When Effort Became Free: AI, Mythos, and the New Economics of Hacking

A single person. A flaw in a football club’s app. And, with it, the keys to the kingdom.

In March 2026, RTL Nieuws revealed that Ajax, one of the most-watched football clubs in the Netherlands, had been compromised through its ticketing app. The technical flaw was simple: every user of the app carried the same digital key to reach a season ticket, so getting hold of one meant you could reach anyone’s. RTL proved the point by retrieving the season ticket of Ajax director Menno Geelen, including access to the VIP boardroom box. The flaw could expose data associated with more than 300,000 supporters and 538 stadium bans. Ajax later said the observed access was much smaller: a few hundred email addresses and fewer than twenty stadium-ban records. In May, Dutch police arrested a 35-year-old man from Buren on suspicion of computer intrusion.

This wasn’t a state actor or a crew with a zero-day arsenal. It was one individual targeting a bespoke app for football tickets and stadium-ban data. Claude Code was part of the attacker’s workflow. Work that might once have required weeks of manual reverse-engineering had become affordable for one person chasing a relatively narrow payoff.

I’ve spent almost two decades helping organisations defend against attackers, and this is the clearest local example yet of something I’ve been watching arrive globally. AI lowers the marginal cost of digging through an unfamiliar app until one mistake opens everything. AI hasn’t made hackers smarter. It has made effort feel free. Compute, access, target knowledge and verification still cost something. The scarce block of specialist time has become dramatically cheaper, and “effort was expensive” was a load-bearing assumption beneath many security strategies.

The world we’re leaving behind

For thirty years, offensive capability was gated by human talent. Finding a genuine vulnerability in a large, unfamiliar codebase was slow, specialized work. A senior researcher might spend weeks or months on a single high-impact bug in brand-new code. That scarcity shaped everything downstream. Attackers concentrated on high-value targets because effort had to be justified by payoff. Obscure software that only one company ran was, in practice, safe. Not because it was secure, but because nobody would bother. And the window between a vulnerability becoming known and a working exploit existing in the wild was often long enough to patch in.

The “script kiddie”, the no-skill attacker running tools they ripped from the internet without understanding them, was a nuisance precisely because they couldn’t do the hard part themselves. They were limited to whatever someone else had already weaponized.

None of those assumptions is safe as a default anymore.

What actually changed: marginal effort collapsed

Talk to the people building AI bug-finding systems and the numbers are startling. At DARPA’s AI Cyber Challenge, automated systems found the deliberately planted flaws and more than a dozen real bugs nobody had inserted on purpose. Tim Becker, a security researcher at Theori, put the shift bluntly to The Verge: work that used to take him weeks or months now takes hours. “The bar to diving into a new million-line codebase and finding a bug is so much lower than it used to be.”

When marginal effort collapses, three defender assumptions become unreliable.

Target selection inverts. As Dan Guido of Trail of Bits framed it, “because effort is cheap, you can do things that are lower down the food chain.” You can write an exploit for software that only one company runs, in one configuration, on the fly, in the middle of an intrusion. The obscure line-of-business app that was safe-by-obscurity is now a legitimate target, because pointing an AI at it costs almost nothing. Ajax’s ticketing app was exactly this kind of target.

Disclosure-to-exploit can collapse. The gap between “a vulnerability is announced” and “an exploit exists” is shrinking for flaws that a model can reproduce from a patch or advisory. This isn’t true for every bug, but patch planning can no longer assume a long quiet period.

The script kiddie becomes genuinely dangerous. The no-skill attacker is no longer limited to yesterday’s weaponized exploits. They can grind a novel target at machine speed: “point an LLM at that wall,” as Guido put it, and let it iterate until something works. The dangerous attacker of 2026 doesn’t need to be an expert.

Fortinet’s 2026 threat report recorded a 389% rise in ransomware victims and described attackers using generative AI across their operations. That does not prove AI caused the entire increase, but it shows the two trends arriving together. Katie Moussouris of Luta Security warns that the next problem may be a “patchpocalypse,” as organisations face more fixes than they can safely test and deploy. As she puts it, we can’t incident-respond our way out of this.

The real lesson is the harness

The instinct is to fixate on the model, specifically Anthropic’s Mythos, the frontier model that reportedly finds vulnerabilities in nearly everything it’s pointed at.

But when Cloudflare got hands-on access to Mythos Preview and pointed it at more than fifty of their own repositories under Project Glasswing, the lesson they came away with wasn’t about the model’s raw intelligence. It was about structure. What made Mythos frightening wasn’t that it found bugs — plenty of models find bugs. It was two things: it could chain several low-severity primitives into a single working exploit the way a senior researcher would, and it could prove exploitability by writing, compiling, and running proof-of-concept code, then reading the failure and trying again until it worked. A suspected flaw is speculation; a flaw with a working proof is a weapon.

Cloudflare found that pointing even a brilliant model at a repository and saying “find vulnerabilities” doesn’t work well. The model wanders, hedges and drowns you in “possibly” and “could in theory.” What worked was a harness: reconnaissance, narrowly-scoped hunter agents, an adversarial review pass, deduplication and a reachability check for attacker-controlled input. Their conclusion, in their words: the model is one input; the system is the product.

That reframing matters more than the benchmark headline. Operational advantage comes from the orchestration around the model and the judgement encoded into it. A capable model in a crude loop is noisy. A good model in a carefully designed harness can outperform an unstructured human workflow on the task it was built for. The durable advantage belongs to the team that implements and validates the system, rather than the one with temporary access to the highest-scoring model.

Defenders got the same class of capability

If that were the end of the story, it would just be despair. It isn’t, because the harness cuts both ways, and the defensive side of the industry is moving fast.

Microsoft’s answer is the clearest illustration of a broader doctrine I’d call defend at machine speed, and it has two halves.

The first half is discovery. Microsoft built a multi-model agentic scanning harness (codename MDASH) with almost exactly the shape Cloudflare described: a pipeline of specialized agents that prepare, scan, then debate each finding for and against its exploitability, deduplicate, and prove. On a test codebase it found 21 of 21 planted vulnerabilities with zero false positives. On real Windows code it contributed 16 CVEs to a single Patch Tuesday across the network stack, and hit 96% recall against five years of historical bugs in one component and 100% in another. Their conclusion is a near-verbatim echo of Cloudflare’s: the harness does the work, and the model is one input. That portability matters: when the next model lands, the targeting, debating, deduping, and proving carry over intact.

The second half is response, and this is where I’d point you back to something I wrote about earlier this year. At Experts Live, Raviv Tamir described Microsoft’s shift to a “fire first, ask questions later” model, where automated systems executed hundreds of defensive actions inside 50 minutes during an active attack (isolating accounts, revoking tokens, blocking lateral movement) faster than any human SOC could. That capability, Attack Disruption, is the defensive mirror of the machine-speed attacker. When the adversary can move at the speed of an AI agent, a human-paced response loop isn’t slow — it’s irrelevant. Detection that only creates a ticket for a human to investigate tomorrow is, as I’ve said before, just watching yourself get robbed in high definition.

Put the two halves together and the picture is roughly symmetrical: agentic offence meets agentic defence, while people spend more time governing the work. The contest is harness versus harness. Bolting a chatbot onto a SIEM doesn’t change a response process that still sends every real decision into an overwhelmed analyst queue.

So how do you actually deal with this?

None of this is a reason to despair, and it’s certainly not a reason to freeze. As Moussouris frames it, this is a moment to shore up defenses and finally get budget for the things you’ve been putting off. Here’s where I’d focus: principles first, with the Microsoft stack as one concrete way to implement them.

1. Assume exploitation as well as vulnerability. Patching faster is necessary but it will never be sufficient — you cannot win a race where exploit code ships the same hour the CVE does. The higher-leverage move, as Cloudflare argued, is architecture that makes exploitation harder even when a bug exists, so the gap between disclosure and patch matters less. That means defense-in-depth in front of the application, blast-radius containment so a flaw in one place can’t reach everything, and the ability to roll a fix everywhere at once. In Microsoft terms: rigorous segmentation, Conditional Access as a control plane, phishing-resistant MFA, and just-in-time privilege via Entra PIM so a compromised session isn’t a master key.

