# Alex Stamos says AI has flipped the hacker kill chain, and security is entering a "dark age"

> Cognition's security chief describes chained breaches from Fireworks to Cursor to 5,000 companies, and a downloadable Chinese tool that finds and exploits bugs in real time.

- URL: https://devisdead.ai/news/alex-stamos-says-ai-has-flipped-the-hacker-kill-chain-and-security-is-entering-a
- Published: 2026-11-08T23:22:51Z
- Author: DevIsDead Newsroom
- Section: AI
- Tags: cybersecurity, alex stamos, open weights, breaches
- Originally reported by The Verge (https://www.theverge.com/podcast/1029038/ai-cybersecurity-hackers-data-breach-dark-age-alex-stamos).

If security teams sound exhausted lately, Alex Stamos says there's a reason. The chief security officer at Cognition and Stanford lecturer told Nilay Patel on [The Verge's Decoder](https://www.theverge.com/podcast/1029038/ai-cybersecurity-hackers-data-breach-dark-age-alex-stamos) that AI has put the industry on something like permanent emergency footing, and that we're in for a rough stretch before things improve.

## What's been happening

Stamos pointed to a run of incidents: big bugs in PHP and Node, a string of breached neoclouds, a Binance heist he called the largest in history, and chained attacks. In one chain, API keys stolen from AI provider Fireworks were used to break into Cursor; from there attackers pushed a malicious plugin that reached 5,000 more companies. He described it as a continuous breach across the tech industry, and said fellow security chiefs have been at "DEFCON 2" since October.

## The inverted kill chain

His core point is how attacks now work. Traditionally, attackers researched software, found a bug and wrote exploits in advance, then deployed them. Now, he says, open-weight models are good enough to automate most of the kill chain: an AI system looks at a target, finds bugs and writes exploits on the spot.

The tool everyone is talking about, he says, is ARTEX, a Chinese open-source project with an English translation on GitHub. Paired with an "abliterated" GLM-5.3, a version with safety training removed, it lets people break into a shocking number of organizations. It hit three South Korean banks first, and about 200 more companies this week. Not since the 1990s, he says, could you download a free tool and break into billion-dollar companies.

## Not doom, but dark

Stamos isn't a long-term doomer. He compares the moment to the early, chaotic days of the always-online internet and expects defenses to adapt. But he expects a "dark age" first.

This matches the [Vals test results](/news/free-chinese-ai-models-now-hack-almost-as-well-as-the-locked-up-frontier-ones-a-t) showing free models closing in on gated ones. For developers, the practical steps are familiar but urgent: rotate and scope API keys, treat plugins and extensions as supply chain risk, and assume your dependencies are being scanned by an AI right now.

**[Scoreboard](/scoreboard) update:** AI +1. AI turns finding bugs and writing exploits into a single automated loop.

Stay undead.