bug in March 2017. A month later, the NSA’s exploit for it leaked. WannaCry hit 59 days after the patch was available and disrupted 81 of England’s 236 hospital trusts. NotPetya followed, causing more than $10 billion in damages. Every victim had had two months to patch.
Before that came the 1999-2004 worm era. Those outbreaks caused more than $250 billion in losses in 2025 dollars, according to an estimate cited by Jason Healey. Microsoft’s security overhaul helped bring them under control.
What changed in the field
The 2026 field record is short but specific. On September 21, an AI agent chained two zero-days in a help-desk product to break into the Dutch Institute for Vulnerability Disclosure, escalating “in seconds,” with the agent, in DIVD’s words, “deciding the next step itself.” In May, Google’s threat intelligence group reported the first zero-day it assesses was developed by AI in criminal hands, intended for mass exploitation and disrupted before use. In August, the NSA, CISA, FBI, Department of Energy and EPA warned that AI-generated scripts were targeting internet-exposed Siemens controllers in energy, water and chemical plants. The advisory named no new vulnerabilities, only old exposure newly automated. And Dragos documented an intruder using a frontier model as its “primary technical executor” who built a 17,000-line attack framework and reached the boundary between a Mexican water utility’s office network and its control system before being stopped.
None of these is a catastrophe, and the PHP bugs make the point both ways. A week after disclosure, millions of attempts had produced few confirmed compromises: memory-corruption bugs are hard to exploit reliably, and hosting providers and content networks blocked attacks at their edge within a day. But between 2.6 and 4.4 million internet-facing PHP installations remain, with about 80% on versions the project no longer supports and several hundred thousand with no fix at all. Most are old blogs and small business sites nobody would target on purpose. But that is the point: when attacking is nearly free, attackers no longer need to want a target, and a hijacked site becomes a host for phishing, malware or the next campaign. Unlike Y2K, there is no date after which that risk goes away.
Why it is happening now
The frontier labs’ results explain the field. They come mostly from the AI developers themselves and run without live defenders, so we read them as an explanation for what we see in the field, not as proof on their own. In March 2026, Anthropic reported that several hundred attempts and about $4,000 got its then-current model to two working Firefox exploits. A month later, its next model, which it has kept off general release, produced 181 on the same task. By June it reported going from a released Firefox patch that fixes a bug to a working exploit in under an hour, and from Windows kernel binaries with no source code to 8 complete privilege-escalation chains in 18 hours at about $2,000 each. Independent measurement points the same way: the UK’s AI Security Institute finds the length of cyber tasks frontier models finish unaided doubling every 4.7 months, and in May reported the first models to complete its 32-step corporate-network range and its industrial-control range.
Cyber is not a special case. Since late 2024, the length of tasks models can reliably complete in both cyber and coding has doubled every 4-5 months. Coding offers a preview: in under 2 years, agents went from demos to production use at 83 percent of large companies.
Put simply, an exploit has gone from a skilled person’s month to a few hours of machine time, and an N-day, a bug that already has a patch, can now be weaponized before most organizations have read the advisory.
Patching has not moved
In 2003, Qualys measured the half-life of a critical vulnerability, the time for organizations to patch half their exposed systems, at 30 days. In 2008 it was still 30. The 2026 Verizon Data Breach Investigations Report puts the median time to fully fix a known-exploited vulnerability at 43 days, up from 32 the year before, with only 26 percent fully fixed within the year, in the same year exploitation became the leading way breaches begin. Below the enterprise, it is slower or never: a quarter of 2025’s industrial-control advisories shipped with no patch at all, grid operators are allowed 35 days to evaluate a patch and 35 more to apply it, and FDA cybersecurity rules cover only new medical devices. Even at the top of the stack the last mile is slow. In October, Anthropic reported that an unreleased model had written an exploit giving a remote attacker with no login full control of Linux servers that use multipath TCP, through a kernel bug fixed upstream on October 5. More than three weeks later Ubuntu and Red Hat, two of the most widely used server distributions, still had no fixed package, and Red Hat had first rated the bug moderate because its timing race was hard to win. The model exploited it in under an hour. Severity scores still assume a human attacker. Buyers know it. In a survey of 100 large-company security chiefs our colleagues published this week, a fintech CISO put it plainly: “you’re able to find vulnerabilities faster, but you’re not able to patch faster.”
Why we don’t expect a catastrophe
Start with the grid, because it is what people fear most. Turning off power takes more than access. Grid control systems use specialized industrial protocols, have protection equipment designed to limit failures, and can often be run by hand. Every successful grid attack on record, Ukraine in 2015 and 2016, took a state team months of preparation and purpose-built tooling, and power was restored within hours. Large US utilities operate under mandatory federal reliability standards for segmentation and patching.
For states, the constraint on a grid attack has never been the exploit, it has been intent and the willingness to accept the consequences. Chinese state operators quietly kept access inside some US critical-infrastructure networks for at least five years, according to CISA. Access alone does not tell us when, or whether, an attacker will cause disruption.
The harder question is the actors who would not hold back: hacktivists, terrorist groups, and fronts that let a state disown the result. Their constraint was never intent, but was capability - the engineering work it takes to turn access into a physical effect. That is exactly what AI erodes. Open-weight models have typically trailed the frontier by months to a year, and versions with their safety training stripped out are no longer an underground practice: Hugging Face hosts thousands of them, and since September, at least one startup has sold hosted access to a leading open-weight model with its refusals removed, as TechCrunch reported. Practitioners say stripping refusals costs some capability, which may slow this but will not stop it. So we should assume that within a year an unrestricted model will do what the most capable restricted models do today: find bugs, write reliable exploits from a patch, move through a network and run for weeks without a human.
We already have examples of what exposed controls allow:
In January 2024 pro-Russian hacktivists overflowed a water tank in Muleshoe, Texas, by changing a pump setting. In April 2025 a pro-Russian group opened a dam valve in Bremanger, Norway, for four hours. In late 2023 an Iran-linked group posing as hacktivists took over water-utility controllers across the US through a default password. Every one hit a small operator with an exposed control screen, and every one ended in local disruption measured in minutes or hours, not an outage. We expect more attacks of this kind, with more capable attackers reaching small operators.
The reason we still don’t expect the bulk grid to fall is not that these groups lack skill. Even attackers with full state capability have produced outages measured in hours, because the grid is built to absorb the loss of any single component. Its protection equipment acts on physics rather than software, and restoration is practiced. That architecture held against states, and it is what holds against everyone else. The risk from unrestrained actors lands, again, on the long tail.
The internet as a whole is more robust than its weakest server. Most of the traffic people depend on runs through a few cloud, content-delivery and hosting platforms that update at machine speed - during the PHP scare they had protective rules in place within a day for the millions of sites behind them. Core routing and naming infrastructure is concentrated, closely monitored and run by organizations with the budgets of what security people call “the security 1%.”
The history agrees. The worm era hit the whole internet repeatedly and never took it down. NotPetya caused more than $10 billion in damage and shut down shipping lines and drug plants for weeks, but the internet carried on. And today’s numbers are not moving the way a catastrophe would require. Confirmed exploited vulnerabilities grew modestly, from about 640 in 2023 to 880 in 2025, while published vulnerabilities rose by two thirds. Ransom payments fell for a second straight year. Only 12 of the 440 PaperCut victims lost full control of their networks.
There are two risks we watch closely.
The first is attacks spreading beyond their intended targets. The PaperCut agents ignored their operator’s targeting rules, and in a separate lab incident about 1,200 nominally isolated agents found a way to coordinate and some 700 joined an attack nobody sanctioned. NotPetya’s worst damage was collateral too.
The other is aggregation: state-grade capability in more hands could reach operators whose defenses were built for much less capable attackers: small water systems, rural electric cooperatives and county hospitals. Coordinated attacks, especially ones that destroy systems rather than demand payment, could turn local disruptions into a regional emergency.
October showed how damage can spread across many sites. Attackers manipulated refrigeration systems in hundreds of French supermarkets, causing fires and food losses. Three weeks later, stores across Belgium, Luxembourg, Sweden, Estonia and other European countries reported similar incidents. Some units were set to 50°C.
French authorities had already told operators to remove these controllers from the public internet, warning that unsupported equipment would remain vulnerable even after a factory reset. No AI involvement has been shown, but the pattern matters: many sites, one night, several countries.
The second wave matters most for this piece. Three weeks of warning had not been enough to secure the exposed equipment. Where a fix requires physical work at each site, a faster advisory does little to shorten the job.
Nobody is too small anymore
The damage will fall unevenly. Organizations that counted on what researchers Murphy and Stone call the “seemingly-rational calculation that attackers may not bother” are the ones AI prices back in. Half the PaperCut victims were schools. In Claroty’s 2025 study of 351 healthcare organizations, 89 percent had connected medical devices with known-exploited vulnerabilities linked to ransomware and insecure internet connections. An attacker does not need to control an MRI scanner to hurt a hospital, only to stop it.
The money already shows the shift. Ransomware leak-site claims rose by more than half, while ransoms paid fell to about $820 million. More attacks, less money: cheaper intrusions reach smaller victims who mostly don’t pay. Verizon’s 2025 breach report found ransomware in 88 percent of breaches at small and mid-sized businesses, against 39 percent at large ones. Access is getting cheaper too: the average price criminals paid for access to a victim’s network dropped from about $1,427 in early 2023 to $439 in early 2026, according to data cited by Chainalysis.
We expect the break-even victims to move downmarket, to dentists, county governments and small manufacturers. Attackers can also sell access or stolen data without depending on the victim to pay. States and hacktivists get the same cheaper capability without needing revenue at all. Shared software makes losses correlated: one bug in shared code can now expose thousands of victims at once. Ransom revenue alone will miss much of the damage as destructive attacks grow. A wiper demands nothing. We would watch the number of victims and the length of their outages.
