It already happens, though less dramatically than the headlines suggest. In November 2025 Anthropic reported a state-backed espionage campaign in which its AI model carried out an estimated 80 to 90% of the work against about 30 organisations, with humans stepping in at only four to six decision points. Its September 2026 report describes groups running "agent swarms" and completing breaches in two to three hours. Yet Google's threat intelligence team said in February 2026 that it had not seen AI give attackers "breakthrough capabilities", and the AI in Anthropic's case sometimes invented credentials that did not exist. The realistic picture is machine-speed versions of familiar attacks. The defence is the same discipline done faster: fewer exposed services, quick patching, intrusion prevention, strong authentication and automated response. At SourceIT, a Fortinet FortiGate 70G with 1-year Unified Threat Protection is S$2,630.40 (listed 30 Oct 2026).
What have AI-run attacks actually done?
| Case | What the AI did | Source |
|---|---|---|
| GTG-1002, assessed as Chinese state-sponsored | Reconnaissance, vulnerability testing, writing exploit code, harvesting credentials, creating backdoors and sorting stolen data; thousands of requests, often several per second | Anthropic, 13 Nov 2025 |
| "Vibe hacking" extortion | Automated reconnaissance and network penetration against at least 17 organisations, chose which data to steal and wrote tailored ransom demands, some above US$500,000 | Anthropic, 27 Aug 2025 |
| Agent swarms (GTG-10007) | Persistent campaign memory across about 50 targets, including a Southeast Asian government agency | Anthropic, Sep 2026 |
| GTG-50014 | Scanned 1.8 million Android apps for hard-coded secrets; one developer token escalated to full cloud admin in about three hours | Anthropic, Sep 2026 |
| Offensive AI tools in circulation | FortiGuard Labs names HexStrike AI and BruteForceAI and says attackers "are beginning to leverage Agentic AI" | Fortinet 2026 Global Threat Landscape Report, Apr 2026 |
From the named reports; we report these cases, we have not investigated them.
Why does speed matter so much?
Because the window for defenders keeps shrinking. Mandiant's M-Trends 2026 report found the median time between an initial-access broker getting in and handing access to the next criminal group fell from more than eight hours in 2022 to 22 seconds in 2025. FortiGuard Labs puts time-to-exploit for critical outbreaks at 24 to 48 hours. FortiGate intrusion prevention logged about 185 million brute-force events a day in 2025. A human-only process that checks alerts every Monday cannot keep pace with that, whether or not the attacker is an AI.
An AI attacker does not get tired, take leave or skip the boring targets. Your defences have to be automatic too.
Where do AI attackers still struggle?
- Reliability. Anthropic noted its model hallucinated credentials and presented public information as secret, which it called an obstacle to fully autonomous attacks.
- Known techniques. Verizon's 2026 breach report found the median threat actor used AI across 15 documented techniques, mostly to automate and scale methods defenders already know how to detect.
- Hard targets. Automation favours easy wins: exposed services, unpatched devices and reused passwords. Removing those changes the economics.
What does intelligent threat prevention look like for an SME?
- Shrink the attack surface. Close unused ports, keep the firewall's admin interface off the internet and remove old remote-access methods. Fortinet now recommends IPsec VPN over SSL VPN.
- Patch at machine speed. Track Fortinet's recommended release (FortiOS 7.6.8 for entry models in October 2026) and apply critical fixes within days, not quarters.
- Block known exploits automatically. FortiGate IPS, updated by FortiGuard, blocks attempts against known vulnerabilities while patches are pending.
- Make stolen passwords useless. Require MFA for VPN, email and admin access, and limit login attempts.
- Use reputation and geography. FortiGuard IP reputation, botnet databases and geo-blocking cut off much automated traffic before it reaches a login page.
- Respond automatically. FortiOS automation can quarantine a device or send an alert when certain events occur, so the first response does not wait for office hours.
The AI features in Fortinet's own products are covered in AI vs AI: Can FortiGate Fight Hackers Using Artificial Intelligence?, and round-the-clock operations in Cybercriminals Don't Take Weekends Off. Does Your Firewall?
Should smaller companies worry?
Yes, because automation removes the cost of attacking small targets. An AI agent scanning thousands of addresses does not care whether the company behind one has 10 staff or 10,000. Singapore's Cyber Security Agency reported 165 ransomware cases in 2025 and said SMEs were disproportionately affected. See Singapore SMEs Think They're Too Small to Be Hacked.
Buying in Singapore
SourceIT supplies FortiGate firewalls with UTP bundles and local warranty: the FortiGate 50G (S$1,819.20 with 1-year UTP), FortiGate 70G (S$2,630.40), FortiGate 90G (S$6,094.80) and FortiGate 120G (S$9,036), with 3- and 5-year options. Prices listed 30 Oct 2026. Browse the FortiGate firewall collection. For a quotation, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Can AI carry out a cyberattack on its own? Largely, in documented cases. Anthropic reported an espionage campaign in which AI did about 80 to 90% of the work, with humans making four to six key decisions.
Are AI attacks a new type of attack? Mostly not. Verizon and Google found attackers use AI to automate and scale known techniques, which defenders can detect if their tools are current.
How fast are attackers exploiting new vulnerabilities? FortiGuard Labs reports 24 to 48 hours for critical outbreaks, and Mandiant estimates exploitation now often comes before a patch is available.
How can a small business defend against AI-powered attacks? Reduce exposed services, patch quickly, use intrusion prevention and reputation filtering, require MFA, and set up automatic alerts and responses.
Does FortiGate block automated attacks? FortiGate IPS, IP reputation, botnet blocking and geo-blocking, updated by FortiGuard, block much automated scanning and exploitation, provided the subscription is active.
