When AI becomes a double-edged sword: The global cybersecurity landscape is being redefined.

When AI Becomes a Double-Edged Sword: The Global Cybersecurity Landscape Is Being Redefined

This week, a series of seemingly isolated security incidents point to a common trend: artificial intelligence is fundamentally changing the pace and symmetry of cyber offense and defense. From Chinese blacklisted company 360 claiming to have developed a Mythos-like AI cyber weapon, to the Five Eyes issuing an urgent AI threat warning, to the White House directly intervening in the release of OpenAI's frontier model—these signals, taken together, reveal a new era of cybersecurity accelerated by AI.

Offense: AI Weaponization Accelerates, Barriers Lower

The CEO of Chinese cybersecurity company 360 announced with great fanfare that its developed AI system, "Dragon Slayer," possesses vulnerability discovery capabilities comparable to Western frontier model Mythos—the first time a Chinese entity has publicly acknowledged using AI for cyber breaches. Although he conceded that the AI itself may not be as powerful as Mythos, when combined with 360's other technologies, its actual attack capability poses a serious threat to enterprise and government networks. This announcement comes against the backdrop of 360 already being on a blacklist, indicating that state-backed AI cyber capabilities are moving from behind the scenes to center stage.

At the same time, the Five Eyes' joint warning provides a broader context for this trend: frontier AI models have compressed the threat timeline from years to months. By automating vulnerability research and exploit development, these models allow low-skilled cybercriminals to obtain offensive tools previously available only to advanced APT groups. Traditional perimeter-based defense systems are becoming ineffective against machine-speed attacks.

A more specific case involves Russian authorities using Cellebrite mobile forensics software to crack the iPhones of opposition activists. Although the Israeli company canceled its Russian contract in 2021, legacy devices were still used to extract Telegram and WhatsApp data, followed by targeted phishing attacks by the state-backed APT group ColdRiver. This demonstrates how the combination of commercial tools and state power can strengthen cyber infiltration.

Defense: AI Disrupts Analysis, Strategy Lags

On the defensive side, AI also brings new challenges. A Rust backdoor named macOS.Gaslight has been attributed to North Korean threat actors. Its unique feature is the use of adversarial prompt injection techniques, embedding dozens of deceptive system error messages specifically designed to disrupt LLM-assisted analysis tools, causing them to automatically terminate investigations. This type of attack against AI analysis processes is entirely novel, indicating that attackers have begun to systematically undermine automated defense systems.In the face of this situation, the defensive side's strategic adjustments appear lagging. After experiencing large-scale layoffs, the U.S. CISA is planning to recruit about 600 professionals to rebuild its team, but the permanent leadership position has been vacant for a year and a half, reflecting the government's chaos in security planning. Meanwhile, the White House's intervention in OpenAI's GPT-5.6 model — requiring customer-by-customer approval based on national security — exposes the awkwardness of regulation in the face of technological leaps.

Economic Cost: Data Breaches and Layoffs in Parallel

The economic impact of data breaches is amplifying. India's Tata Electronics suffered an attack from the ransomware group World Leaks, with over 630GB of proprietary files released, including manufacturing specifications, component drawings, and confidential designs for Apple and Tesla. This incident not only exposes supply chain security vulnerabilities but also indicates that intellectual property theft targeting manufacturing has become part of a national-level economic war.

At the same time, the security industry itself is undergoing structural adjustments. Snyk announced layoffs and organizational restructuring, unifying R&D around four areas and streamlining leadership layers to accelerate decision-making. This shows that even security startups considered rapidly growing cannot ignore market competition and efficiency pressures.

Rule of Law and Crime: Pleading Guilty and Verification

Two members of the UK-based Scattered Spider pleaded guilty for the 2024 attack on Transport for London (TfL), which caused the automatic refund system to go offline, forced all employees to reset passwords, and resulted in millions of dollars in losses. This case demonstrates that as law enforcement cooperation strengthens, members of cybercrime gangs will eventually face legal consequences.

Also noteworthy is Google's announcement that from September 30, 2026, it will implement an Android developer identity verification framework on seven major app distribution platforms, including automatic registration API and enhanced sideloading processes, aimed at combating fraud and forced installations. This is an important step for platforms to proactively improve security foundations.

Conclusion: Accelerating Game

The picture painted by this week's news is clear and unsettling: AI is simultaneously enhancing the power, speed, and accessibility of attacks, while defenders lag in tools, organization, and regulation. From the urgent warnings of the Five Eyes alliance to the White House's model intervention, from 360's AI weapon to North Korea's backdoor innovation, cyberspace is entering an arms race driven by machine speed. For enterprises and individuals, zero-trust architecture, rapid patch cycles, and legacy system retirement are no longer options but necessities for survival.

• Sources:
• SecurityWeek: In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs