Black hat hackers now run agent swarms.

For twenty years the thing that limited a black hat was not imagination, it was hours. Reading someone else’s code until a flaw appears, writing an exploit that survives contact with a real system, moving sideways once inside without tripping anything — all of it was skilled manual labour, and that labour is what separated a state-sponsored team from somebody working alone in a bedroom. Between November 2025 and September 2026 that gap was measured, documented by the companies whose models were being used, and largely closed. This is what actually happened, and what it means for a website that is not a state target and never will be.

The disclosures that mark the shift

Every row is a vendor or researcher disclosing misuse of their own product or a platform they monitor, which is the most reliable category of evidence available here and also the most self-selecting: these are the campaigns that were caught. Nothing in this table is a projection.

Where the risk actually sits, platform by platform

This ranks exposure, not quality. WordPress core had six vulnerabilities in all of 2025 and every one was low priority — the platform is not the problem, the thirty plugins are. A well-run WordPress site patched weekly is safer than a neglected custom application, and the row order says nothing about which one suits your business.

The offensive AI tooling that is publicly documented

Every entry comes from published threat-intelligence reporting, and most of these are legitimate red-team tools being used by people they were not written for — the Cobalt Strike pattern, repeated. Listed so the capability is legible to someone deciding what to defend, not as a recommendation: none of it is obscure and all of it is already in vendor reports.

What to fix, in the order that matters

Deliberately ordered by return rather than by sophistication. The first four cover the overwhelming majority of real-world compromises of small and mid-sized sites, and none of them requires a security specialist — they require somebody whose job it is to do them on a schedule.

The skill that stopped being scarce

An intrusion has always had the same shape: work out what the target runs, find something wrong with it, get in, take what is worth taking, and stay unnoticed long enough to finish. Every stage of that is a research problem, and research problems turned out to be what large language models are unusually good at. The offensive side noticed early, for the obvious reason — the capability that finds a flaw in order to report it is the same capability that finds a flaw in order to use it.

What changed was not that a model can write malware. That was true and unremarkable by 2023, and the output was mediocre. What changed is that a model can now be handed an objective, a set of tools and a loop, and left to work — choosing what to try next based on what the last attempt returned. That is the difference between a tool and an operator, and it reached production on the attacking side slightly before it reached production on the defending side.

The first campaign the model actually ran

On 13 November 2025, Anthropic disclosed that it had disrupted what it described as the first reported AI-orchestrated cyber espionage campaign. The group, tracked as GTG-1002 and attributed to Chinese state-sponsored actors, had built scaffolding around Claude Code that drove ordinary open-source penetration-testing tools through a full intrusion lifecycle against roughly thirty organisations — technology companies, financial institutions and government agencies.

The figure that made it a landmark is eighty to ninety per cent: the share of the tactical work the model carried out on its own. Humans chose the targets and approved the handful of moments that mattered. Everything in between — scanning, identifying weaknesses, writing exploit code, harvesting credentials, moving laterally, then sorting the stolen data by value — ran at machine tempo, in sustained bursts of multiple operations per second.

A handful of those intrusions succeeded before the accounts were shut down. The campaign matters far less for what it took than for what it proved: the whole workflow held together end to end, unattended, against real targets. Nobody outside a research lab had shown that before.

Swarms, and the three-hour breach

Anthropic’s September 2026 threat report covers December 2025 to August 2026 and reads like a catalogue of the year the technique matured. One Chinese-linked actor maintained standing agent swarms that decomposed reconnaissance into parallel sub-agents running on a schedule, producing more than a dozen possible zero-day findings in a single month. A Russian-linked operator ran monitoring agents that rewrote their own malware whenever a detection fired, iterating until it was clean. In one SaaS supply-chain compromise, agents did nearly all the work and escalated a single stolen token to full administrative control of a cloud environment in roughly three hours.

Google’s threat intelligence group published the commodity version of the same story on 8 September 2026. A financially motivated actor compromised one cloud resource, then planned, built and ran a mass credential-harvesting campaign using an agent framework driven by markdown playbooks. It rotated its own IP addresses, troubleshot its own failures, and took thousands of third-party credentials in under six hours, without a human in the loop for the duration.

Anthropic’s own one-line summary of the period is the part worth remembering, because it is a statement about economics rather than about technology: sophisticated attacks no longer require sophisticated attackers. The labour that used to separate a well-funded state programme from a lone operator with a stolen API key has been commoditised, and the two now produce comparable campaigns.

