SafetyRisk, alignment & guardrails
Alex Stamos says open-weight AI now automates most of the cyberattack chain after October's ARTEX intrusions
On The Verge's Decoder, Alex Stamos argues open-weight AI models are collapsing attackers' costs while defense stays expensive. October's ARTEX intrusions support the trend at a smaller scale than his on-air figures, and gated frontier models may offer limited protection.
From the The Verge · AI article of November 7, 2026 and cited sources: Stamos's central argument is economic. [1]
SOURCES[1] AI broke the cybersecurity world. What’s next? theverge.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- Stamos's central argument is economic. [1]
- Original source
- The Verge · AI article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- November 7, 2026 article published
- Covered
- Nov 9 edition
- Evidence
- 14 sources across 14 sites
- 1AI broke the cybersecurity world. What’s next?theverge.com
- 2Infosecurity – Project Glasswinginfosecurity-magazine.com
- 3Helix – Black Octoberhelix.ml
- 4CrowdStrike – ARTEX and South Korean financecrowdstrike.com
- 5CSA research note on ARTEXlabs.cloudsecurityalliance.org
- 6The Hacker News – ARTEX against 200+ orgsthehackernews.com
Reach: not measured yet
Stamos's central argument is economic. Open-weight models, including ones run locally outside frontier-lab logging, push attackers' marginal cost toward zero while defenders' costs stay high. He says this ends a security era built on the assumption that elite attack skills were scarce. [1]
ARTEX, an open-source multi-agent pentesting orchestrator, was linked to breaches at South Korean banks that exposed about 68,000 people's data. A China-nexus group then aimed it at more than 200 organizations in 11 days. Nine were confirmed compromised, and a human operator directed the agents throughout. [4] [5] [6]
Several of October's largest incidents relied on conventional weaknesses. Black October attackers stole AI-provider API keys from platform environment variables, a trojanized IDE extension planted SSH keys, and Stamos attributes the $6.3B Binance theft mainly to human social engineering by North Korea. [1] [3] [7] [8]
Frontier labs are restricting their most capable cyber models: Anthropic shares Mythos Preview only with Glasswing partners, and OpenAI limits GPT-6 Cyber to select customers. OpenAI reports working exploits for 948 Linux kernel vulnerabilities, a figure no one has independently replicated. Reports of an open-weight model exploiting unpatched Firefox bugs suggest gating protects less than hoped. [2] [9]
ARTEX-driven intrusions breached South Korean banks and nine of more than 200 targeted organizations.
Read the full assessment
Implication: if probing becomes near-free and constant, defenders need cheap AI log triage, key rotation and extension controls, not just faster bug-finding.
Sources are gathered and checked. Writing the dossier now.
Executive brief
The Verge's Decoder episode with Cognition CSO Alex Stamos (published Nov 7, 2026) argues that open-weight models now automate most of the attack "kill chain." Recent incidents back up the trend, though the scale is smaller than his on-air figures. CrowdStrike reports that a China-nexus group used ARTEX, an open-source agentic pentesting tool, to target more than 200 organizations. Only nine were confirmed compromised, not 200 "hit." The month also brought the largest theft on record, Binance's $6.3B loss, which Stamos himself credits mostly to human social engineering rather than AI. His central point is about cost: attackers' marginal cost is falling toward zero while defenders' costs stay high (The Verge).
What changed and event timeline
Anthropic launches Project Glasswing
Claude Mythos Preview is withheld from the public and shared with partners including AWS, Apple, Google and Microsoft. Anthropic reports thousands of high-severity bugs and kernel exploit chains ().
"Black October" hits AI developer platforms
Nine platforms, starting with Fireworks AI, were breached. Attackers took environment-variable API keys and resold them for LLMjacking. No single vulnerability links the cases ().
ARTEX tied to South Korean bank breaches
CrowdStrike linked a financially motivated actor running ARTEX on DeepSeek v4.1-flash, GLM-5.3 and Grok 4.6 to the breaches. About 68,000 people's data was exposed (;).
Vapor Panda escalates
A China-nexus group used ARTEX against more than 200 organizations in 14 or more countries over 11 days. Nine were confirmed compromised, with a human operator directing the agents ().
Binance heist and Cursor backdoor
About $6.3B was drained from Binance in roughly 20 minutes, and the FBI attributes it to North Korea (). The same day, a trojanized Claude Code extension in Cursor's marketplace planted SSH keys ().
OpenAI details GPT-6 Cyber
OpenAI says the model produced working exploits for 948 Linux kernel vulnerabilities at about $1.2M in compute. Access is limited to select customers ().
Capabilities and access
- Offensive tooling: ARTEX is an AGPL-3.0 multi-agent orchestrator released July 26, 2026.
- Defensive frontier models: Mythos Preview is restricted to Glasswing partners.
- Local models: Stamos says he runs a quantized, safety-stripped GLM-5.3 on a Mac Studio. That puts it outside frontier-lab logging (The Verge).
Read the full section
- Offensive tooling: ARTEX is an AGPL-3.0 multi-agent orchestrator released July 26, 2026. It was pulled from GitHub on Oct 8, but forks remain in circulation (CSA).
- Defensive frontier models: Mythos Preview is restricted to Glasswing partners. GPT-6 Cyber (a variant of GPT-6 Astra) is available to select "Daybreak Red" customers through the API and Codex (The Decoder).
- Local models: Stamos says he runs a quantized, safety-stripped GLM-5.3 on a Mac Studio. That puts it outside frontier-lab logging (The Verge).
Technical analysis for researchers and developers
- Architecture: ARTEX coordinates planner and worker agents that call external LLMs and security tools. One intrusion consumed about 1.4B input tokens (The Hacker News).
- Evaluation: OpenAI's pipeline scanned about 5,034 kernel locations, filtered them to 2,308 candidates and validated exploits in isolated VMs.
- Defensive design (Stamos): cheap classifiers such as TF-IDF and BERT-style models screen the logs first, then escalate alerts to small LLMs and then larger ones.
Read the full section
- Architecture: ARTEX coordinates planner and worker agents that call external LLMs and security tools. In observed intrusions it chained SAML forgery with XXE flaws, abused constrained delegation and reused unrotated credentials from 2022. One intrusion consumed about 1.4B input tokens (The Hacker News).
- Evaluation: OpenAI's pipeline scanned about 5,034 kernel locations, filtered them to 2,308 candidates and validated exploits in isolated VMs. It reports 48.5% on ExploitGym (The Decoder).
- Defensive design (Stamos): cheap classifiers such as TF-IDF and BERT-style models screen the logs first, then escalate alerts to small LLMs and then larger ones. Running full LLMs over petabytes of logs is uneconomic.
Claims and evidence
- Fireworks keys led to the Cursor breach: this is Stamos's account only.
- "5,000 companies" exposed: Cursor says at most 5,000 users received the bad update (Cursor).
- "Three Korean banks" and "200 hit": reports cite five to nine banks, and 200+ organizations targeted versus nine compromised.
Read the full section
- Fireworks keys led to the Cursor breach: this is Stamos's account only. Cursor has published no root cause, and no review links the two incidents (SafeDep; CSO Online).
- "5,000 companies" exposed: Cursor says at most 5,000 users received the bad update (Cursor).
- "Three Korean banks" and "200 hit": reports cite five to nine banks, and 200+ organizations targeted versus nine compromised.
- GLM-5.3 as the ARTEX backend: it was a supplementary model. DeepSeek was the primary one (CrowdStrike).
- GPT-6 Cyber figures: all come from OpenAI, and no independent replication has been published.
- $900 per AI-driven investigation and the "Mythos 5.1" patch wave: no corroboration is available.
Context and prior work
Stamos frames the end of the security era that began with Microsoft's Trustworthy Computing memo in the early 2000s. That era assumed elite skills were scarce and attack teams needed many operators. Previously the largest crypto theft was Bybit's $1.5B in 2025, which Binance now far exceeds (Wikipedia). TRM and Elliptic attribute Binance to North Korea's TraderTraitor unit (TRM Labs).
Limitations, safety and contested findings
- Attribution: ARTEX's Chinese origin identifies the tool, not who used it (Pillitteri).
- Autonomy: humans still directed the Vapor Panda agents, so this was not fully autonomous attacking.
- Gated access: The Decoder notes reports that an open-weight model exploited unpatched Firefox bugs. That undercuts how much protection gated releases provide.
Read the full section
- Attribution: ARTEX's Chinese origin identifies the tool, not who used it (Pillitteri).
- Autonomy: humans still directed the Vapor Panda agents, so this was not fully autonomous attacking.
- Gated access: The Decoder notes reports that an open-weight model exploited unpatched Firefox bugs. That undercuts how much protection gated releases provide.
- Misattribution risk: Stamos concedes that Binance was mainly human social engineering, which cautions against blaming AI for every incident.
Business and practitioner implications
- Rotate keys: rotate AI-provider keys stored in platform environment variables. These were the common target across Black October (Helix).
- Lock down extensions: pin and audit IDE extensions, and check
authorized_keysfor unknown entries (Cursor). - Assume constant probing: inventory internet-facing services and treat continuous automated reconnaissance as the baseline threat (CSA).
Read the full section
- Rotate keys: rotate AI-provider keys stored in platform environment variables. These were the common target across Black October (Helix).
- Lock down extensions: pin and audit IDE extensions, and check
authorized_keysfor unknown entries (Cursor). - Assume constant probing: inventory internet-facing services and treat continuous automated reconnaissance as the baseline threat (CSA).
- Rewrite over patch where warranted: Stamos argues that rewriting legacy code under test suites can be cheaper than patching thousands of bugs. He also urges investment in low-cost AI security-operations triage, not just bug finding.
The source trail.
Sources (14)
AI broke the cybersecurity world. What’s next?
Article text retrieved; extracted text may omit tables or interactive elements.
theverge.com