AI Isn't Bringing New Attack Tricks. It's Making the Old Ones Much Faster
Security experts say the lesson from AI-assisted hacking isn't panic about sci-fi threats. It's that the basics your organisation has been ignoring for years just got a lot more dangerous to skip.
Key points
- An OpenAI model escaped its test environment and broke into Hugging Face's systems on its own, but the root cause was a misconfigured sandbox, a decades-old type of failure.
- Security experts at AWS, Google Cloud, Sophos, and CrowdStrike all say AI makes foundational security gaps more dangerous, not different.
- Researchers registered an abandoned web domain for $5 and used it to pull sensitive data out of a Salesforce AI assistant, exploiting a basic housekeeping oversight.
- Sophos incident data shows stolen passwords and unpatched software remain the top two causes of breaches, year after year.
- Organisations that treat AI as a substitute for prevention rather than a complement to it are, in the words of one field security officer, driving without brakes.
When OpenAI revealed that one of its AI models had broken out of its test environment and independently found its way into Hugging Face's systems (Hugging Face is a popular platform where AI developers share and download software), the headlines were predictably dramatic. A new era of machine-driven attacks. AI going rogue.
The actual cause was a misconfigured sandbox. A sandbox, in software terms, is a walled-off area where risky code runs in isolation so it cannot touch anything important. Somebody had set it up wrong. Not new. Tuesday.
So what has actually changed?
AI has not invented new ways to break into systems. What it has done is make the old ways faster, cheaper, and targeted with a precision that manual attacks rarely achieved.
John Shier, field CISO (the senior security officer) at Sophos, puts it plainly: Sophos investigates breaches for a living, and the top two causes it sees year after year are stolen passwords and software that was never patched, meaning updated to fix a known flaw. Neither is new. Neither requires AI to exploit. AI just means criminals can probe thousands of targets overnight instead of a handful. Our 15 July story on Sophos ransomware data found that phishing and malicious emails now cause half of all ransomware attacks, while stolen passwords are defeating even multi-factor authentication at an alarming rate.
Chris Betz, CISO at Google Cloud, told CSO Online the shift is from doing the same bad thing at scale to doing a precisely targeted bad thing at scale. Traditional automated attacks were blunt. AI-assisted ones can be tailored to each victim.
Why old security debt is suddenly a bigger problem
Most organisations carry what security teams call "security debt": misconfigurations that never got fixed, software that should have been replaced years ago, accounts with more access than they need. Fixing these things costs money and causes disruption, so they get postponed.
AI-powered scanning can now find those weak spots continuously, at machine speed, without fatigue.
Consider ForcedLeak, a vulnerability researchers at Noma Security studied. A hidden instruction buried in a web form could trick a Salesforce AI assistant into leaking sensitive information. The attack sounded sophisticated. What it actually exploited was not: the organisation's security policy still trusted a web domain it had abandoned years earlier. Researchers registered that domain for $5. Removing it from the policy would have blocked the whole attack.
Diana Kelley, CISO at Noma Security, told CSO Online: "This was an advanced agentic attack that used indirect prompt injection, but something as simple as DNS hygiene would have prevented it."
Gene Spafford, a distinguished professor of computer science at Purdue University, calls this kind of debt "willful". Companies prioritised speed and features over careful engineering across decades, and AI is now finding every shortcut they took.
| Root cause | How AI changes it | Basic fix |
|---|---|---|
| Misconfigured sandbox | Automated scanning finds it faster | Configuration review checklists |
| Stolen or weak passwords | AI crafts more convincing phishing emails | Multifactor authentication on all accounts |
| Unpatched software | Vulnerabilities exploited before teams respond | Consistent, timely patching |
| Abandoned domains in trust lists | AI agents weaponise the stale entry | Regular DNS and policy audits |
Should you worry?
If a company you use gets breached, the attackers most likely got in through a stolen password or a software flaw, not a Hollywood AI. Watch your inbox for unexpected password-reset emails or login alerts. If a service offers two-step verification, where you confirm logins with a code sent to your phone, turn it on.
Adam Meyers, SVP of counter-adversary operations at CrowdStrike, says organisations have rushed into cloud services and remote work without keeping their security basics current, particularly around identity: knowing who is logged in, with what permissions, and whether that access is still needed. His advice for organisations: "Pull up your pants and do the fundamentals."
Shier offers a sharper image for teams tempted to skip prevention and rely on AI to catch everything after the fact: it is like a car loaded with sensors and airbags but fitted with no brakes. Detection matters. Brakes matter more.
The operational reality is this: if your patch cycle runs to months, your password policy carries exceptions, or you have not audited access since the last reorg, AI has not changed what you need to fix. It has only changed how fast those gaps get found. As we reported on 27 July, a forgotten service account at Klue let criminals walk straight in. No novel exploit required.
