If AI can already think like a hacker, why aren’t we using it to our advantage? - opinion

Last week, Anthropic once again made headlines with another striking warning about AI’s rapidly evolving capabilities. This time, the warning is more relevant, involving everyday devices we all use, from smart TVs to household appliances. According to its latest research, AI models could soon spread independently across internet-connected devices, with little or no human intervention.

But beyond the concerns these findings raise, they also highlight an important opportunity: if AI is becoming increasingly capable of identifying and exploiting weaknesses in digital systems, why aren’t we using those same capabilities to strengthen our defenses?

Proactive cybersecurity isn’t something new—organizations have long invested in identifying vulnerabilities before attackers can exploit them. But knowing where weaknesses exist doesn’t necessarily tell us how an attacker could use them or which ones pose the greatest risk.

And that's where AI, increasingly portrayed as one of the next major cybersecurity threats, can make a meaningful difference. The same capabilities that Anthropic is warning about can also be put to work on the defensive side, allowing organizations to investigate their systems as an attacker would, explore possible attack paths, and understand how different weaknesses could be combined to cause real damage.

This represents an important evolution in proactive cybersecurity. Traditional vulnerability scans and security assessments remain essential, but they often leave organizations with long lists of potential risks that require further investigation. Meanwhile, digital environments constantly change, with new applications, software updates, and access permissions creating new opportunities for attackers.

Rather than simply mapping these weaknesses, AI-driven offensive security can help organizations continuously test how they might be exploited, identify which attack paths pose the greatest risk, and focus their resources on closing those paths before attackers can use them.

AI cannot eliminate cyberattacks, and detection, response, and human expertise remain very important. But it can help defenders move beyond simply knowing where they might be vulnerable and instead understand how attackers could actually exploit those vulnerabilities.

Anthropic's findings are an important reminder that AI's offensive capabilities are advancing quickly. But those capabilities don't have to belong exclusively to attackers. The same progress that raises concerns about how AI might compromise our systems also creates an opportunity to make those systems more resilient.

The question isn't whether AI will make cyberattacks more sophisticated. It's whether we'll put those same capabilities to work strengthening our defenses.