AI Accelerates Exploits in the Patch Gap, Not Full Cyberattacks

Snehal Antani rejects the idea that the latest frontier models amount to an autonomous “doomsday cyber device.” In his view, an attacker did not need models such as Mythos to compromise an organization, and the models look much stronger in controlled cyber ranges than they do inside production networks that are changing, actively defended, and seeded with deception.

That distinction does not mean AI has no material effect on offensive security. Antani identifies one clear capability jump: accelerating the reverse engineering of software patches. When a vendor ships a patch, attackers can compare the new binary with the prior version, identify changed code, determine which changes address security flaws, and develop exploits against the newly revealed vulnerabilities. Skilled vulnerability researchers already do this; language models can compress the work substantially.

The value to an attacker lies in the lag between a patch becoming available and an organization applying it. Antani cited a finding that 50% of CISA-known exploitable vulnerabilities remained unpatched two months after notification. In that period, an attacker that can turn a patch into a working exploit faster than defenders can deploy the patch has a target-rich window.

The response cannot be patching alone. Organizations need to patch quickly, but they also need “virtual patching”: firewall-rule changes, improved endpoint detection, or other controls that can block exploitation before a full patch can be deployed. If an attacker gets inside anyway, the decisive capabilities become containment and eradication—along with micro-segmentation, zero-trust network design, and least-privilege access.

The near-term shift, in Antani’s account, is speed around established workflows: examining changes, developing exploits, conducting reconnaissance, and applying those capabilities against organizations that have not yet closed obvious gaps. That is materially different from a model independently pointing, clicking, and draining a bank account at will.

The strongest reason for Snehal Antani’s skepticism is Horizon3’s deception research. He says expert human penetration testers clicked on security decoys 37% of the time, while the models he referred to as “4.6, 4.7, 4.8” clicked them 92% of the time. With decoys placed in particular locations, he said, those models clicked between 95% and 100% of the time.

A decoy, or honey token, is a planted artifact that looks useful to an intruder: a fake password.txt file, cloud credentials, a database dump, or a keystore containing what appears to be a login. Attackers commonly search shared drives, file systems, and internal resources after gaining access—a tactic Antani calls “living off the land.” Opening a decoy creates an alert for the defender.

Current agents inspect such artifacts unusually aggressively, he says. In one result he described, a model identified a potential decoy 90% of the time, yet clicked it 92% of the time anyway. He attributes the behavior to two limitations: frontier models have limited experience with behind-the-firewall production environments, and they tend to commit too strongly to an apparent path rather than adapting when the environment is adversarial or changing.

That makes deception a potentially important defensive advantage, but not an automatic one. A honey token is valuable only if the organization can recognize the signal, contain the intruder, and remove it through a practiced response before initial access becomes material damage.

Alex Kantrowitz frames the tension directly: if agents let attackers fire “infinite cyber bullets,” but those agents also reveal themselves by clicking decoys, how frightening is the scale-up?

Snehal Antani’s answer is that scale is real, but it applies most readily to discrete parts of expert work. In principle, Horizon3’s AI hacker could be instantiated in the thousands or hundreds of thousands without a human operating each instance. The constraint is not compute or instance count. It is whether the system has the operational knowledge and training data needed to work in the target environment.

Antani says Horizon3 did not build its system as a wrapper around frontier models because crucial cybersecurity data sits behind the firewall. The company spent years collecting a corpus of production training data for custom attack models, he says. A frontier provider that has not seen that operational data remains limited by its lack of real-world exposure, even as general-purpose models improve.

His broader claim is that the durable advantage in adversarial applications lies less in a model’s current weights than in its harness and training data. Cybersecurity, fraud, and military systems all force AI into edge cases shaped by an adversary. Recalling work at the Department of Defense’s Project Maven, Antani describes concern that corrupted training data might lead a system to mistake an aircraft-carrier group for a flock of pigeons.

For offensive work today, agents can accelerate reconnaissance: collecting public information, selecting targets, identifying technologies and architectures, and mapping possible avenues of attack. They can help inspect binary differences and support vulnerability and exploit development. An expert hacker, Antani says, gets “unlimited interns.”

The boundary is the end-to-end campaign. Connecting open-source intelligence, reconnaissance, on-the-fly exploit development, perimeter breach, internal lateral movement, and full compromise in one push-button operation remains beyond frontier models when the environment is changing and actively resisting them. Horizon3 can automate substantial activity after an initial foothold, Antani says, including finding routes to full network control without human involvement. But the full chain remains complicated even for a purpose-built offensive system.

