AI advances are reshaping cyber risk, experts warn
Check Point Software and Flashpoint have warned that advances in artificial intelligence are transforming cyber risk for enterprises and governments.
Executives at both security companies say emerging AI models are changing how quickly attackers can find and exploit software flaws.
Concern intensified after it emerged that Anthropic had been developing a new Claude model, known internally as Capybara or Mythos, which researchers say can improve vulnerability discovery, exploit development and multi-step attack planning. The details surfaced through a leak rather than a formal launch, prompting fresh scrutiny of how frontier AI systems could shift the balance between attackers and defenders.
Jonathan Zanger, chief technology officer at Check Point Software Technologies, said the leaked details confirmed patterns the company had been tracking in its own research and testing of advanced models.
"Claude Mythos confirms what we've been tracking: AI has crossed a cybersecurity threshold. Capabilities that required nation-state resources are now on a path to anyone with a laptop and a prompt. The time-to-exploit window is collapsing, and security leaders who are still running a patching-first strategy are in a race they can't win. This is the moment to reassess your foundations - not just your tools, but whether your tools themselves are secure," said Zanger.
Check Point says two structural shifts are redefining cyber risk: the wider availability of advanced offensive techniques, and the industrialisation of attacks through automation and so-called agentic systems.
Zanger argues that AI systems capable of generating sophisticated software can, with relatively minor adaptations or prompts, also analyse code for weaknesses. He links this to better exploit development and the ability to chain multiple steps into a single campaign.
That combination, he said, expands the threat surface and compresses the time between the discovery of a flaw and the launch of an exploit. Check Point researchers describe this as a move toward "AI attack factories", in which attackers run repeatable pipelines rather than bespoke, manual intrusions.
Check Point has urged security leaders to re-examine their first line of defence, including networks, firewalls, web application firewalls, endpoints and email security. It argues that many default configurations do not protect against previously unknown exploits, and that organisations should scrutinise their vendors' vulnerability histories as exploitation timelines shrink.
The company also points to long-standing blind spots such as legacy servers, unpatched systems, accounts without multi-factor authentication and unprotected remote access. Zanger's team advises organisations to speed up patching, explore virtual patching options and strengthen network segmentation on an "assume breach" basis.
Ian Gray, vice president of intelligence at Flashpoint, said the trend is not limited to any one model or vendor and is already beginning to reshape incident response planning.
"Access to advanced AI models raises the stakes on what threat actors can potentially execute. Tasks like analyzing large codebases or identifying exploitable weaknesses, which previously required significant time and expertise, can now be done faster and at greater scale. That escalates the threat landscape for organizations, as the gap between vulnerability discovery and potential exploitation continues to narrow."
Gray said the effects will also be felt in older environments burdened by technical debt, as models sift through large volumes of legacy code.
"One of the more immediate impacts is how AI changes the way vulnerabilities are surfaced and revisited. These models can analyze legacy code at scale, which increases the likelihood that older or previously overlooked issues are rediscovered and re-evaluated. For organizations, that means exposures that were deprioritized or assumed low risk may re-enter the threat landscape with little warning."
Flashpoint expects a broader mix of attackers to use AI tooling. Gray said this will put more pressure on how security teams prioritise and act on vulnerability data, rather than simply expand their lists of identified issues.
"As these capabilities evolve, organizations should plan for increased variability in attacker sophistication and speed. A broader range of actors can identify and act on vulnerabilities more efficiently, which places pressure on how quickly teams can assess and respond. Security programs should align their response to real-world threat activity to maintain operational effectiveness. Fortunately, it's heartening how the industry has come together to ensure defenders take a 'one team, one fight' approach to stay ahead."