Artificial intelligence’s ability to detect software vulnerabilities everywhere, and fast, is turning hacking into a weapon of rapid execution.
Anthropic and OpenAI have both restricted or documented uses of their models capable of hacking systems autonomously.
Five critical vulnerabilities discovered in 2026 in Linux — the operating system used by 77% of the world’s servers — illustrate the scale of this new threat.
The year 2026 marks a turning point in the management of cyber-defence. Previously, finding a vulnerability and exploiting it was a long job reserved for experts. Take NSO, the company behind the Pegasus hacking software, which employs around a hundred full-time researchers to unearth just a handful of vulnerabilities a year, so as to be able to hack smartphones on its clients’ behalf.
Every intelligence agency faces the same problem. Hacking takes time and remains costly, with no guarantee of success.
In theory, everything is hackable. In practice, breaking into a system such as a power plant can take weeks or months — and may never succeed. If the plant has to be neutralised before the end of the week, sending a missile is the only option.
A technological break in the space of months
Recently, AI’s advances in the unsuspected field of hacking have become exponential in just a few months — to the point of making possible the fully automated hacking of any system.
These advances were unexpected, because hacking was not the aim. AI companies were above all seeking to improve programming capabilities. They realised that their coding AIs were formidable at analysing code in search of vulnerabilities. What was a chance discovery a year ago has become a very concrete threat.
Anthropic, the company behind the Claude AI, has restricted access to its latest version, Mythos, dedicated to vulnerability research. Even its more consumer-facing model, Fable, was restricted by the US government given the possibility of turning the AI against American systems.
What was a chance discovery a year ago has become a very concrete threat.
Read also: AI and war: friends or enemies?
Five critical vulnerabilities in Linux
There is nothing imaginary about these threats. The open-source Linux project is already on its fifth critical vulnerability (CVE-2026-31431, 43284, 46333, 23111, 64600), found with the help of AI since 2026. Yet Linux is the operating system behind 77% of online servers. Its code is entirely open and audited worldwide by the best experts. Normally, a critical vulnerability in Linux appears once a decade and triggers a global security problem.
The succession of five major vulnerabilities — some of them dormant for more than nine years — is an earthquake. Several are already being actively exploited.
Read also: Integrating cyber operations into modern warfare
An AI out of its sandbox
A recent episode shows the full potential of AI to hack any target quickly.
Researchers at OpenAI, another AI company — the one behind the famous ChatGPT — challenged their latest model to spot vulnerabilities in a well-known test set.
The AI was therefore in a controlled environment, with restricted internet access. Instead of solving the test set, the AI hacked the controlled environment to roam freely on the internet. It then hacked the server (which does not belong to OpenAI) from which the test set originated, in order to access the answer.
Like something out of a science-fiction film, an unauthorised AI hacked its own environment to break through its barriers. It then hacked an external server to exfiltrate data entirely autonomously — in the space of a single weekend.
Read also: Cyber operations during the Russo-Ukrainian war
Digital missiles are possible. If you want to neutralise a power plant, an AI could manage it in a matter of days.
Photo: Cyber-attacks, an ever-present danger. © Pixabay
