More findings, less time: pentesting in the AI era

What attackers do with AI: the documented record

Fewer humans per attack, more targets per operator.

In August 2025, Anthropic described a criminal who used Claude Code to automate reconnaissance, credential theft and intrusion against at least 17 organizations. In November 2025 it disclosed what it calls the first reported AI-orchestrated espionage campaign: a group it assesses as Chinese state-sponsored (GTG-1002) used Claude Code against about 30 targets and succeeded in a small number. AI did 80 to 90% of the work; humans stepped in at 4 to 6 decision points.

Anthropic's September 2026 threat report says this autonomous way of operating has spread to every class of actor it investigated, and that sophistication no longer reveals who is behind an attack. In one case a stolen developer token became full cloud administrator access in about three hours; in another, an AI exploit-development loop produced more than a dozen possible zero-days in network appliances in a single month.

Google's Threat Intelligence Group (GTIG) sees the same shift: malware that queries a language model while it runs (November 2025), a criminal zero-day exploit that GTIG believes was built with AI (May 2026), and an agent-driven credential-harvesting campaign built in under six hours, whose infrastructure held more than 23,800 stolen secrets, including cloud and AI API keys (September 2026). Latin America is in the picture: according to Bloomberg, citing Gambit Security, an attacker who framed requests to Claude as a bug-bounty pentest stole about 150 GB of Mexican government data in December 2025 and January 2026.

The window between patch and exploit is closing

Fortinet's 2026 Global Threat Landscape Report, based on 2025 data, puts the time to exploit critical flaws at 24 to 48 hours, down from 4.7 days in earlier editions, and counts 7,831 confirmed ransomware victims against about 1,600 in the previous report. Fortinet names AI crime kits among the causes.

Anthropic's N-day study (June 2026) shows how. Working only from public patches, its restricted Mythos Preview model built 8 working code-execution exploits from 18 Firefox security patches, the first about an hour after the patch, and 8 full SYSTEM-level exploit chains from 21 Windows kernel patches. Windows Autopatch, the study notes, takes about 7 days to reach 90% of enrolled devices. Anthropic's advice: deploy patches faster.

Colombia knows the pattern. In March 2025, Check Point reported that Blind Eagle (APT-C-36), a group that targets Colombian institutions and companies, adopted a technique resembling a Windows flaw six days after Microsoft patched it; one of its campaigns claimed more than 9,000 victims in a single week. When exploitation takes days, the patch-and-retest cycle matters as much as discovery.

AI as a vulnerability hunter: what it has really found

Real results, with humans still reviewing.

Access to the strongest models is rationed. Project Glasswing started on April 7, 2026 with AWS, Apple, Google, Microsoft and other partners, and in June about 150 more organizations in over 15 countries joined. Claude Mythos 5.1 is reserved for vetted organizations, while Fable 5.1, the same model with extra safeguards, blocks pentesting and exploit generation but still finds flaws in source code. OpenAI rates GPT-6 Astra (September 3, 2026) as its first model at the "Critical" cybersecurity level; the public version refuses tasks such as proof-of-concept exploits.

The asymmetry matters: according to Anthropic, the misuse in its September report used its general models (Haiku, Sonnet and Opus), not the restricted ones. Attackers get by with general-purpose AI; defenders who want the best must qualify for an access program.

More findings, more noise: the curl lesson

The best documented case of AI's effect on security reports.

Daniel Stenberg, curl's lead maintainer, has published the numbers. In July 2025 he estimated that about 20% of that year's security reports were AI slop and only about 5% were real vulnerabilities. In January 2026 curl ended its bug bounty: since 2019 it had confirmed 87 vulnerabilities and paid more than $100,000, but the confirmed rate had fallen from over 15% to under 5%.

Then the trend reversed. By April 2026 reports were mostly high quality and AI-assisted, arriving at about twice the 2025 rate, and the confirmed rate was back to 15 to 16%; Stenberg expects close to 50 curl CVEs in 2026. In May, a Mythos scan reported 5 "confirmed" vulnerabilities; after human triage, one low-severity CVE and about 20 ordinary bugs remained.

Three lessons for pentest buyers. Discovery is becoming cheap and abundant. Validation, proving that a finding is real, reachable and serious, is now the scarce skill. And because true findings grow in number, a yearly test leaves more time for someone else to find them first.

Where humans remain essential

HackerOne's 2025 report (9th edition) gives the researchers' view: 58% of surveyed researchers say AI misses business-logic flaws and chained exploits, and only 12% think it could replace them. The same report shows authorization flaws (IDOR, broken access control) rising while XSS and SQL injection decline. Even attackers' AI needs supervision: in the GTG-1002 campaign, Anthropic notes that Claude sometimes invented credentials or presented public data as secret.

• Business logic. A discount applied twice, a refund without a return, an approval skipped: the flaw is in what the process allows.
• Authorization chains. A low-privilege token, a predictable identifier and a permissive API can together expose another customer's data, though each step looks harmless.
• Impact. CVSS scores a flaw; only someone who understands your operation can say whether it reaches payroll, health data or payments.
• False positives. Every unconfirmed finding costs developer time. Removing them is part of the job.

Old pentest vs AI-era pentest

What we recommend changing, line by line.

If AI makes discovery cheaper for everyone, paying for volume makes less sense than paying for confirmed risk and for the retest that proves the fix.

What a company in Colombia should do now

The regional numbers justify a faster cycle.

Check Point counted an average of 2,716 attacks per organization per week in Latin America in the first half of 2025, 39% above the global average (1,955), with Colombia among the region's five most targeted countries. According to Kaspersky, Latin America was the region most affected by ransomware in 2025 (8.13% of organizations hit), and 2,222 people in Colombia filed complaints with the FBI's IC3 in 2025, placing it among the top 20 foreign countries.

1. Shorten the cycle. Test critical applications and APIs after each major release, with a quarterly cycle as a floor for the rest, and fix critical flaws in days, not weeks.
2. Widen the scope. APIs, mobile back ends and AI features belong in it: a chatbot connected to your data or an agent with tools is attack surface (see prompt injection and agents).
3. Protect secrets. Stolen tokens and API keys fuel the campaigns above: limit their permissions, rotate them and review your dependencies (AI supply chain).
4. Demand validation and a retest. Reproducible evidence for each finding, and a retest as soon as each high or critical flaw is fixed.
5. Monitor between tests. Alert on unusual logins, API usage and cloud admin actions: a three-hour attack won't wait for the next pentest.
6. Train the people who move money. AI also scales fraud: see our deepfake fraud protocol.

If you sell software in the European Union, there is one more reason: since September 11, 2026, the Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities in their products, with an early warning within 24 hours. To decide what to test first, read pentest in Colombia: what to really test; our launch offer (COP 0 if we confirm no high or critical findings, one retest included on paid engagements) is on the pentest page.