DNTLS
On September 12, 2026, Dario Amodei wrote that accelerating AI capability, combined with the OpenAI–Hugging Face incident, made him worry that within 6–12 months an agent swarm could potentially establish a persistent botnet capable of causing hundreds of billions of dollars in damage. His proposed answer is that “We Must Pace the Frontier”: that is, slow capability advancement sufficiently for alignment, evaluation and regulation to catch up. He said:
it’s my worry that in 6–12 months such a swarm could be capable of taking over the entire internet with a persistent botnet (potentially causing hundreds of billions of dollars in damage), and that the scale of damage would continue to increase from there if AI becomes more powerful without the necessary guardrails.
I think Amodei is right about what is coming, but wrong about what will cause it and when it arrives. The transition has already started. I call it the Cybersecurity Siege Economy.
Thanks for reading DNTLS! Subscribe for free to receive new posts and support my work.
Subscribe
Thanks for reading! Subscribe for free to receive new posts and support my work.
I don’t think that his 6–12 month capability estimate is too aggressive, I think it is actually too conservative for the cybersecurity problem that matters.
The Internet does not need an uncontrollable superintelligence before it becomes hostile. It only needs economically viable autonomous attackers.
And those already exist.
Checkpoint released their 2026 AI Security Report in it they explicitly say AI has moved from assistant to operator. They document live intrusions where AI generated thousands of commands with minimal human direction, AI-built malware that one person produced in under a week at a quality researchers initially attributed to a team working for months, and a single operator compromising nine Mexican government agencies using an AI-driven workflow. Importantly they explained that while attackers are currently seen to be preferring to abuse commercial models, they have also used Self-hosted open-source models and that malicious DarkGPT services had growing adoption, that seems to have fallen. This shows that attackers are capable of self-hosting or using cheaper hosted open source models. If the commercial models increase guardrails, attackers will not go away, they will become better at using self-hosted or cheaper hosted non-US based models. There is no reason to assume they would not. And while DarkGPT service use fell, that was solely attributed to poor service quality, again there is no reason to presume that a lucrative demand for DarkGPT services would not see the recurrence of higher quality services.
In March of 2026, Google and Mandiant release their AI risk and resilience special report. That report shows that during 2025 attacker capabilities progressed dramatically from Augmentation and experimentation in early 2025, to late 2025 where they were seeing Autonomous agents being deployed and native AI threats.
Google has released a number of reports tracking the evolution of Adversarial AI its September 2026 report GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI states they have “observed forward leaning adversaries transition from basic prompting to agentic AI workflows and AI-enabled automation.” They cite an example in Q2 of 2026 where “threat actors compromise a cloud resource, then plan, build, and execute an agent-enabled mass credential harvesting campaign in under six hours.” They also explain that “Adversaries are deploying multi-agent frameworks that autonomously manage scanning pipelines, resolve operational errors, and execute credential harvesting at scale.”
The CrowdStrike 2026 Threat Hunting Report shows CrowdStrike tracking over 290 Adversaries across over 150 Malicious activity clusters and emerging threat groups.
They state:
The window between vulnerability disclosure and active exploitation continues to shrink, and the incorporation of agentic AI into vulnerability discovery workflows has the potential to render traditional patching cycles insufficient, leaving defenders forced to adopt a continuous emergency patching posture or accept significantly elevated risk. This scenario is no longer theoretical
Further:
CrowdStrike OverWatch has observed significant growth in AI agent-triggered detection leads, now tracking at 2.5x the rate of human-triggered leads, underscoring how AI-driven activity is increasing the volume and velocity of signals threat hunters must assess.
In September 2026, Anthropic released their Detecting and countering misuse of AI: September 2026 report. It shows with detailed examples of people using Anthropic hosted LLMs to stage various attacks. They explain:
AI has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators.
and
frameworks, like PentAGI, reproduce much of the same scaffolding for anyone who downloads them. This scaffolding effectively automates each step of the cyber kill chain. The operators behind observed cases range from state services to lone individuals, across a widening set of countries.
We often think of Advanced Persistent Threats as well resourced groups, with state backing, or supported by proceeds from earlier successful campaigns. However this report demonstrates:
AI has helped to close the capability gap turning low-level hacktivists into advanced persistent threats.
In one cited case:
In the spring of 2026, a single French-speaking actor was observed using Claude to target European political parties, media, think-tanks, and the SaaS providers used by these organizations.
The pace of AI development globally means that the models we are seeing used in these case studies are already largely obsolete. Threat-intelligence reports are necessarily lagging indicators. By the time an incident is investigated, attributed, written up and published, the models used in the attack may already be months behind the current state of the art.
If a French hacktivist was using Claude in February 2026, that tells us what capability was available to that actor in February. It does not tell us what model is required to reproduce the same attack in September.
This distinction matters because the open-model gap is now measured in months. Capabilities that required access to a leading closed model earlier this year can migrate rapidly into cheaper hosted models and then into open-weight models that attackers can run themselves.
The case studies therefore understate the current threat. They show the minimum capability attackers had months ago, not the minimum capability they need today.
This is demonstrated by the AI Security Institute reports from July 2026: How Far Behind the Frontier are Leading Open Weight Models on Cyber? and UK AISI / CAISI Preliminary Assessment of Kimi K3’s Cyber Capabilities They concluded that:
recent open weight models lag frontier closed models’ cyber capabilities by 4 to 7 months – a narrower gap than the 6 to 10 months we measured internally through most of 2025.
More disturbingly they show that:
In one of the 10 attempts, Kimi K3 successfully completes “The Last Ones” cyber range within the 100M token limit.
