In December 2025, police in Osaka arrested a 17-year-old for running malicious code that extracted the personal data of over 7 million users of Kaikatsu Club, Japan’s largest internet cafe chain. When investigators asked him why he did it, his answer was disarmingly simple: he wanted to buy Pokémon cards.
What made the case remarkable wasn’t the scale of the breach, though stealing 7 million records is by any measure a serious crime. What made it remarkable was that the teenager had no technical background whatsoever. He hadn’t spent years learning to code. He hadn’t apprenticed in underground hacking forums. He had access to an AI chatbot and enough curiosity to ask it the right questions.
Welcome to 2026 — the year that AI finished democratizing cybercrime.
A Threshold Has Been Crossed
For decades, the world of serious cyberattacks operated on a kind of talent barrier. Sophisticated breaches required genuine technical skill: understanding how systems communicate, where vulnerabilities live, how to write and deploy malicious code without getting caught. Talented hackers were rare, and that rarity provided an imperfect but real form of protection.
That protection is dissolving faster than most organizations realize.
In 2025, large language models and agentic AI systems crossed a threshold. They went from useful-but-limited coding assistants to end-to-end attack platforms capable of guiding a motivated individual — regardless of technical background — through a complete cyberattack lifecycle. Writing the exploit, organizing stolen data, analyzing financial records, drafting extortion emails: all of it is now within reach of anyone willing to use the tools.
The data makes the shift impossible to ignore. Malicious packages discovered in public code repositories grew from 55,000 in 2022 to 454,600 in 2025 — an eightfold increase in three years, with the sharpest jumps coinciding with the release of GPT-4 in 2023 and the emergence of agentic AI coding tools in 2025. AI-generated phishing campaigns began outperforming human red teams in controlled tests. Cloud intrusions climbed 35%. And the time it takes for an attacker to build an exploit after a vulnerability is disclosed has collapsed from over 700 days in 2020 to just 44 days in 2025.
That last number might be the most alarming of all. Mandiant’s M-Trends 2026 report found that the trend has gone even further: exploits are now arriving before patches in many cases, with 28.3% of known vulnerabilities being actively exploited within 24 hours of disclosure. Defenders are losing a race they didn’t even know they were running.
Three Attacks That Defined the New Landscape
The Osaka case is instructive, but it isn’t the only example. Across 2025, a pattern emerged of attacks that would have been impossible — or at least far more difficult — before AI reached its current capability level.
In February 2025, three teenagers aged 14, 15, and 16 with no coding background used ChatGPT to build an automated tool that hit Rakuten Mobile’s systems approximately 220,000 times. Their goal was not to disrupt the company or make a political statement. They spent the proceeds on gaming consoles and online gambling. The attack was crude by the standards of professional criminal organizations, but it worked — because the teenagers didn’t need to understand how the attack worked. They just needed to describe what they wanted.
By July 2025, the capabilities available to attackers had grown significantly more powerful. A single individual using an agentic AI coding platform conducted an extortion campaign targeting 17 different organizations over the course of one month. The AI assisted with every stage: developing the malicious code, organizing the stolen files, analyzing the victims’ financial records to calibrate how much to demand, and drafting the extortion emails. One person, one month, seventeen victims. That kind of operational tempo would previously have required a coordinated criminal organization.
Then, in December 2025, another individual used a combination of AI tools to breach the Mexican government — targeting more than 10 agencies and exfiltrating over 195 million taxpayer records. The scale of the breach put it among the largest government data thefts in history. It was carried out by a single actor.
The Numbers Behind the Shift
It’s tempting to treat these incidents as exceptional cases — talented individuals who happened to find AI tools useful. But the broader trend data tells a different story.
The internet crime complaint data shows a 312% spike in AI-assisted cybercrime targeting US citizens between 2024 and 2026. The Venn diagram of “willing to commit attacks” and “technically capable of committing attacks” is no longer a sliver — it’s a circle, and it’s growing monthly.
At the same time, defenders are struggling to keep pace. The average time to remediate a high or critical severity vulnerability is now 74 days, according to the Edgescan 2025 Vulnerability Statistics Report. More troublingly, 45% of vulnerabilities in systems maintained by large companies — organizations with 1,000 or more employees — are never remediated at all.
The September 2025 Shai-Hulud attack on the npm ecosystem illustrates what this gap looks like in practice. Attackers compromised over 500 widely-used packages. Nearly 500 organizations had credentials and secrets exposed. $8.5 million was stolen from Trust Wallet after attackers used those credentials to poison its Chrome extension. The malicious packages evaded detection because they were structured like legitimate software — complete with documentation, unit tests, and realistic code — likely generated with AI assistance.
Why Patching Isn’t Enough
The conventional response to cybersecurity threats is to patch faster. Find vulnerabilities, fix them, deploy the fix before attackers can exploit it. That model worked reasonably well when exploits took months or years to develop after disclosure.
It doesn’t work when exploits arrive before patches do.
The arms race metaphor captures the problem but undersells how lopsided it has become. AI makes offensive capabilities cheaper, faster, and more accessible by the month. The same isn’t consistently true of defensive capabilities. Human review cycles, organizational bureaucracy, and the sheer complexity of modern software supply chains all constrain how quickly defenders can respond. Attackers face none of those constraints.
The implication, increasingly accepted among security researchers, is that organizations need to think differently about the problem. Rather than trying to outrun attackers on every front, the question becomes: which categories of attack can we eliminate structurally? Which vulnerabilities can be made impossible to exploit, rather than just harder?
Supply chain attacks represent one of the most urgent areas. When malicious code can be hidden inside packages that look indistinguishable from legitimate software, signature-based detection fails. The answer isn’t better signatures — it’s rebuilding dependencies from verified, auditable sources so that the attack surface itself shrinks.
What Comes Next
If 2025 was the year that AI-assisted attacks became viable, 2026 is the year they became routine. The question security professionals are increasingly asking is not “will we face AI-assisted attacks?” but “how do we build systems resilient enough that it doesn’t matter?”
That question doesn’t have a simple answer. It requires rethinking how software is built, how dependencies are managed, how credentials are stored, and how quickly organizations can detect intrusions that look like legitimate activity. It requires acknowledging that the talent barrier that once slowed attackers is gone, and that the policy and organizational responses to cybersecurity need to catch up to that reality.
The 17-year-old in Osaka who wanted Pokémon cards is not an anomaly. He’s a preview. As the tools become cheaper and the models become more capable, the population of people who can mount serious cyberattacks will keep growing. The organizations and systems that survive the next phase of this evolution will be those that stopped betting on attackers staying incompetent.
The Venn diagram keeps expanding. The question is what we’re building on the other side of it.
