Cybersecurity 2025–2026: what happened and why it matters

In 2026 artificial intelligence moved from promise to auditing tool with measurable results. According to Mozilla, in two weeks of January an Anthropic model found more than 100 bugs in Firefox, 14 of them high severity, in a year when the browser had patched 73 high or critical flaws. Months later, Firefox 150 shipped fixes for 271 vulnerabilities found with Mythos Preview, and a separate agent found 21 zero-day flaws in FFmpeg.

The flip side is the gap between discovering and fixing. In its first month, Project Glasswing flagged more than 10,000 possible critical flaws: 1,726 were confirmed and only 97 had been patched. The UK AI Security Institute tempered the story: on single tasks Mythos barely improves on other models, but it was the first to complete a simulated 32-step intrusion, though only in three of ten attempts. Google, meanwhile, confirmed the first case of an AI that discovered and weaponized a zero-day used in the wild.

Attackers are adopting AI too. CyberStrikeAI, an open-source platform, bundles more than a hundred offensive tools and was used against FortiGate firewalls; the Transparent Tribe group automates malware implant creation against targets in India; and agents built on large language models have been seen handling post-exploitation. A Chinese open-weight model, GLM-5.2, matches or beats an Anthropic model at finding flaws.

Platforms for building and running AI agents became targets of real attacks. Flowise suffered an actively exploited remote code execution flaw rated 10.0 on the CVSS scale, with more than 12,000 instances exposed on the internet. Langflow, with roughly 7,000 exposed instances, and two other popular frameworks accumulated serious vulnerabilities that let attackers run code and steal credentials.

According to the analysis, these are not exotic threats but classic flaws, such as SQL injection, path traversal and unsafe deserialization, inside infrastructure that security teams have not yet learned to monitor. Ollama (out-of-bounds read), OpenClaw (prompt injection and data exfiltration) and PraisonAI, attacked within hours of its flaw being disclosed, add to the list. Model and agent-skill repositories already host hundreds of malicious entries, and tool registries can be poisoned because agents choose tools by description, with no human verification.

The most telling episode came in July: Sysdig documented what it believes is the first fully autonomous ransomware attack, run by an AI agent that got in by exploiting a Langflow flaw and corrected a failed login in just 31 seconds.

Network and security appliances were the favorite way in. The FBI warned in August 2025 that Russian hackers linked to the FSB were targeting thousands of networking devices in US critical infrastructure through a Cisco flaw seven years old. Soon after, F5 had BIG-IP source code exposed to a suspected nation-state actor, and SonicWall confirmed a state-backed group was behind its breach. In 2026, Interlock exploited a zero-day in Cisco Secure Firewall Management Center from late January, before the March 4 patch, and another Cisco SD-WAN zero-day gave attackers root access.

Chinese cyber-espionage was constant. UNC5221 used the BRICKSTORM backdoor against the US legal and technology sectors; Mandiant tied it to Beijing's interest in its trade dispute; Palo Alto Networks described a Chinese group that had sat in foreign ministry mail servers for years; and UAT-9244 hit South American telecom operators with three distinct tools. On the Russian side, the FBI and CISA warned of a phishing campaign aimed at Signal recovery keys, and APT28 exploited an MSHTML zero-day before the February patch.

The supply chain was the attack path that drew the most attention. The compromise of Trivy, a widely used vulnerability scanner, began on March 19 according to one source and triggered a worm that infected 47 npm packages; in April it emerged that the TeamPCP group, via Trivy, stole 92 GB from the European Commission's cloud infrastructure. Another attack, GlassWorm, abused 72 Open VSX extensions to reach developers' environments.

Identity is the other weak link. The Vercel breach started with an employee who granted broad permissions, from a corporate account, to a third-party AI tool, and the attacker took advantage of environment variables not marked as sensitive. A phishing technique based on OAuth consent bypasses even multi-factor authentication. Trellix, a security company, confirmed access to its source code repositories, and fake Laravel packages and Bitcoin-themed packages repeated the pattern in package registries.

Ransomware sped up and changed method. Cl0p exploited Oracle E-Business Suite and, according to Google, several executives received extortion emails claiming to come from that group, though there was no proof to confirm it. In June, ShinyHunters breached more than 100 organizations with an unpatched Oracle PeopleSoft zero-day. ReliaQuest counted 2,638 victim postings in the first quarter of 2026, up 22% year on year, with The Gentlemen growing 588%.

Botnet scale set records, and the response was just as international. AISURU, with up to 4 million infected hosts, was linked to a 29.7 Tbps DDoS attack; in March the US Justice Department dismantled a network of about 3 million IoT devices behind 31.4 Tbps attacks. Another operation disrupted SocksEscort, with about 369,000 IP addresses in 163 countries, and INTERPOL took down 45,000 IP addresses with 94 arrests. The alleged head of Black Basta joined the EU's most wanted list.