The half nobody can disrupt

Every story so far has the same quiet feature at the end of it: somebody switches the attacker off. Anthropic suspended the GTG-1002 accounts. Google disabled the Gemini assets behind PROMPTSPY. That is possible because those operators used a hosted model, which means an account, a policy and telemetry — three things that exist on the provider’s side of the connection.

A model running on the attacker’s own hardware has none of them: no provider, no policy, no logging and nothing to suspend — and the safety layer can be removed from an open-weight model by anyone who downloads it. Researchers scanning the public internet in January 2026 found 175,000 exposed Ollama hosts across 130 countries, 201 of which were already serving prompt templates written specifically to strip the guardrails out.

The usual reassurance is that local models are much weaker, and for the hardest reasoning that is still true. It is less true for the work that actually matters here — reading code until something looks wrong, writing a throwaway script, summarising the output of a scan. Those are ordinary tasks, they run acceptably on one consumer graphics card, and they are the bulk of an intrusion. The practical consequence is that the Anthropic and Google reports should be read as a floor on the problem rather than a measurement of it. They describe the attackers who chose the traceable option.

There is a second edge to this that lands much closer to home. A local model is a server. The same research found a critical flaw, CVE-2026-7482 at CVSS 9.1, exposing roughly 300,000 servers to leaking API keys, environment variables and stored conversations, and Sysdig recorded the first confirmed case of an attacker using a misconfigured Ollama server as the reasoning engine for their own attack pipeline on 12 June 2026. If anyone in your company has a model running on the office network, it belongs in the inventory and behind the firewall with everything else.

The tooling is off the shelf, and most of it is legitimate

HexStrike-AI was published by a security researcher as open-source automation for penetration testing: an MCP server that connects a language model to more than 150 existing security tools and runs them in sequence, with retry logic and error recovery so a failed step does not end the run. In the twelve hours after a set of Citrix NetScaler vulnerabilities was disclosed, Check Point watched underground forums discussing exactly how to point it at them — scanning for exposed instances, generating payloads, dropping webshells for persistence. Operators claimed it had taken weaponisation from days to under ten minutes. ShadowServer counted around 28,000 exposed endpoints when the flaw landed and about 8,000 five days later, which is both an encouraging patch rate and roughly eight thousand organisations that were still waiting.

Villager is the same idea sold as a product. Published to PyPI in July 2025 by Cyberspike, it wraps a containerised Kali Linux toolchain around DeepSeek models to orchestrate an engagement end to end, and it took 10,030 downloads in its first two months. Researchers describe it as Cobalt Strike’s AI-native successor, and that comparison is the whole argument: Cobalt Strike was written for red teams and became the most common post-exploitation framework in criminal hands. There is no reason to expect a different ending here, and the download count suggests it is already underway.

The third pattern is simply theft of compute. Between March and May 2026, honeypot sensors caught three separate operators pointing Strix and HexStrike-AI at hijacked Ollama and LiteLLM endpoints — using somebody else’s unsecured model server as the brain of the operation, and leaving them the bill. A fourth was running a coding agent under a persona built to talk it past its own refusals.

None of this is exotic, and that is the point worth taking away. It is the ordinary lifecycle of security tooling — written for defenders, equally effective for everyone else — except that the AI layer removed the skill floor that used to keep most people from using it well. The defence does not change because the attacker got a better tool. It changes because the attacker got faster, which is an argument about your patch cadence and nothing else.

The defenders moved the other way

Verizon’s 2026 Data Breach Investigations Report analysed more than 22,000 breaches across 145 countries and found that exploiting a known vulnerability is now the single most common way attackers get in — 31% of initial access, up from 20% the previous year. That is a 55% year-on-year rise in the category, and it overtook both phishing and stolen credentials to reach the top.

The remediation numbers moved in the opposite direction over the same twelve months. The median time to patch rose from 32 days to 43. The share of known-exploited vulnerabilities that actually got remediated fell from 38% to 26%. Attackers accelerated and defenders slowed down, simultaneously, and the gap between those two curves is the entire story of 2026 in one chart.

For ordinary websites the figures are more specific still. Basic web application attacks account for 10% of breaches, and by Verizon’s earlier count 88% of them involve credentials that somebody had already stolen elsewhere. Most site compromises are not clever. They are a login that should have had a passkey on it.

