How AI changed hacking

Hacker's handbook • 2 min read

Breaking into a website used to need a skilled person with time to spare. That person had to find your site, work out what it runs, look for a weakness, and write something to exploit it. Each step took effort, and effort is what kept most small sites out of the firing line. AI has removed much of that effort. The attacks are mostly the same as before. What changed is who can run them, how fast, and against how many sites at once.

What AI is good at

Reconnaissance at scale: listing a company's domains, subdomains, and exposed services, then summarising what each one runs. This was tedious work for a person. It's a routine task for software.
Finding vulnerabilities: AI systems have found real, previously unknown flaws in widely used open-source software. Reading large amounts of code and spotting the mistake is exactly the kind of work they do well.
Turning advisories into attacks: when a vulnerability is published, the advisory describes what's wrong. Researchers have shown AI agents writing working exploits from those public descriptions.
Adapting on the fly: an old script fails when a page looks slightly different. An AI agent reads the error, adjusts, and tries again.
Convincing messages: phishing emails no longer have spelling mistakes. They can be written for one person, in their language, about their actual job.

What hasn't changed

AI attackers go after the same weaknesses human attackers always did. Nearly every break-in still starts with one of a short list:

Something exposed that was never meant to be public.
Software with a known vulnerability that hasn't been updated.
A login that allows unlimited guesses or accepts a stolen password.
A file or admin page left where anyone can reach it.
A flaw in the application itself, such as injection or a missing permission check.

That's good news. You don't need a new kind of defence. You need the ordinary one, done consistently.

What it means for you

Being small is no longer protection

Most automated attacks don't pick a target. They sweep the whole internet looking for a specific weakness, and attack whatever answers. Your site isn't chosen because it's valuable. It's found because it's there.

The window is shorter

The time between a vulnerability being announced and attackers scanning for it has shrunk from weeks to days, and often to hours. Fixing things "at the next maintenance window" assumes a head start you may not have.

A yearly check describes one day

Your site changes with every deploy, and new vulnerabilities are published every day. A test that was clean in January says little about March.

How to respond

Know what you have exposed. You can't defend a server you've forgotten about.
Test continuously, not once. The attackers' tools run around the clock, so yours should too.
Hear about problems quickly. An alert on the day beats a report next quarter.
Fix the most reachable things first. Anything facing the internet comes before anything internal.
Check that the fix worked. Test again after every change.

Conclusion

AI didn't make attackers smarter than defenders. It made attacking cheap. The defence is to make checking your own site just as cheap and just as constant: use the same kind of automation, pointed at your own systems, before someone else points theirs.