Alex Stamos, chief security officer at Cognition, says downloadable AI tools are allowing attackers to find software flaws and exploit them during attacks, lowering the skill needed to breach large companies. In a Decoder interview with The Verge, he described a succession of compromises whose consequences can spread from an AI service provider to companies using its customers’ software.
The warning is particularly relevant to organizations relying on interconnected AI services and development tools. Stamos described one alleged chain involving Fireworks and Cursor that he said exposed 5,000 companies to potential breaches, and separately said an open-source attack tool had been used against three South Korean banks and about 200 more companies during the week of the interview.
Those accounts come from Stamos, who is also a lecturer at Stanford University’s Cyber Policy Center. He said he had been helping some affected companies through Cognition, although the company is not an incident-response provider.
A breach that travels through suppliers
Stamos described October as a sustained period of pressure for security teams, citing major bugs involving PHP and Node alongside breaches at a succession of AI-related companies, including specialized cloud providers. He also cited a Binance hack, which he characterized as the largest heist in history.
His most concrete example concerned Fireworks, a provider of AI services to other companies. In his account, attackers stole API keys—credentials that allow software to access a service—from Fireworks and used them to break into Cursor. They then distributed a malicious plugin through Cursor that reached 5,000 more companies, creating 5,000 potential breaches.
The distinction matters: his account describes potential downstream compromises, rather than 5,000 confirmed successful break-ins. It also illustrates how a stolen service credential can carry an intrusion beyond the company initially breached.
Stamos attributed the broader wave to a variety of groups. He discussed government hacking organizations and criminal operators, but did not assign that entire sequence to a single actor.
Finding flaws during the attack
Stamos’s central argument is that AI is changing the order and economics of an intrusion.
Traditionally, he explained, attackers research software, discover a vulnerability and write an exploit—code that takes advantage of the flaw—before deploying it against a chosen organization or many targets. He said AI systems can now examine targets, identify bugs and write exploits while an attack is underway.
That compresses what security teams call the “kill chain”: the steps an attacker takes to achieve an objective, such as stealing information, disrupting a system or taking money. Stamos argued that open-weight models, whose model parameters are available for others to run, can now automate much of that process.
He singled out ARTEX, which he described as a Chinese open-source tool with an English translation available on GitHub. He said pairing it with a model such as an “obliterated GLM-5.3” could enable intrusions into a surprising number of organizations. His figures for the South Korean banks and roughly 200 additional companies were presented as examples of that tool’s use.
Stamos also said he had been running a quantized version of that model on his M5 Mac Ultra Studio. In his assessment, attackers’ ability to run models themselves reduces their dependence on hosted frontier models with protective controls and logs potentially available to law enforcement.
Pressure on the security industry’s assumptions
Stamos compared the present moment with the 1990s, when publicly available tools could expose weaknesses across large numbers of companies. The difference, he argued, is that far more of society now depends on internet-connected systems, while attackers can automate their work and operate from places beyond effective law-enforcement reach.
He traced the modern software-security industry to the early 2000s and Bill Gates’s “trustworthy computing” memo. Companies hired former hackers, while responsible disclosure practices, bug bounties and security consultancies developed into a multibillion-dollar industry.
That system rested partly on scarce expertise, Stamos said: relatively few people could discover difficult vulnerabilities, develop sophisticated exploit code or reverse-engineer security patches. Attack organizations also needed people to turn that research into operations. He argued that AI weakens both constraints by giving less-skilled operators access to capabilities previously concentrated among specialists. He also cited Bitcoin as an earlier change that altered criminal economics by making money laundering more accessible to technically skilled actors.
For defenders, the concrete response Stamos described was using AI tools to repair the flaws exposed by intrusions. He said Cognition has been helping some affected companies fix their bugs after attacks.
