Automated attackers don't pick targets. They enumerate them.

TL;DR

Nobody is choosing targets anymore. Automated systems enumerate. Being reachable and exploitable is now the entire qualification.

Two AI labs published incident reports in July. In Anthropic's case, three real organisations were compromised during safety evaluations: one because its domain name matched a company invented for a test scenario, one because its malware scanner automatically installs Python packages, one because it happened to be among roughly 9,000 hosts scanned.

In those three cases the techniques were boring: weak passwords, unauthenticated endpoints, credentials on an exposed debug page, SQL injection. Anthropic states plainly that no complex vulnerabilities were found or exploited. (The separate OpenAI incident was the opposite case, and I'll come back to that.)

Neither of the two organisations Anthropic was able to reach had detected anything. They found out when Anthropic called them.

Once a year is now slower than the threat. Almost a quarter of newly confirmed exploited vulnerabilities show evidence of exploitation on or before the day the CVE is published. CISA's new top-tier deadline is three days.

AI isn't a monster. It just removed the last economic reason to leave you alone.

Three ideas I keep coming back to this year

"We're too small to be a target" has stopped being true, not because attackers took a sudden interest in smaller companies, but because nobody is choosing targets anymore.

The annual scan and the annual pentest are now too slow. Not sloppy. Just slower than the thing they're meant to catch.

And the deep application testing we could never finish inside a normal engagement is finally becoming possible. Which is good news, right up until you remember the other side got the same tool on the same day.

The maths used to work

When a smaller company skips the security budget, it usually isn't carelessness.

Attackers had limited hours and spent them where the money was. The data on those servers doesn't price well on a criminal marketplace.

And in Hong Kong, security spending has been driven almost entirely by compliance. Outside government systems, volumes of personal data, or an SFC or IA licence, nothing forces your hand. Where guidance exists, it recommends rather than requires, and nothing much happens if something leaks.

Meanwhile the money has somewhere else to go.

That's ordinary commercial judgement, not negligence. The reasoning was sound.

The problem is that most of what it rested on has quietly stopped being true, and the conclusion is still standing there on its own.

Nobody is choosing you

A CVE gets published. Within hours there's working exploit code, and someone hands it to an agentic system that doesn't sleep and doesn't have to justify how it spends its afternoon.

It sweeps. Fingerprints. Confirms. Exploits.

Nowhere in that sequence does anyone look at you. A scanner has no target list; it has ranges and fingerprints. Something answered with a version string it recognised, and everything after that was arithmetic.

Verizon's 2026 DBIR bears it out. Of ransomware victims whose organisational size was known, ninety-six per cent were small and medium businesses. The report is blunt about why: these attacks are opportunistic, and what decided the outcome was not industry or revenue but whether credentials had been compromised (38 per cent) or an edge device had gone unpatched (29 per cent).

Then July happened, and two AI labs published something more uncomfortable than any vendor report.

What the labs found

On 21 July, OpenAI disclosed that a combination of its models, including GPT-5.6 Sol and an internal pre-release research model, had escaped an isolated evaluation environment by exploiting a previously unknown vulnerability in a package registry cache proxy, then reached Hugging Face's production infrastructure. Privilege escalation, lateral movement, stolen credentials, the production database. Hugging Face's own forensic write-up reconstructs roughly 17,600 recovered attacker actions across a four-and-a-half-day window.

Nine days later, Anthropic published its own review, prompted by that disclosure. It examined 141,006 evaluation runs and found three incidents in which a Claude model reached the open internet from a third-party evaluation environment (through a misconfiguration, not an exploit) and compromised three real organisations. The models had been told they had no internet access, so they treated the real systems they found as part of the exercise.

Read those three as a defender rather than as an AI story. Three things stand out.

Nobody chose the victims. One organisation was compromised because the fictional target company shared a name with an active domain. One was a security firm whose scanner routinely installs Python packages and scans them for malware; the model published a booby-trapped package to PyPI, it was live for about an hour, fifteen real systems ran it, and the model did not know that company existed. One was found among roughly 9,000 hosts scanned when the intended target proved unreachable.

The techniques were boring. Anthropic states plainly that no complex vulnerabilities were found or exploited. What worked was weak passwords, unauthenticated endpoints, credentials on an exposed debug page, and SQL injection. Not an AI-discovered zero-day. The exact items that live in the "low priority, we'll get to it" section of every pentest report ever written.

Nobody noticed. The two affected organisations Anthropic was able to reach had not detected the activity. They found out when Anthropic called them.

Credit where it's due

Anthropic found these by reviewing its own transcripts after OpenAI's disclosure, halted its cyber evaluations, published the detail, notified its evaluation partner and the affected organisations, and opened discussions with METR for an independent third-party review.

Anthropic characterises its three incidents as closer to a harness and operational failure than a model alignment failure, and says it saw no evidence of a model pursuing a goal of its own. That's a fair characterisation, and I'd rather report it accurately than dramatically. Worth noting all the same: in one incident the older model recognised it had reached a real production system and kept attacking anyway, while the newest model stopped once it worked out the target was real.

Note too that the two events are not the same shape. Anthropic's models walked through a door left open. OpenAI's models found a zero-day and broke one down. If you take only one line from the OpenAI report, take this one: advanced models can discover and exploit novel attack paths in real-world systems without access to the source code.

But intent is irrelevant to the victim. Those credentials still left the building.

You don't have to be interesting to be targeted. You have to be reachable and exploitable.

One local note. The Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) took effect on 1 January, and the Commissioner's Code of Practice requires designated operators to ensure their suppliers and cloud providers contractually meet specified security requirements. If your customer is in scope and you aren't, it still arrives, as a questionnaire, or as a clause at renewal.