This means that Kimi K3 can complete the full benchmark, just not reliably under the benchmarks 100M token limit. AISI already identify this possibility as a limit of their testing framework, not a limit of the models themselves under test in Measuring AI Agents’ Progress on Multi-Step Cyber Attack Scenarios:
First, model performance scales log-linearly with inference-time compute: spending more tokens reliably increases the number of attack steps completed, with no observed plateau up to 100M tokens (Figure 1). Second, newer model releases consistently outperform their predecessors at fixed token budget
The important thing to realize is that threat actors are typically commercially rational. They do not care whether an open model requires ten times as much inference as a frontier model if ten times as much inference still costs less than the expected return from the attack. For a state-backed operation, even that economic constraint may be weak. What matters is whether the capability exists at all and whether enough compute can make it reliable. Therefore, Policy frameworks built around slowing down US development rest on a critical logical flaw: they assume threat actors need tomorrows bleeding-edge technology to do harm. They do not. In AI, yesterdays frontier AI is tomorrows potato. Cyber capabilities that were frontier-class only months earlier are already propagating into open-weight models that can be downloaded, modified and run beyond provider control. Slowing the US frontier does not take those capabilities back out of the hands of threat actors; it risks slowing the development of the next generation of defensive capability while the offensive baseline continues to progress.
There can be no rational dispute that attackers already have the means, motive and opportunity to launch AI-automated attacks. They also have access to open models which equal or exceed the capabilities of frontier models from just 12 months ago.
The only factor then is scale and timing. Not IF, but WHEN continuously operating persistent botnets arrive. What is true is if we wait for it to arrive before reacting, it will be too late.
When the scale of attack reaches the proportions warned of by Dario Amodei then the internet will be forever under siege. There will not be a moment respite. Threat Actors will learn quickly that by constantly probing and altering their attacks they gain two advantages.
1. They exhaust the defender economically. Every successful act of defense costs money. Bandwidth must be carried, requests inspected, logs stored, alerts evaluated, infrastructure over-provisioned, and AI-based detection and response continuously invoked at token prices. Even when the attacker loses every interaction, the defender still pays for the fight. 2. One mistake equals a breach. Attackers only need to win once; defenders need to win every single time. As the number of attempts approaches continuous saturation, time increasingly works in the attacker’s favor. Every modification to a production system, including deployment of security patches, creates a new window of vulnerability. A single mistake at that moment can allow a persistent attacker to access a system they may have been locked out of for months. This will create pressure to slow the pace of deployments, even when those deployments are critical. Continuous attack also creates continuous psychological pressure. Even with significant automation and AI assistance, defenders still live with the knowledge that the next breach may happen on their watch, and that one missed signal, one bad deployment, or one judgment call may be the mistake that defines their career.
I already established that attackers have a smorgasbord of options at their disposal: US commercial frontier models, whether paid for, jailbroken or accessed through stolen credentials; foreign commercial models, including state-sponsored access; standard open-weight models; or obliterated, modified and fine-tuned open-weight models. The key point is that attackers are criminals. They will not hesitate to use stolen API keys, compromised accounts, or stolen compute.
Defenders are much more constrained. They have contracts, acceptable-use rules, compliance departments, audit requirements, procurement restrictions and vendor-enforced guardrails. To access the strongest cybersecurity capabilities they may have to navigate vendor identity programs, approval processes and higher pricing. Some providers are trying to make this accessible to SMEs, but the structural problem remains: many smaller organizations will not apply in advance, and when they suddenly need the capability they may not have it and may not be able to obtain it quickly.
This is a global problem, not a US-centric one. Defensive capability is not distributed evenly across jurisdictions, and an organization is only as isolated as its weakest trusted relationship. A compromise of a supplier, subsidiary or service provider in South Africa can still spill through internal trust channels into a US organization. Treating US availability, pricing and access to frontier models as the global baseline is therefore a dangerously incomplete threat model.
A Siege is a warfare tactic where you encircle a target, and prevent them from finding refuge. When a persistent botnet is attempting to breach any targets they can find, we have similar structural outcomes.
Defenders are trapped inside walls. Stepping outside those walls is high risk, defense must be continuous and any upgrade to the walls creates its own risk of breach. Defenders get tired, attackers have it relatively easy. Defenders must never lose while resources might be draining on defense, whereas attackers can replenish supplies and keep attacking and adapting to any defense.
It’s already demonstrable that the lag between frontier models and leading open weight models is not large, and shrinking. Any pause to frontier models may see that gap reduce or even be eclipsed. That means the ability to respond to a persistent threat diminishes, without meaningfully withholding capability from attackers.
For most of history, human labor placed a natural economic floor on hostile activity and a practical ceiling on its scale, both in real-world sieges and online. AI removes much of that economic floor by turning offensive labor from a scarce human resource into repeatable computation, raising the practical ceiling.
The evidence from the first 9 months of 2026 is that the first skirmishes in this global cybersecurity siege have already been fought. We should consider this a prelude of what is to come, and not a series of isolated incidents. As the cost to attack declines, the cost to defend will rise disproportionately and without bound.
There will be no flag day when the Siege will be recorded as having started, as the number of incidents and their prevalence will simply escalate at their own pace over the next few months to years. By the time it has unequivocally arrived, we will have been living under those condition for some time already.
The Cybersecurity Siege Economy is the result of this process when the capability to attack becomes cheap and persistent enough that Internet-connected systems are no longer attacked occasionally, but continuously.
At that point, stopping the attacker is only part of the problem. The defender must also survive the cost of stopping them.
Part 2 will look at what that does to the modern cybersecurity stack: endpoint protection, malware detection, identity, email, vulnerability management, SIEM, MDR, DDoS protection and other controls — where they fail under continuous machine-speed attack, and what those failures do to the cost and complexity of operating on the open Internet.
Thanks for reading DNTLS! Subscribe for free to receive new posts and support my work.
Subscribe