Microsoft Report Warns AI Is Accelerating Cyberattacks and Vulnerability Weaponization

Summary

Microsoft’s 2026 Digital Defense Report says threat actors are using AI to speed vulnerability weaponization, phishing, malware development and intrusions, while more autonomous attacks may be approaching.

Key points

Microsoft reports the median time from in-the-wild vulnerability discovery to weaponization has fallen below 24 hours; it estimates 2026 CVEs could reach 72,000.
Phishing accounted for 23% of investigated intrusions, up from 7% a year earlier; exploitation of public-facing applications rose from 15% to 24%.
Microsoft says state-linked groups from China, Russia, North Korea and Iran are incorporating AI into activities including vulnerability research, social engineering, malware development and infrastructure management.
The s1ngularity malware used AI coding tools to search infected machines for secrets; Microsoft says it leaked about 2,000 secrets and 20,000 files from 225 victims.
Microsoft describes PromptLock as an experimental ransomware prototype that obtains Lua scripts at runtime from an open-weights model on attacker infrastructure.
Tests in an emulated enterprise environment showed advanced models could orchestrate a 32-step attack chain and take control of the domain; Microsoft says most observed complex intrusions still involve human direction.
Microsoft warns that AI-driven ransomware and self-spreading worms may become feasible, while remediation of known vulnerabilities is lagging behind discovery.

Article Details

Publisher: Microsoft
Report Period: July 2025 to June 2026
Scope: AI use in vulnerability discovery, phishing, malware development, and intrusion operations
Sample Size: Not disclosed
Key Statistics: Median time from vulnerability discovery in the wild to weaponization has fallen to well under 24 hours.
The number of CVEs tracked for 2026 was estimated to reach 72,000, a potential record.
Phishing was the initial access method in 23% of intrusions investigated by Microsoft's incident responders, up from 7% a year earlier.
Exploits against public-facing applications accounted for 24% of intrusions, up from 15% a year earlier.
The s1ngularity malware reportedly leaked about 2,000 secrets and 20,000 files from 225 victims.