An annual review from Verizon, covering more than 31,000 security incidents, shows a shift in the initial vectors for data breaches: vulnerabilities identified or exploited with AI now outnumber cases that began with stolen credentials.
According to the report, 31% of all breaches began with exploitation of vulnerabilities in what the authors describe as an AI-influenced environment. Verizon cautioned that threat actors are employing AI "to accelerate the time to exploit known vulnerabilities, shrinking the window for defense from months to mere hours."
The report details how hackers are leveraging generative AI across the stages of an attack. It notes that AI is being applied to tasks including targeting, gaining initial access, and assisting in the development of malware and other attack tools. While these applications are widening the scale and speed of activity, Verizon characterizes AI’s main effect so far as operational: it automates and scales attack techniques that defenders already know how to detect, rather than immediately creating fundamentally new types of attack surfaces.
However, the authors add a caveat: that assessment may quickly become outdated as AI capabilities continue to advance. The report found that threat actors typically researched or used AI assistance in 15 different techniques, with some actors employing as many as 50 techniques aided by AI.
The report explicitly excludes data related to Mythos, a recently announced AI model. Mythos, disclosed on April 7, is being made available in a controlled way under Anthropic’s Project Glasswing - a limited program that allows select organizations to use an unreleased Claude Mythos Preview model for defensive cybersecurity work. Verizon is among organizations permitted to operate under that controlled initiative.
Security experts cited in the report warn that Mythos’s advanced coding ability gives it an uncommon capacity to both identify vulnerabilities and suggest ways to exploit them, creating potential new risks even as the model is being trialed for defense.
Verizon’s chief information security officer, Nasrin Rezai, stressed the urgency of adopting AI for defensive purposes. "We need to fight AI with AI. We need to incorporate them into our practices," Rezai said. "We need to bring them into our software development life cycle, in our testing processes, in our cyber defense processes at a scale that we have never done before."
The report’s findings spotlight how generative AI is being used to compress attackers’ timelines and to scale familiar techniques, while also flagging an unresolved question about future attack surfaces as AI models grow more capable. The exclusion of Mythos-related data from the report further underscores an area of active concern and monitoring, given the model’s purported coding strengths and the controlled nature of its current deployments.