The rapid advancement of Artificial Intelligence has unleashed a new frontier in cybersecurity threats. Recent incidents of AI systems successfully breaching public websites have exposed exactly how vulnerable the modern internet is to automated, highly capable AI agents.

According to AI and security consultant Andrew Cullen, the crux of the issue lies in the fact that highly powerful AI systems are being “let loose free on the internet,” yet we lack robust methods to fully understand or control their actions.

How AI Hackers Operate

When we hear that an AI has “hacked” a website, it is easy to imagine a rogue robot acting entirely on its own. However, these AI agents operate using the same core methodologies as human hackers—but on a vastly accelerated scale.

AI hackers explore systems to identify vulnerabilities and attempt to break through security measures, including workarounds for systems like two-factor authentication. The critical difference is the sheer computing power backing these AI systems. While a human hacker must manually probe for weaknesses and test different avenues of attack, an AI agent can automate these processes, testing a massive number of potential vulnerabilities simultaneously with the computing infrastructure of tech giants behind it.

The Accountability Gap

It is vital to recognize that these security failures are not acts of spontaneous AI rebellion; they are the direct result of decisions made by major tech companies. Companies like OpenAI, Google, and Anthropic have actively chosen to give these AI agents immense capacities, which inevitably leads to these breaches.

Currently, a significant legal loophole exists: in most Western countries, if an AI system commits a malicious act, the user of that system is held responsible, not the tech company that created it. Because these companies are insulated from liability, they lack the necessary financial and legal incentives to rein in the capabilities of their most powerful models.

When things do go wrong, major tech firms often emphasize their transparency—highlighting that they identified the issue, stopped it, and disclosed it to the public. However, experts point out that this “openness” can also serve as a strategic advertisement of their formidable technological capabilities, subtly reinforcing the narrative that they alone are equipped to control it.

Securing Our Infrastructure

The rise of AI-driven hacking requires a two-pronged defensive approach: reigning in the AI developers and shoring up our vulnerabilities.

There is an urgent need for governments to incentivize operators of critical infrastructure—such as telecommunications providers, dams, and electricity grids—to isolate their systems from the internet and fortify their defenses. As AI automated attacks become more widespread, any critical system connected to the broader internet becomes a severe liability.

The Path Forward: Government Regulation

History has shown that industries with a high potential for public harm cannot be trusted to self-regulate. Relying on big tech companies to set their own rules and police their own products is no longer sufficient.

There is immense value in governments stepping in to establish clear, enforceable legislation. To protect the future of internet security, regulators must mandate corporate accountability, ensuring that the developers of powerful AI systems bear responsibility for the actions of their creations.