Snehal Antani sees a separate, immediate source of exposure in the spread of AI-built applications and broadly connected agents. The problem is not only a more capable attacker. Organizations and individuals are also creating more systems with insecure defaults, weak authentication, excessive permissions, and poorly understood connections to sensitive services.

He cited research he had read claiming that 86% of tokens spent by Claude Code went toward fixing mistakes made by Claude Code, leaving roughly 14% for creating value. Antani uses that ratio to illustrate a wider concern: AI-generated software can reproduce basic engineering failures at speed.

He points to hardcoded credentials, privilege-escalation paths, and broken access controls in “vibe-coded” applications. The result is a shadow fleet of applications inside enterprises, including tools built by people who are not conventional developers and made available online without understanding whether authentication has been configured correctly. That, he says, helps explain renewed demand for application-security practices such as code scanning and black-box testing.

The more consequential issue may be the permissions granted to agents. Antani characterizes an agent as an insider threat: an entity with broad access, the ability to move quickly, and susceptibility to malicious influence.

An insider-threat program traditionally addresses an employee who has excessive access, can be manipulated or becomes malicious, and has the means to hurt an organization. Antani argues that agent security should be an extension of the same program. By the time a poorly controlled agent’s misbehavior is noticed, an organization may face both a large token bill and stolen data.

Kantrowitz illustrates the practical concern with his own use of tools connected to Gmail and Google Calendar, alongside AI-built websites and internal workflow software. The risk follows from the access and permissions an agent has been given, and from whether an organization can observe and stop its activity when it is manipulated.

Prompt injection is often discussed as an attack on a helpful, trusted agent: malicious content causes it to disregard intended guardrails or disclose sensitive data. Snehal Antani agrees that this is a real threat, but argues that it can also be turned against an attacking agent.

If an agent opens a decoy file, Antani says, the decoy can contain natural-language instructions intended to redirect it: a demand to reveal who it is, to delete attacker infrastructure, or otherwise to behave against the attacker’s interest. He calls this “reverse prompt injection”—using the attacker’s own willingness to ingest untrusted content as a defensive lever.

A defender could also make the bait expensive. Antani suggests a fake credential or password file inflated to 30 gigabytes, causing an agent to consume thousands of dollars’ worth of tokens trying to parse it. In his framing, an attacker can use prompt injection to lead a corporate agent out of its guardrails, while a defender can use it to extract information from or disrupt an attacking agent.

Alex Kantrowitz observes that this makes the contest unusually strange: it is, in large part, “English versus English.” Rather than only exploiting a code defect, the offensive or defensive move may be an artfully written instruction that changes what a model does.

Antani extends the concern to model integrity, while explicitly describing the underlying research as uncertain. He mentions a scenario in which a model could be trained with a hidden trigger phrase that induces malicious behavior, and asks whether an evaluator could reliably detect it. He compares the idea to a Manchurian candidate: a model that behaves normally until a secret phrase elicits nefarious behavior. As companies consider different frontier models, including Chinese models, he expects intentional or inadvertent training-data corruption to become a material risk that banks and other large adopters must accept and underwrite.

Snehal Antani says the deception findings changed his outlook. Before the research, he expected attackers to move toward human-out-of-the-loop operations: point, click, shoot, and fully compromise an organization. He still expects AI to make attacks worse in important ways, particularly during the patch gap and in reconnaissance. But current agents’ brittleness in adversarial environments gives defenders an opening.

Those fundamentals are detection, containment, eradication, and preparation. Teams must “train like they fight,” Antani says: they cannot learn how to handle an intrusion in the middle of one. Decoys matter only if alerts lead to a practiced response. Segmentation and least privilege matter only if they limit movement after initial access. Virtual patching matters because it can narrow the exploit window while operational teams work through a full update.

Antani positions Horizon3’s offensive-security system as a way for customers to test and improve their defenses, with a longer-term aim of creating learning loops between attack and defense. But his operational prescription does not depend on a future AI-versus-AI system. The organizations best positioned for current threats are the ones that patch promptly, deploy compensating controls where they cannot, use deception intelligently, contain intrusions quickly, and rehearse the response before an attacker forces the issue.