Five hours

Patchstack’s State of WordPress Security in 2026 counted 11,334 new vulnerabilities across the WordPress ecosystem during 2025, a 42% increase year on year. Ninety-one per cent were in plugins and nine per cent in themes. WordPress core itself accounted for six, all of them low priority. Of the total, 1,966 were high severity — a category that grew 113% in a year — and 46% had no fix available from the developer at the point of disclosure.

For a heavily targeted flaw, the median time from disclosure to mass exploitation is five hours, and roughly half of high-impact vulnerabilities are exploited within a day. No human patching process operates on that timescale. Waiting for a monthly maintenance window is, arithmetically, a decision to be exploited first and patched afterwards.

One finding in that report is worth reading twice by anyone who assumed paid meant safe: premium and freemium components produced 29% of the vulnerability reports but 76% of them were exploitable, and they carried three times as many known-exploited vulnerabilities as free ones. Patchstack also measured what hosting-level defences caught, and the answer was 26% of vulnerability attacks overall and 12% of WordPress-specific ones. Assume the rest arrives at your site.

Your website is now an input to somebody else’s agent

There is a second, stranger surface that did not exist three years ago. Agents read the web to do their work, and they cannot reliably tell the difference between content and instruction. Text hidden in a page — in HTML, in metadata, in a review, in a comment field — can be written to be read as a command by whatever assistant next summarises that page. OWASP ranks this, indirect prompt injection, as the number one risk for LLM applications, and it is no longer theoretical: Google found a 32% relative increase in malicious-category injections when it scanned the public CommonCrawl archive between November 2025 and February 2026.

The liability here is unusual, because the victim is not you. If your site accepts user-generated content — reviews, comments, profile fields, uploaded documents — then you are hosting text that somebody else’s agent will obey, and the consequences land on their side of the fence. It is worth understanding before agents are doing the buying on your site as well; how AI agents buy things covers that half.

Which platforms are safest, and which are not

The honest answer is that there is no secure platform, only two variables that actually predict whether you get compromised: how much of somebody else’s code executes on your server with your database privileges, and how quickly it gets patched when that code turns out to be wrong. Every row in the platform table above is a different answer to those two questions, and nothing else about a platform matters nearly as much.

WordPress is not insecure — WordPress core had six low-priority vulnerabilities in all of 2025 — but the thirty plugins on top of it are where 91% of the ecosystem’s flaws live, each running with full access to your database. That is a configuration problem rather than a platform problem, and it is fixable: fewer plugins, automatic updates on, and a maintenance slot that is somebody’s actual job. WordPress or a headless CMS is the longer version of that decision.

At the exposed end, self-hosted Magento and Adobe Commerce have the worst structural position on the web, and there is a live example running as this is written. StyleSmuggler, CVE-2026-75650, is a remote code execution flaw with the maximum CVSS score of 10.0. Sansec confirmed exploitation beginning on 4 September 2026; Adobe’s emergency hotfix landed on the 7th. That is three days of a maximum-severity, unauthenticated flaw being actively used against a platform that holds payment flows, and every store that was not patched within hours of the hotfix spent that week hoping.

At the safe end the reasoning is almost boring. A static or pre-rendered site served from a CDN has no database on the public origin, no admin login to brute-force and no plugin executing at request time, so most of the attack classes above simply have nowhere to land — why we build with Next.js is partly this argument. Managed SaaS platforms are nearly as good for a different reason: the vendor patches centrally, for everyone, usually within hours, which is the only response fast enough for a five-hour window. What you give up is control, and what you keep is the risk in your apps, your theme scripts and your staff logins.

What to actually do about it

The fix list above is ordered by return rather than by sophistication, and the striking thing about it is how little of it is security work in the specialist sense. Phishing-resistant MFA, a short patch cycle, fewer moving parts and backups that have been restored from once will prevent the overwhelming majority of real compromises of a normal business website. None of it requires a consultant. It requires somebody whose job it is to do these things on a schedule, which is precisely what a maintenance retainer buys.

Credentials deserve the top slot because the numbers are lopsided. Microsoft measures phishing-resistant MFA as stopping over 99% of identity attacks, while SMS codes and one-time passcodes are now routinely bypassed by attackers who already hold the password. Passkeys are no longer exotic — the FIDO Alliance counts 48% of the top hundred websites as supporting them and Google reports more than 800 million accounts signing in that way. Turning them on for your admin, host, registrar and DNS accounts is an afternoon that removes an entire category of risk.

The last row is the one most likely to be ignored. If any part of your site was written with AI assistance — and by 2026 most of it somewhere is — it needs reviewing on the parts that handle input, authentication and data access, because 45% of AI-generated samples carry an OWASP Top 10 flaw. The tools are not the problem and we use them daily. The absence of a reviewer is.

Where to start if this is a lot

Start with an inventory, because almost nobody has one. What is running on the server, what version is it, when was it last updated, who can log in, and which third parties hold a key. That list alone usually answers the question of what to do first, and it is frequently the first time anyone has written down how many plugins or integrations have accumulated over five years.

From there, the sequence is the table: credentials, patch cadence, surface reduction, backups. If you would rather not assemble that yourself, a technical audit produces exactly that inventory and the prioritised fix list that follows from it, in plain language rather than a scanner dump. Either way, the thing worth internalising from this year is that the window has closed from weeks to hours, and any plan that assumes you will notice in time no longer holds.

Sources

Checked September 2026. Primary vendor and researcher disclosures wherever a figure comes from one — see each table footnote for what the numbers do and do not measure.

• Anthropic — Disrupting the first reported AI-orchestrated cyber espionage campaign ↗

  The GTG-1002 campaign disclosed on 13 November 2025: roughly 30 targeted organisations, 80–90% of tactical work performed by the model, sustained rates of multiple operations per second.

• Anthropic — Countering misuse of AI: September 2026 ↗

  December 2025 to August 2026 across seven harm categories: agent swarms, a three-hour escalation from one stolen token to full cloud administration, and the conclusion that sophisticated attacks no longer require sophisticated attackers.

• Google Cloud — Adversaries leverage AI for vulnerability exploitation, augmented operations and initial access ↗

  GTIG, 12 May 2026. The first zero-day believed to have been developed with AI, the PROMPTSPY and PROMPTFLUX malware families, and the TeamPCP supply-chain compromise of Trivy, Checkmarx and LiteLLM in late March 2026.

• The Hacker News — Autonomous AI agents compromise thousands of credentials in under six hours ↗

  Coverage of the Google Threat Intelligence Group disclosure of 8 September 2026, including the SANDCLOCK and DUSTMAKER stealers delivered through PyPI, npm and Docker Hub.

• Verizon — 2026 Data Breach Investigations Report ↗

  Over 22,000 breaches across 145 countries: vulnerability exploitation at 31% of initial access, median time to patch up from 32 to 43 days, known-exploited remediation down from 38% to 26%.

• Patchstack — State of WordPress Security in 2026 ↗

  11,334 new ecosystem vulnerabilities in 2025 (+42%), 91% in plugins and six in core, a five-hour median to mass exploitation, 46% with no fix at disclosure, and hosting defences blocking 12% of WordPress-specific attacks.

• Sansec — StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) ↗

  CVSS 10.0, affecting versions 2.4.4 to 2.4.9. Exploitation confirmed from 4 September 2026; Adobe’s emergency hotfix released on 7 September 2026.

• Check Point Research — HexStrike-AI: when LLMs meet zero-day exploitation ↗

  The Citrix NetScaler case: underground forum activity within twelve hours of disclosure, and the claim that weaponisation fell from days to under ten minutes.

• Straiker — Cyberspike Villager: Cobalt Strike’s AI-native successor ↗

  Villager on PyPI from July 2025 — containerised Kali tooling driven by DeepSeek models, 10,030 downloads in two months, and the dual-use argument for why that matters.

• The Hacker News — Researchers find 175,000 publicly exposed Ollama AI servers across 130 countries ↗

  The scale of unmanaged local-model infrastructure, including the 201 hosts serving guardrail-stripping prompt templates and the CVE-2026-7482 exposure.

• Zenity Labs — Bring your own agent: hijacking exposed AI backends to power offensive operations ↗

  Honeypot data from March to May 2026 showing Strix and HexStrike-AI run against hijacked Ollama and LiteLLM endpoints, plus a coding agent carrying a refusal-suppressing persona.

• Help Net Security — Indirect prompt injection is taking hold in the wild ↗

  Google’s scan of the public CommonCrawl archive finding a 32% relative increase in malicious-category prompt injections between November 2025 and February 2026.