Hospitals show what those outages mean. Even before AI, hospitals hit by ransomware averaged two to three weeks of downtime, and confirmed attacks on healthcare providers worldwide grew sixfold between 2018 and 2024. Counting leak-site claims, attacks held at about 440 a year in 2024 and 2025. The first nine months of 2026 already matched that, and the third quarter’s 192 attacks and claims were a record. Most of the recent rise remains unconfirmed, so it is an early signal. Recovery could also get harder: attackers are targeting backups to prevent victims from restoring systems independently. If the backups go too, outages lasting weeks could stretch into months.
The long tail is not the only place where the cost lands. Exposure follows whatever cannot update at machine speed, whatever its owner’s budget. And at the other end sit a few targets so valuable that one break-in becomes a market event. Binance now puts the October 29 theft at $6.34 billion, with its initial investigation tracing the attack through compromised engineers’ computers and stolen credentials. Within hours, two lending platforms had frozen markets the attacker was using to cash out, and $628 million of leveraged positions had been liquidated. The same day, a tampered copy of the Claude Code extension sat in Cursor’s extension marketplace for about eleven hours and reached up to 5,000 developers’ machines. It attempted to plant an SSH backdoor. Cursor pulled it and rebuilt its marketplace. How the package got there remains unexplained.
Who can patch their way out, and who can’t
The instinctive answer to a faster attacker is faster patching. It works for some systems and not others, and the line between them is mostly about what an update costs.
Two things follow. Machine-speed patching works where an update is cheap to apply and cheap to undo: software the vendor runs for you, browsers and phones that update silently, servers behind a platform that can block an attack at its edge while the real fix ships. It does not work where an update means stopping a physical process, re-certifying a medical device or reaching an owner who doesn’t know the device exists. And patch speed has a ceiling even where it works. If fixes arrive every few minutes, applying them all becomes its own outage risk: in July 2024 one faulty security update crashed about 8.5 million Windows machines and grounded flights for days. Past some cadence, patching replaces attacks with self-inflicted downtime. For everything in the bottom-right of the figure, the goal shifts from fixing the vulnerability to making it unreachable, through isolation, segmentation and network-level protection, with safe manual fallback when that fails. What that takes is the subject of our next piece.
A scorecard
What would change our minds
We will know within two years, and the indicators are public.
Exploited-vulnerability counts. VulnCheck counted about 880 in 2025. Under 1,200 in 2027 and the skeptics were right about magnitude, above 2,000 and the cost collapse has arrived. For scale, the long-run six percent share applied to 2025’s CVEs would be about 2,900, eight a day.
Exploitation at disclosure. In 2025, 29 percent of exploited vulnerabilities were attacked on or before the day their CVE was published. Above half by 2027 and the window has closed from the attacker’s side.
Time to patch. The DBIR median was 43 days. Under 30 in the 2028 report and defenders adapted, above 60 and the window is the whole story.
AI-found bugs in the wild. So far 1.3 percent of AI-discovered vulnerabilities have been exploited. Still under five percent at the end of 2027 and AI discovery is helping defenders more than attackers.
Victim breadth. Ransomware leak-site victims hit a record in 2025. If they keep rising while payments fall, the damage is spreading downmarket as we expect.
Industrial disruption. Physical disruption at scale has now happened without attribution: in October hundreds of French supermarkets lost refrigeration in one night, and on November 1 stores in four more countries did. If by the end of 2027 none has been attributed to an AI-run intrusion, “exploitation is not impact” holds for industrial systems.
Destructive versus extortion attacks. If the share of major incidents that destroy data or equipment, rather than demand payment, rises through 2027, unrestrained actors have arrived and ransom figures understate the damage.
Twenty-three years of data say patching does not get faster on its own. Microsoft could once make a large part of the internet safer by fixing Windows. This time no single company owns the problem. Our bet is that 2026 looks less like the start of a cyber war, and more like the start of a long, expensive worm era for everyone without a platform to shelter under – and for the few targets valuable enough that the platform itself is worth attacking.
This newsletter is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. Furthermore, this content is not investment advice, nor is it intended for use by any investors or prospective investors in any a16z funds. This newsletter may link to other websites or contain other information obtained from third-party sources - a16z has not independently verified nor makes any representations about the current or enduring accuracy of such information. If this content includes third-party advertisements, a16z has not reviewed such advertisements and does not endorse any advertising content or related companies contained therein. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z; visit https://a16z.com/investment-list/ for a full list of investments. Other important information can be found at a16z.com/disclosures. You’re receiving this newsletter since you opted in earlier; if you would like to opt out of future newsletters you may unsubscribe immediately.
Extremely well done!!! Having been an IT Boss and key defender in a enterprise for 30 years without getting beat, php2shell was a highly relevant test of the frameworks and systems against this new trend.
The central distinction remains unchanged: PHP2Shell has demonstrated dangerous offensive capability, but has not yet triggered proportionate, widespread catastrophic outcomes. However, the absence of a published aggregate does not establish zero loss or cost.