AI puts cyberattacks into overdrive: Sophos report

Artificial intelligence is helping cybercriminals carry out cyberattacks faster and with greater coordination, significantly shrinking the time available for organisations to detect and contain threats, according to a new report by cybersecurity firm Sophos.

Sophos’ “AI Security 2026” report says attackers are largely relying on established cyberattack techniques, but AI is making those operations faster, more automated and more coordinated. As a result, attacks that once took weeks to develop and execute can now be completed within days.

The report identifies enterprise AI systems—including identities, authentication tokens, AI agents, APIs and development tools—as increasingly attractive targets for attackers. The growing use of AI in social engineering and deepfake technology is also making scams and impersonation attempts more convincing.

Sophos said it identified an attack campaign, tracked as STAC 6994, in which attackers used about 12 AI agents to test techniques against different security controls. The group developed nearly 80 modules and more than 70 evasion techniques. Sophos’ analysis found that tasks that could take human operators weeks were completed in just days with AI assistance.

The report also warns that the rapid spread of coding agents, AI assistants and open-weight models is creating new security risks. If these technologies gain access to critical systems, attackers could potentially obtain credentials, access permissions, authentication connections and API keys.

Development tools, model weights, training data, AI infrastructure and software supply chains are also emerging as potential attack surfaces, Sophos said.

The company stressed that AI security should not focus solely on protecting AI models. Organisations must also strengthen identity management, governance, access controls and supply-chain security to address the broader risks created by AI-enabled attacks.

The AI Security 2026 report draws on Sophos’ research and monitoring systems as well as data from more than 625,000 customers, according to the company.