2. Compress your response loop with a harness, not headcount. You will not hire your way to machine speed. High-confidence threats should trigger automated containment (disable the identity, revoke the tokens, isolate the device) with humans arriving after the bleeding stops, not before it starts. This is exactly what Microsoft’s Attack Disruption does by default for classes like ransomware and hands-on-keyboard attacks. The key, echoing Raffy Marty’s work on the AI-native SecOps control plane, is disciplined automation: deterministic playbooks and policy-as-code where safety matters, generative AI reserved for reasoning and investigation, and guardrails (approval gates, rollback paths, audit trails) around all of it. Risk becomes the control signal: the same event on a test box and on a privileged identity should not get the same response. And if you don’t run a 24/7 SOC yourself, this is exactly what a modern Managed Detection and Response (MDR) service should now deliver: not analyst labor bolted onto your alerts, but the AI-native SecOps control plane Raffy Marty describes, operating the detection-to-response loop on your behalf while you set the policy and own the high-risk decisions.

3. Govern your AI agents like privileged insiders. Researchers have shown that an AI browser assistant, handed a signed-in admin session, can enumerate and dismantle a Microsoft 365 tenant by automating existing administrative workflows. Any agent that can act with a user’s session inherits that user’s blast radius. Lock down and monitor Graph activity, restrict OAuth consent and device-code flow, and use token protection for the device, app and resource combinations Microsoft supports. Apply Purview controls where the agent and data channel are actually covered. Agent 365 can inventory and govern agents brought under its management; it cannot discover every unintegrated script by magic. This companion control map goes through the coverage boundaries in detail.

4. Prioritise by reachability, not CVSS. The patchpocalypse is a triage problem. A flat severity score can send you to a critical bug buried behind several controls while an exposed medium-severity weakness sits on a live attack path. Microsoft Security Exposure Management models those routes and identifies chokepoints. I covered the graph model in Blueprint for a Modern Defense Stack. You can also point a scanning harness at your own code before an attacker does; Microsoft’s MDASH is the in-house example. You don’t need to fix everything at once. Break the reachable paths first.

5. Keep humans where judgment lives, and staff for it. The reflex to cut security headcount because “AI is more efficient” gets the lesson exactly backwards. AI dramatically accelerates senior people, but it can hollow out the pipeline that creates them if juniors never learn to think because the machine thinks for them. You still need humans for prioritization, threat hunting, and the high-risk decisions no policy engine should make alone. Point the automation at the toil so your people can do the judgment. As Moussouris put it: you can’t incident-respond your way to resilience.

6. Treat your apps and APIs as the front line. In the Ajax case, a key in a mobile app unlocked the API behind it. AI makes bespoke apps cheaper to probe, while many organisations still under-instrument the application layer. Discover every exposed API, including forgotten ones; enforce authentication and object-level authorisation; rate-limit; and monitor for automated abuse. This gap is why we built API Protect at Wortell: we kept finding that the route to sensitive data was an API the security programme could not properly see.

The uncomfortable symmetry

The same class of tool that can write your code, review your architecture and defend your tenant at machine speed can turn a bespoke app into a weekend target for one motivated person. It can also drive an identity plane through the same administrative actions your own staff use. The capability is available to both sides.

Talent still matters. So do compute, access and budget. But implementation now compounds those advantages: the harness, the response loop, agent governance, application controls and the people trusted to make high-risk decisions.

Effort isn’t literally free. It is cheap enough to change the target list. The question is who puts that change to work first.

So here’s the one I’d take into your next Monday: if an AI agent had your most privileged admin’s session open right now, how far could it get before anything in your environment noticed — and who, or what, would stop it?

If you can’t answer that with confidence, you already know where to start.

Sources:

• Ajax: Ajax’s disclosure and observed-access figures, RTL Nieuws’ reporting of 25 March 2026, the Dutch police arrest notice and NOS.
• Offensive capability and harness design: The Verge, “Attack of the killer script kiddies” and Cloudflare, “Project Glasswing: what Mythos showed us”.
• Defensive systems: Microsoft Security, “Defense at AI speed”, Raffy Marty on the AI-native SecOps control plane and Netwrix on automating Entra tenant destruction.
• Threat trend: Fortinet’s 2026 Global Threat Landscape Report.