The attacker's cost curve has collapsed

There is a sentence in Anthropic's September 2026 threat intelligence report that deserves to be read twice by anyone responsible for a security programme.

Describing an actor assessed as a suspected state-sponsored campaign, consistent with public reporting linking it to Midnight Blizzard, the report describes AI agents monitoring whether the actor's own malware had been detected by security products. Where it had, the agents autonomously modified and rebuilt the tooling, and continued iterating until it was undetected. Only then was it staged for live operations.

Read that as a security practitioner and something breaks. The entire defensive tradition of signature-based detection rests on a simple economic proposition: if the adversary has to rebuild their tool every time we detect it, we impose a cost on them. That cost was the mechanism. It was never the signature itself.

When the rebuild is automated, the cost approaches zero. The signature still works — against the version it was written for.

What the report actually covers

The report covers activity Anthropic's Threat Intelligence team disrupted between December 2025 and August 2026, across seven areas of harm. The cyber section is the relevant one here, and its central finding is subtler than the headlines suggest.

Anthropic's analysts argue that commentary over-focuses on AI developing exploits at scale. The more pronounced risk, they write, sits across the cyber kill chain: adversaries operating faster, across a broader and deeper surface, with fewer resources.

Three observations from the cases:

• The labour gap has collapsed. AI has closed the skills and tooling gap that separated well-resourced state operations from individuals. A hacktivist with stolen API keys, disparate financially motivated criminals, and a state espionage operator each sustained multi-victim campaigns that a year earlier would have required many skilled operators.
• The operating model has proliferated. An autonomous attack model documented in November 2025 has now spread across every class of actor investigated. Publicly available offensive agent frameworks reproduce much of the same scaffolding for anyone who downloads them.
• Obscurity is dead. The report is blunt: unique and obscure configurations are made clear and exploitable, and security through obscurity is no longer viable. Everything connected to the internet is a potential target.

If your defensive strategy depends on the adversary finding your environment hard to understand, that strategy has an expiry date, and it has passed.

The same pattern, from the other direction

This is not one vendor's finding. Reported earlier in October 2026, OpenAI notified more than 100 organisations about unauthorised activity involving its AI agents as part of a large-scale investigation — a reminder that agentic capability is not a controlled substance, and that the accounts and keys around these systems are themselves attack surface.

Meanwhile the volume keeps rising. Microsoft's October 2026 Patch Tuesday addressed 1,411 vulnerabilities, including three zero-days, one of them actively exploited.

Put those together. More vulnerabilities, faster and cheaper to find; tooling that adapts to detection automatically; and an attacker population that no longer needs to be large or skilled to be effective. Nothing in that combination is improved by buying more detection content.

The three things that still work

None of this is hopeless, but the effective responses are structural rather than procurement-shaped.

Impose cost somewhere the adversary cannot automate away

Detection content is automatable against. Positioning is not. If your defensive posture is generic — the same controls, the same stack, the same architecture as everyone else — then the adversary's automated evasion work is amortised across thousands of targets. Segmentation, identity architecture and privilege design that is specific to your environment impose work that has to be redone for you, and only you. That is a real cost.

Shorten your own loop, not just your detection

If the adversary re-tools in hours, a 30-day patch cycle is not a control, it is a disclosure timetable. The organisations coping best have automated the boring classes of remediation and pre-authorised the change process for the rest, so that speed is a property of the system rather than a function of whose calendar the change lands on.

Move earlier in the kill chain

The one part of this the adversary cannot automate is the part before the tooling exists: targeting, infrastructure acquisition, reconnaissance. That phase is long, it is observable from outside the perimeter, and it is where pre-emptive intelligence operates. Knowing a named actor is preparing against you changes every downstream decision — what you patch first, which supplier you call, what you tell the board.

What to tell the board on Monday

Avoid the AI-arms-race framing; it invites a budget conversation with no decision in it. The decision worth putting to a board is narrower:

Our detection content is now a depreciating asset, and our remediation speed is the control that replaces it. Which means funding automation, identity architecture and early-warning intelligence — and accepting that the alert queue will keep growing regardless of how much you spend on it.

Blueridge works with security leadership across the GCC on threat-informed defence, third-party exposure and the operating model change that AI-driven adversaries now require.