Frontier AI cyber capability: are defenders losing their head start?

TL;DR: Open-weight models from China are already close enough to U.S. frontier systems to support vulnerability discovery, exploit development, and autonomous attack progression, according to Tenzai research, while government and vendor testing show attackers can compress multi-stage operations into hours. The defender problem is no longer whether AI can hack, but whether a find-fix-repeat loop can move faster than an attacker’s find-exploit-repeat loop.

Editorial analysis by NHI Mgmt Group, based on content published by Tenzai: “You Can't Ask Attackers to Slow Down”.

Key questions

Q: How should security teams adapt when attackers can use AI to compress multi-stage attacks?

A: Treat attack speed as a control problem, not just a detection problem.

Q: Why do AI-enabled attacks change the value of traditional vulnerability management?

A: They reduce attacker cost and speed up reconnaissance, phishing, and exploitation, which means the defender’s old timeline no longer fits the threat.

Q: What are the signs that AI is being used to support early-stage cyber attacks?

A: Common signs include unusually polished phishing text from weak operators, malware code that looks like lightly modified samples, and repeated small rewrites across languages or shells.

Practitioner guidance

• Build a continuous find-fix-repeat loop Run offensive testing continuously against your own applications and infrastructure, then convert the findings into rapid fixes and retest immediately to confirm the exposure is gone.
• Prioritise AI-assisted red teaming for high-value systems Use stronger models for authorised testing of internet-facing apps, identity controls, and cloud paths so you can measure how quickly AI can discover the same weaknesses an attacker would pursue.
• Tighten identity controls around AI-enabled attack paths Review service accounts, API keys, and privileged workflows that an AI-assisted attacker could enumerate, harvest, or reuse during rapid multi-stage operations.

Bottom line: AI is shortening the offensive cyber loop by making reconnaissance, exploit development, and attack progression easier to automate.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →