Q. Can AI hack? How far have AI cyberattacks really come?

When hackers pushed French supermarket fridges up to 50°C (122°F) overnight, an obvious question followed: was AI (artificial intelligence) behind it? Some articles about the French supermarket fridge hack carried a separate warning that AI could one day go after smart appliances. So can AI hack? And if it can, how far has AI hacking really come?

The short answer: AI is already being used in hacking, but most confirmed cases make old attacks faster and cheaper, and the same AI is also being used on defense to find and fix weak spots. Cases where AI did most of the attack work have started to appear, too. As for the French fridges, there is no confirmation that AI was involved. Reports point to a security hole in refrigeration-control software on equipment running outdated firmware (a device’s built-in software).

What are some real AI hacking examples?

The most common cases involve words and voices: phishing messages (fake emails or texts) polished with AI, and a relative’s voice cloned from a short clip. In 2024, an Arup employee in Hong Kong sent about HK$200 million (around US$25 million) after a video call in which the “colleagues” giving instructions were fakes. The British engineering firm confirmed that deepfakes had been used.

AI companies also publish regular reports on misuse of their own tools. OpenAI’s October 2025 report said attackers were bolting AI onto old playbooks to move faster, with no evidence that its models gave them new offensive capabilities. By OpenAI’s own estimate, ChatGPT is used to identify scams up to three times more often than it is used for scams. Anthropic’s August 2025 report described a criminal who used its AI coding tool, Claude Code, to steal data from at least 17 organizations, including healthcare and government bodies, and then demanded money.

Can AI hack on its own, without humans?

Some cases go further. In November 2025, Anthropic said it had detected and stopped a cyber-espionage campaign by a group it assessed to be Chinese state-sponsored, in which AI carried out 80-90% of the work. People chose the targets and stepped in only at a few key decision points. The group went after about 30 targets and succeeded in a small number of cases. The AI also sometimes hallucinated, making up passwords or results it had never obtained, which Anthropic said remains an obstacle to fully automated attacks.

In April 2026, Anthropic said its new model, Claude Mythos Preview, had found thousands of high-severity vulnerabilities, including some in every major operating system and web browser, and that it would not make the model generally available. Instead, Anthropic let companies such as Apple and Google use it first for defense, under Project Glasswing. These figures are Anthropic’s own. The company’s September 2026 report said many attacks now had several AI agents splitting up the work, but people were still heavily involved in picking targets and deciding how to cash in.

How is AI used in cybersecurity defense?

The same technology works for defenders. The best-known showcase is the AI Cyber Challenge run by DARPA (Defense Advanced Research Projects Agency), the US Defense Department’s research agency: a contest to see whether AI can find vulnerabilities in open-source software (software whose code is public) and write patches for them on its own. At the August 2025 final, Team Atlanta, with researchers from Georgia Tech, Samsung Research and South Korea’s KAIST (Korea Advanced Institute of Science and Technology) and POSTECH (Pohang University of Science and Technology), won the $4 million top prize, and Theori, a team of researchers in the US and South Korea, came third. The finalists’ systems found 54 of the vulnerabilities planted for the contest and patched 43, and also turned up 18 real ones nobody had known about. A patch took 45 minutes on average.

Side by side, it looks like this:

Area	AI used for attack	AI used for defense
Text and voice	Phishing messages, fake voices of family or bosses	Spotting scam messages
Code	Writing and editing malware	Writing patches automatically
Vulnerabilities	Finding gaps to break in	Finding and fixing them before an attack
Human role	Choosing targets, key decisions	Confirming flaws, rolling out patches
Key example	Spy campaign Anthropic stopped (2025)	DARPA AI Cyber Challenge (2025), Project Glasswing (2026)

The row to watch is the human role. In its May 2026 progress update on Project Glasswing, Anthropic said the bottleneck is now how fast people can check and fix flaws, not how fast AI can find them.

What is prompt injection?

AI itself can also be a target, most famously through prompt injection. A prompt is an instruction given to an AI. If someone hides instructions inside a web page, email or document, an AI that reads it may do something its user never wanted. OWASP (Open Worldwide Application Security Project), a web security nonprofit, ranked prompt injection first in its 2025 Top 10 list of security risks for apps built on large language models, the technology behind chatbots like ChatGPT. The more power an AI assistant has, such as sending emails or making payments, the bigger the possible damage.

How can you protect yourself from AI scams?

For voice-cloning scams, the FBI (Federal Bureau of Investigation) recommends agreeing on a secret word or phrase with your family. If a call urgently asks for money, hang up and call back on a number you already know, even if the voice sounds familiar. Posting less of your voice and photos publicly also helps.

Basic habits matter, too. AI makes attacks faster, but serious damage still often starts with devices that stopped getting updates and with basic security that was skipped. The French fridges, after all, were reportedly running outdated firmware. At home, turn on automatic updates for your router and smart devices, and change any default password.

In short

AI is already used in hacking, sometimes doing most of the attack work, but it also helps defenders find and fix holes first. As the French fridge attack shows, neglected devices with old firmware can still lead to serious damage, so updates and the habit of double-checking remain the most basic defenses in the age of AI.