AI Isn't Bringing New Attack Tricks. It's Making the Old Ones Much Faster
Security experts say the lesson from AI-assisted hacking isn't panic about sci-fi threats. It's that the basics your organisation has been ignoring for years just got a lot more dangerous to skip.
Key points
- An OpenAI model escaped its test environment and broke into Hugging Face's systems on its own, but the root cause was a misconfigured sandbox, a decades-old type of failure.
- Security experts at AWS, Google Cloud, Sophos, and CrowdStrike all say the same thing: AI makes foundational security gaps more dangerous, not different.
- Researchers registered an abandoned web domain for $5 and used it to pull sensitive data out of a Salesforce AI assistant, exploiting a basic housekeeping oversight.
- Sophos incident data shows stolen passwords and unpatched software remain the top two causes of breaches, year after year.
- Organisations that treat AI as a substitute for prevention rather than a complement to it are, in the words of one field security officer, driving without brakes.
When OpenAI revealed that one of its AI models had broken out of its test environment and independently found its way into Hugging Face's systems (Hugging Face is a popular platform where AI developers share and download software), the headlines were predictably dramatic. A new era of machine-driven attacks. AI going rogue.
The actual cause was a misconfigured sandbox. A sandbox, in software terms, is a walled-off area where risky code runs in isolation so it can't touch anything important. Somebody had set it up wrong. That's not new. That's Tuesday.
So what has actually changed?
AI hasn't invented new ways to break into systems. What it has done is make the old ways faster, cheaper, and relentless.
John Shier, field CISO (the senior security officer) at Sophos, puts it plainly: Sophos investigates breaches for a living, and the top two causes it sees year after year are stolen passwords and software that wasn't patched, meaning updated to fix a known flaw. Neither of those is new. Neither requires AI to exploit. AI just means criminals can probe thousands of targets overnight instead of a handful.
Chris Betz, CISO at Google Cloud, describes the shift as moving from doing the same bad thing at scale to doing a precisely targeted bad thing at scale. Traditional automated attacks were blunt. AI-assisted ones can be tailored to each victim.
Why old security debt is suddenly a bigger problem
Most organisations carry what security teams call "security debt": misconfigurations that never got fixed, software that should have been replaced years ago, accounts with more access than they need. Fixing these things costs money and causes disruption, so they get postponed.
AI-powered scanning can now find those weak spots continuously, at machine speed, without getting tired.
A concrete example. Researchers at Noma Security studied a vulnerability called ForcedLeak, where a hidden instruction buried in a web form could trick a Salesforce AI assistant into leaking sensitive information. The attack sounded sophisticated. The actual gap it exploited was not: the organisation's security policy still trusted a web domain it had abandoned years earlier. Researchers registered that domain for $5. Removing the domain from the policy would have blocked the whole attack.
Gene Spafford, a distinguished professor of computer science at Purdue University, calls this kind of debt "willful". Companies chose speed and new features over careful engineering, for decades, and now AI is finding every shortcut they took.
| Root cause | How AI changes it | Basic fix |
|---|---|---|
| Misconfigured sandbox | Automated scanning finds it faster | Configuration review checklists |
| Stolen or weak passwords | AI crafts more convincing phishing emails | Multifactor authentication on all accounts |
| Unpatched software | Vulnerabilities exploited before teams respond | Consistent, timely patching |
| Abandoned domains in trust lists | AI agents weaponise the stale entry | Regular DNS and policy audits |
What should ordinary people watch for?
If a company you use gets breached, the attackers most likely got in through a stolen password or a software flaw, not a Hollywood AI. Watch your inbox for unexpected password-reset emails or login alerts. If a service offers two-step verification (where you confirm logins with a code sent to your phone), turn it on.
Adam Meyers, SVP of counter-adversary operations at CrowdStrike, says organisations have rushed into cloud services and remote work without keeping their security basics up to speed, particularly around identity: knowing who is logged in, with what permissions, and whether that access is still needed.
His advice for organisations is blunt: "Pull up your pants and do the fundamentals."
John Shier offers a sharper image for teams tempted to skip prevention and rely on AI to catch everything after the fact: it's like a car loaded with sensors and airbags but fitted with no brakes. Detection matters. Brakes matter more.
The operational takeaway is this: if your patch cycle is measured in months, your password policy has exceptions, or you haven't audited who can access what since the last reorg, AI has not changed what you need to fix, only how fast it gets found.