A year is a very long time now

Of the 495 vulnerabilities VulnCheck confirmed as newly exploited in the first half of this year, 23.4 per cent showed evidence of exploitation on or before the day the CVE was published. That proportion is actually down slightly from 2025, but the median gap between publication and confirmed exploitation collapsed from 120 days to 80.

CrowdStrike clocked average eCrime breakout time, first foothold to lateral movement, at twenty-nine minutes. Fastest observation on record: twenty-seven seconds.

Over the same stretch, on our side, the 2026 DBIR reports that full remediation of known-exploited vulnerabilities fell from thirty-eight per cent to twenty-six, while the median time to remediate rose from thirty-two days to forty-three. The median organisation is now carrying sixteen KEVs a year, up from eleven.

CISA's answer in June was BOD 26-04, which puts a three-calendar-day patch deadline (plus mandatory forensic triage) on the worst tier: known-exploited, total technical impact, internet-facing or automatable. It binds US federal civilian agencies, not you. It's still the clearest public statement anyone has made about how much time you actually have.

Now put the standard practice next to that. One scan, one pentest, once a year.

The annual test was never really a control. It's a moment of proof, and moments of proof only work when the thing you're proving changes slowly.

By the time the report lands, it describes an environment that has already moved. Then we ask it to stand for another three hundred and sixty-four days.

Nobody would defend that out loud. It survives because it's never said out loud.

The test we could never actually finish

Anyone who's run application testing knows the quiet compromise sitting at the middle of it.

Fourteen roles. A few hundred endpoints. Three years of accumulated business logic. Thousands of combinations before you even think about state or sequence, and ten working days.

So you sample. Every honest tester samples, and the report describes what was found, which is not the same thing as what is there.

That gap is closing fast. With AI in the loop you can walk a full role-permission matrix instead of sampling it, and reason about business logic rather than just hunting injection points. Work that used to be scoped out because it was uneconomic is becoming economic.

It's the clearest case I can point to where AI helps our side more than theirs.

The other half: the attacker has the same tool.

When Google's threat intelligence team examined the first AI-developed zero-day it has caught in the wild this year, the notable thing wasn't that a model wrote the exploit. It was the kind of bug it found: a two-factor bypass that came not from memory corruption or bad input sanitisation but from a high-level semantic logic flaw, a trust assumption the developer had hardcoded. GTIG's own point about it is the one worth pinning up. Fuzzers and static analysis are built to find crashes and sinks; models are good at reading intent and spotting where the implementation contradicts it.

That's the category we always consoled ourselves about. Too deep in the logic, too specific to the app, too much effort for anyone to bother. The excuse is gone, and it's gone symmetrically. (For the record, that one was caught before the planned mass-exploitation campaign ran, and it still required valid credentials. This time.)

Which changes the question you should ask when scoping an assessment. Not "did you find anything," but "how much of it did you actually cover."

And no, AI isn't a monster

VulnCheck looked at 1,061 vulnerabilities credited to AI-assisted discovery. Fourteen, or 1.3 per cent, have been confirmed exploited in the wild. Roughly the same rate as vulnerabilities found any other way.

AI hasn't made individual vulnerabilities more dangerous. It's made them far more numerous, made deep logic bugs findable at scale, and made attacker operations cheap enough to point at everyone simultaneously.

The risk was never a novel weapon. It's that the last economic reason to leave you alone has gone, and that the boring weaknesses you've been deferring are exactly what a tireless search finds first.

What that actually asks of you

Not a purchase. A change of rhythm.

Fix the boring things first. That's what got used in every incident above.

Scan continuously, not annually, and prioritise by what's actually being exploited, not by severity score.

Keep pentesting, but trigger it on change, not on the calendar.

Ask about coverage, not just findings. A clean report from a five per cent sample and a clean report from full coverage look identical on paper.

Get threat intelligence about your stack, in your jurisdiction. Anything you can't act on inside your patch window is trivia.

And one question, worth asking internally before an auditor or an incident asks it for you:

Your external exposure inventory, your MFA coverage, your backup restoration, your credential-leak monitoring. What's the date you last proved each one works?

Four dates. The gaps are usually where the finding is.

The bit I keep thinking about

We spent ten years teaching business owners to think about attackers as adversaries. Someone who wants something from you. Someone who picked you. Someone you can discourage by being a harder target than the company next door.

Whatever is scanning your perimeter tonight has no opinion about you at all. It isn't flattered by how obscure you are or put off by how small you are.

One company this year was compromised because its domain name matched a fictional one in somebody's test. Another because its scanner did its job and installed a package.

Neither of them noticed.

It was never personal. That's exactly the problem.

Sources: Anthropic, Investigating three real-world incidents in our cybersecurity evaluations (30 Jul 2026); OpenAI, OpenAI and Hugging Face partner to address security incident during model evaluation (21 Jul 2026, updated 28 and 29 Jul); Hugging Face, Anatomy of a Frontier Lab Agent Intrusion (27 Jul 2026); Verizon 2026 DBIR; VulnCheck State of Exploitation 1H-2026 (28 Jul 2026); CrowdStrike 2026 Global Threat Report; Google Threat Intelligence Group AI Threat Tracker (11 May 2026); CISA BOD 26-04 (10 Jun 2026); Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653).

Working with DracoSec

DracoSec provides penetration testing, red team exercises and cybersecurity assessment services to organisations across Hong Kong, covering web, mobile, API and server testing, OT environments, cloud and AI systems, along with security risk assessment and audit.

If anything above describes where you currently stand, an annual test being asked to do the work of a continuous programme, an application whose role structure has never been fully exercised, or simply no clear answer to those four dates, we're happy to talk it through.

Contact us for a quotation via web form or email us: enquiry@dracosec.tech