The unsettling thing about an AI-driven cyber crisis is how little of it may look new. A forgotten subdomain, an overprivileged software connection or a remote administration tool repurposed for intrusion could provide the opening. AI supplies the speed and persistence to exploit it.
For Ken Bagnall, co-founder and CEO of threat intelligence company Silent Push, the near-term concern is an expanding population of attackers equipped to exploit weaknesses that organisations already struggle to fix.
“The ones who weren’t good enough to be attackers are now, you know, attackers to be concerned about,” he told Deeptech Times at GovWare 2026 in Singapore.
That shifts the debate away from a single catastrophic breakthrough towards a harder operational question: can businesses close their existing security gaps faster than AI makes those gaps discoverable and exploitable?
More attackers for the same defenders
Bagnall sees an imbalance in the familiar argument that AI helps both sides. Defenders can use agents to accelerate investigations and make specialist tools accessible to less experienced analysts. But attackers gain capability too, including people previously unable to mount effective operations.
“The number of defenders hasn’t changed,” he said. The implication is that improving each analyst’s productivity may still leave security teams facing more capable adversaries and a heavier workload. Offensive capability becomes easier to acquire without a corresponding expansion in defensive staffing.
Agents also change the relationship between advice and execution. A chatbot can explain a technique; an agent connected to tools can carry out successive tasks, examine results and continue working. Human direction remains compatible with substantial machine execution.
Anthropic’s November 2025 account of an espionage campaign illustrates that distinction. The company said attackers manipulated Claude Code to target roughly 30 organisations, succeeding in a small number of cases. It estimated that AI performed 80-90 per cent of the campaign, while humans retained critical decisions. Anthropic also reported fabricated findings and overstated results. These are the provider’s findings, rather than an independently established measure of general autonomous hacking capability.
They nevertheless show why waiting for flawless, fully independent AI attackers would set the wrong threshold for concern. Imperfect systems can still lower the cost of intrusion.
IMAGE: Silent Push
Old weaknesses become scalable
Bagnall points to Silent Push’s Danglegeddon research as an example of the change in economics.
Dangling DNS records can persist after the cloud service or other resource they reference has been removed. Where an attacker can claim the abandoned resource, a trusted corporate subdomain can become an entry point for abuse.
Silent Push’s published July 2026 research describes a simulation covering 12,500 apex domains across government, banking, automotive manufacturing and pharmaceuticals. The company reported isolating 16,000 dangling subdomains and automating the takeover of 4,000. Those figures describe its research exercise, rather than evidence that AI criminals compromised 4,000 businesses.
The significance is the combination of an established weakness with agent-based workflows that accelerate discovery and exploitation. Organisations can face a material increase in exposure without a new class of vulnerability emerging.
This broadly aligns with the UK National Cyber Security Centre’s assessment that AI will increase the frequency and intensity of cyber threats through improvements to existing techniques. Its assessment also warns of a widening divide between organisations keeping pace and those left vulnerable.
For businesses, routine asset maintenance consequently becomes more urgent. An abandoned service that once escaped attention may be easier to find when discovery costs fall.
Convenience creates another opening
Enterprises are also introducing agents into their own operations, often through requests to connect assistants to email, customer databases and internal tools.
“We’ve got to be extremely careful about what API access they have into our own systems,” Bagnall said.
The underlying issue is authority. An assistant that drafts a response has a different risk profile from one permitted to retrieve confidential records, send messages or alter business systems. Each connection expands what the agent can do and what a failure could affect.
“There’s no thought from the person who wants the convenience,” he said of requests for additional access.
His criticism raises a governance question: who evaluates the cumulative permissions when individual integrations appear useful? Approving connections separately can obscure how much access a single agent eventually accumulates.
Yet Bagnall rejects the suggestion that increasingly capable AI makes safeguards futile. “I don’t think that’s true at all,” he said when challenged on whether agents would inevitably bypass protections.
His position is that familiar risks still matter, with additional exposure shaped by the access organisations choose to grant. In practical terms, that means restricting permissions, retaining approval for consequential actions and ensuring access can be withdrawn. Those controls need to govern the tools surrounding an agent, as well as the model itself.
Early warning still needs scrutiny
Bagnall is similarly sceptical of the claim that AI-powered attacks can only be countered with AI.
“If you were selling an AI security product, that would be what you would say,” he said.
Silent Push’s approach centres on identifying adversary infrastructure while it is being prepared. Bagnall says customers then use agentic workflows to query the company’s intelligence and accelerate defensive tasks.
“You have to have somebody providing the real information underneath,” he said. That proposition deserves the same scrutiny as claims about autonomous defence.
Bagnall cited an average 103 days of advance warning. Identifying suspicious infrastructure early does not establish that an attack was prevented. Infrastructure intelligence also needs complementary controls for abuse involving legitimate accounts or services.
For APAC business leaders, the credible crisis scenario is therefore cumulative: more attackers, faster exploitation and wider permissions combining with uneven defensive capacity. The immediate test is whether organisations can account for their exposed assets and control what their agents are authorised to do. AI does not need to become unstoppable for neglected security decisions to become more expensive.
