AI attacks are hitting in seconds, and traditional security operations are failing. What should we do?

On Friday afternoon, the industry peer group you are in suddenly becomes active.

A peer sends a message:

A new attack method is spreading, and peer companies have already fallen victim. An intelligence briefing is attached.

You confirm the intelligence is valid and immediately initiate a response: compiling a summary, finding the technical director to assess the impact scope, discussing validation rules, writing a proposal, submitting a work order for approval, waiting for approval, and deploying.

The problem is, the technical director is traveling out of town, and approval will have to wait until next Monday.

At this moment, another message comes in the group—another friendly competitor has already experienced a compromise case.

The rules haven't been deployed yet, the validation hasn't finished running, and nobody can say for sure whether the defensive line will be effective over the weekend. All you can do is urgently push for approval, while reminding the team in the group to keep a closer eye on things.

The problem is not that the process wasn't executed, but that the speed of the process has already exceeded the window left for you by the threat.

And a recent event has made this window even narrower.

01

Attackers Have Already Changed Their Strategy

In May 2026, two events happened in quick succession, causing discussions in the security circle to heat up suddenly.

Google Threat Intelligence Group (GTIG) disclosed a real attack incident. Leveraging AI models, attackers discovered a logical vulnerability—two-factor authentication bypass—in a widely used open-source Web management tool that had never been noticed by anyone before. Subsequently, the AI automatically generated a complete exploit script, which attackers planned to use to launch a large-scale intrusion campaign.

GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access

When analyzing this exploit code, researchers noticed an unusual characteristic: every function in the code had detailed, tutorial-style comments, along with a CVSS score that couldn't be found in any official vulnerability database—it was generated out of thin air by AI. This code didn't look like it was written by an experienced hacker; it looked more like a complete set of teaching materials.

The research team confirmed that this was the first time they had discovered a zero-day exploit developed by AI in actual combat. The team's chief analyst said bluntly after the report was released:

"This is just the tip of the iceberg. For every AI-generated zero-day vulnerability we trace back to, there are likely many more undiscovered cases behind it."

The second event was equally alarming. When testing Anthropic's early AI model, Mythos, an attack path bypassing Apple's most advanced security protection was discovered. Researchers chained two macOS vulnerabilities with multiple techniques to successfully compromise Mac's memory protection mechanism, gaining system privileges that should not have been accessible. This exploit code, completed with the help of AI, took only five days to build.

However, Apple had invested five whole years into this, once proudly calling this hardware-level security mechanism "the culmination of unprecedented design and engineering achievements."

Putting the two events together points to the same conclusion: AI is drastically compressing the time for vulnerability discovery and exploitation. As shown in the figure below, what used to take top experts weeks to complete can now be achieved within days, hours, or even minutes.

The attack-side pipeline is accelerating. The defense-side pipeline remains the same.

02

AI Attacks Entering the Scale of Seconds: What Should We Do?

Where the root of the problem lies is worth clarifying first.

The reason the security operations pipeline is slow is not because the team isn't working hard, but because this pipeline was designed from the beginning to rely on human chaining. The person reading intelligence, the person judging relevance, the person configuring validation scenarios, the person analyzing results, the person generating rules—every step requires professional judgment, and every judgment requires waiting. This design was sufficient in an era when threats evolved slowly, but it is no longer enough today.

There is another layer of the problem that is often ignored, which is the silo of capability caused by professional barriers.

To do security validation well, operators need to simultaneously understand attack principles, the detection logic of defensive products, and the actual conditions of their own environment. These three things combined constitute a very high professional barrier. A high barrier means very few people can actually drive the platform's operation; few people mean that once core personnel leave or are absent, the entire validation capability will grind to a halt.

Many companies have purchased various platforms, but ultimately their daily utilization is extremely low, degrading into compliance exhibition props. The fundamental reason lies here—it's not that the platform isn't good enough, but that there are too few people who can master it.

The compounding of these two issues creates a structural dilemma: information on the intelligence side is updated faster and faster, while the response pipeline on the defense side remains constrained by human bottlenecks. The gap between the two will not automatically narrow just by purchasing more tools.

To truly solve this problem, what needs to change is not the tools themselves, but the way the pipeline is driven.

We can see that a new way of thinking is emerging in the security circle: let AI chain this pipeline, rather than humans.

The parsing of intelligence, the orchestration of scenarios, the execution of validation, and the generation of rules—these steps are essentially structured information processing, and AI has the capability to replace a large number of manual operations within them. Human value should be concentrated on judgment and decision-making, rather than being consumed in the transmission of processes and waiting.

When this pipeline is driven by AI, all it takes to trigger a complete security validation response is a single sentence.

Behind this lies the architecture design of Multi-Agent. Simply put, it decomposes the functions originally undertaken by different people in the security operations pipeline into multiple specialized Agents working collaboratively: some Agents are responsible for continuously monitoring threat intelligence sources, some are responsible for parsing unstructured reports to extract attack tactics, some are responsible for mapping tactics into executable validation playbooks, and some are responsible for analyzing validation results and generating detection rules.

Each Agent focuses on its own step, unified and dispatched by the AI brain, and the entire pipeline automatically closes in the background.

The core value of this architecture is not just speed, but the transfer of the professional barrier from "humans" to the "system". What used to require experts who understood attacks, products, and environments simultaneously to drive can now be triggered with a single sentence.

The Cyri AI Intelligent Brain of SecX Intelligent is built exactly on this logic.

Returning to the scenario at the beginning. As soon as new threat intelligence arrives, you say to Cyri AI: "Read the latest threat report, extract TTPs, and validate the coverage of our current defense system."

No further actions are needed after that. The Multi-Agent system behind Cyri AI begins to operate automatically:

1. Continuously monitor threat intelligence sources, parse unstructured reports, and extract core TTPs;

2. Map TTPs to the ATT&CK framework, automatically generate validation playbooks, execute validation in a protected sandbox environment, and return security product alert logs in real time;

3. Automatically convert undetected results into detection rules that can be directly deployed to SIEM/SOC.

4. From intelligence to rules, the entire pipeline is closed. No need to wait for people, no need to coordinate, no need to go through approval processes.

We call this mode of operation "Conversation as Operations" (CaO), making the front-end effortless while the back-end moves mountains.

The role of humans in this pipeline changes from "executors" to "decision-makers"—you decide what to validate, and Cyri AI is responsible for running it and bringing the conclusions to you. Professional barriers are no longer bottlenecks, and response speed is no longer constrained by team size.

03

Not Much Time Left for Manual Response

The AI-fication of the attack side has already landed. This is not a warning; it is an already occurred fact.

The same alert, the same security team—the only difference is whether the response starts after completing days of approval processes, or right after that sentence is spoken.

The window left for defenders is getting narrower and narrower. Conversation as Operations is what we can do before this window completely closes.

Reference Sources:

GTIG Official Report, GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access, 11 May 2026;

MSN, Apple’s security has been tough to crack. Mythos helped find a way in., 14 May 2026;

Anquan Neican, Discovered for the First Time! AI Generates Zero-Day Vulnerability Exploit Tools and Conducts Cyber Attacks, 12 May 2026;

Sina Finance, Google Claims It First Discovered Hackers Using AI to Develop "Zero-Day" Vulnerability Exploit Tools, 12 May 2026