AI-powered cyberattacks are on the rise

The entire industry as well as many vendors of security products are continually researching the field of AI-powered malware and agentic AI attacks. Some of their findings include:

• In 2025, CrowdStrike observed that the number of agentic AI attacks had increased by 89 percent.
• The role of AI is transforming from helper to that of active operator: Check Point reports that AI is undergoing a transformation from an assisting digital planner into an active operator of live cyberattacks in 2026.
• It is becoming easier to develop malware. Anthropic released a report analyzing 832 accounts that were banned due to malicious activity. 67.3 percent leveraged AI to write the malicious code or prepare the cyberattacks.

The incidence of exploits is accelerating

Published in 2026 by the UK Department of Science, Innovation and Technology, the International AI Safety Report found that AI is accelerating the search for vulnerabilities and the creation of exploit codes. The scientific review was overseen by a panel of more than 100 AI experts from more than 30 countries. It represents the largest international collaboration on AI safety research to date. For example, the experts reported on a competition in which an AI agent identified 77 percent of the vulnerabilities present in real software and for which it wrote the malicious code. Many cybercrime syndicates and state-sponsored groups actively use AI for their operations, which was also indicated in the international report.

However, AI can be utilized for more than just attacks, it can also be put to work in defending systems. For this reason, many vendors of security products rely on AI systems to improve detection of malware and cyberattacks and AI-generated phishing. As proof that it can work, the regular detection tests in the AV-TEST labs show how the different security packages and solutions for Windows, Mac and Android stand up to the latest malware samples.

Security solutions keeping AI-generated malware samples at bay

Security vendors are implementing internal security modules, which are supported or even powered by AI, in their solutions to complement the standard detection systems. But are these security products really able to fend off the latest threats? The live tests and 10 real-world attacks for each product, including the latest attack scenarios, demonstrate the capabilities of these products. The experts analyze how each phase of an attack of a recent malware sample progresses under Windows in these Advanced Threat Protection tests – or ATP tests, for short. If a security product or endpoint solution fails to detect an attack in the first phase, the internal analytic and security modules need to be triggered. The tests show that the vendors’ products are generally highly capable of fending off the attackers.

Looking toward the future

The recent increase in cyberattacks cannot always be directly attributed to the use of AI. However, the speed and scale at which these attacks occur indicate a connection to AI. In addition, less technically inclined actors are increasingly receiving access to a set of professional tools, through which they can further increase the number of autonomous cyberattacks.

Even if ChatGPT, Anthropic and Gemini make it difficult to write malware using their respective AI system, or if they ban it entirely, there are still countless offers on the dark web that explicitly allow this and some that even provide access to entire libraries of code.

“It’s a neck-and-neck race between cyberattackers and security vendors at times and AI will add a new dynamic in the pace of this development,” explains Erik Heyland, Head of Testing Labs at AV-TEST.