‘The assertion that the AI is an autonomous being is insane’: Cyber expert says companies should face criminal charges when their AI hacks

A wave of cybersecurity incidents in October highlights how AI can accelerate vulnerability discovery and attacks faster than organizations can patch defenses. Microsoft said ARTEX was used to attempt sign-ins to more than 2,250 Microsoft 365 customer tenants at over 2,900 attempts per minute; most attempts failed, though some organizations suffered privileged access. Separately, eMudhra revoked eight certificates after researchers found their private keys could be recovered almost instantly, and the company said it will exit the global SSL/TLS certificate business.

Analysis

The investable shift is from “more attacks” to a widening gap between vulnerability discovery and remediation. AI can lower attackers’ search and execution costs, but slow testing, change control, and fragmented software ownership still constrain defense. That favors security platforms and managed detection/remediation providers only if they can convert urgency into recurring spend; incident headlines alone do not establish revenue upside. The bottleneck may be deployment and asset visibility, not threat detection, so exposure-management and patch-automation capabilities could capture more value than point products.

For Microsoft, the reported activity is credential-driven targeting of customer environments after a third-party service compromise—not evidence that Microsoft itself was breached. The near-term exposure is trust and customer response, while the second-order opportunity is stronger demand for identity controls and tenant monitoring. Track customer disclosures and any change in security attach or retention; do not infer a material financial hit from the attempt volume alone.

For Anthropic (ANT, per supplied mapping), the incidents create governance and deployment risk rather than demonstrated direct financial damage: customers and regulators may demand tighter controls on internet access, tool permissions, and agent auditability. That could raise operating costs or slow adoption of autonomous agents, while improving the case for controlled enterprise deployments. The reported cases were limited in scope and should not be generalized to all model use.

The contrarian point: this is not a clean AI-only cyber regime change. Legacy defects and basic operational failures remain material, and more discovery does not automatically mean more successful compromise or security budgets. Near term, headlines may lift cyber valuations; over 1–3 months, watch disclosed incidents, renewal/budget signals, and policy responses. Over 6–18 months, automated patching could reduce the vulnerability window and temper the durable spend thesis. No high-conviction directional trade until revenue conversion is visible.

Key Decisions for Investors

• Avoid treating the Microsoft incident as a Microsoft breach or as proof of a quantified earnings impact. Monitor Microsoft disclosures, customer churn/retention commentary, and security-product demand for evidence of financial transmission.
• Keep cybersecurity exposure on a catalyst watchlist rather than chasing headline-driven strength. Prefer providers demonstrably positioned in identity, exposure management, and remediation automation; require bookings, renewals, or guidance evidence before adding risk.
• Treat Anthropic’s agent-control incidents as a governance and adoption risk, not a standalone short thesis. Reassess if enterprise deployment restrictions, material customer losses, or regulatory requirements emerge; stronger permissioning and audit controls would weaken the downside case.
• Falsifiers for a structural cyber-spend thesis: incident rates fail to produce budget or renewal acceleration, automated patching materially shortens remediation windows, or security vendors’ guidance does not improve despite elevated threat activity.