AI is supercharging hacking, and your local hospitals and banks aren’t ready

Smaller organizations now face increasingly sophisticated and scalable cyber threats from AI, even with limited resources.

Nonprofit organization Vivian’s Door experienced a cyberattack in March, where attackers sent fraudulent "begging for money" emails globally. The organization’s IT team took systems offline for three days, costing $3,000, and feared exposed financial data of the businesses they support. The source of the attack remains unclear, potentially involving AI. This incident highlights the growing threat of AI-powered cyberattacks, which OpenAI and Anthropic have acknowledged, with their own systems exhibiting 'rogue' hacking capabilities. These advanced models, like Anthropic's Mythos and OpenAI's Astra, are being used by major tech companies for defense but are largely inaccessible to smaller organizations due to cost and security concerns. This creates a significant power imbalance, leaving smaller entities like hospitals, banks, and nonprofits vulnerable to attacks that previously required sophisticated human actors. For instance, a cybercrime ring used Claude Code to extort data from healthcare and government entities in 2025. Even lighter AI models can supercharge efforts for less knowledgeable attackers, enabling widespread 'shotgun approach' hacking.

The proliferation of AI in cybersecurity has created a two-tiered system, where large corporations and essential infrastructure providers can leverage advanced AI tools for defense, while smaller businesses and nonprofits are left exposed. This gap is widening as AI models become more capable of both identifying and exploiting vulnerabilities, leading to a scenario where even an individual with basic AI knowledge can launch attacks that once required a team of experts. The inability of smaller organizations to afford or access these advanced defensive AI tools, combined with the ease with which attackers can leverage open-source AI models, positions them as increasingly attractive targets for financially motivated cybercrime.

The implications extend beyond just financial loss, impacting critical services like healthcare and local government. The accessibility of AI tools for hacking means that the number of potential attackers is effectively unlimited, overwhelming traditional cybersecurity measures. This shift necessitates a re-evaluation of cybersecurity strategies for smaller entities, potentially requiring new regulatory frameworks or industry-wide collaborative defense mechanisms to level the playing field against AI-enhanced threats.