Inside the Vulnpocalypse: Are autonomous AI hackers script kiddies?
For about two years, we were promised that AI would supercharge cyberattacks into something so potent humanity had never seen before. In 2025 and 2026, many started believing the doom had started, when autonomous agents stopped being a tabletop scenario and started showing up in real incident reports as the thing doing the hacking, and not just amplifying social engineering attacks.
Anthropic disrupted a Chinese state-sponsored espionage campaign tracked as GTG-1002 in which a jailbroken Claude Code ran most of an operation against roughly thirty tech, finance, chemical, and government orgs, with the company estimating the AI handled 80–90% of the work[1]. Sysdig documented what they called the first ransomware campaign driven end-to-end by a model rather than a person, nicknamed JADEPUFFER[2]. Palo Alto's Unit 42 caught an opportunistic operator who wired a model into an open-source agent framework and pointed it at 460-plus targets across several countries[3]. Someone ran an AI agent unattended inside Thailand's Ministry of Finance[4]. And in the most "we live in a simulation" entry, a low-skill operator gave Claude and Codex some vague prompts and let the agents breach 14+ companies while he…mostly just watched[5].