Agreed. My fairly obscure company got hit by something like this last weekend. What stood out was the speed: attackers found something small, used it to uncover something else, and pivoted to clever exploits for the new thing within minutes. It hit a dozen of our apps in parallel within the span of a day, from a rotating pool of residential proxies, Tor, GCP and Cloudflare IPs.

I'm fairly confident it was LLM-driven. The payloads and throwaway accounts had names like "PT59553 TEST IGNORE" and "PocCorp1659r2", and it adapted to error messages the way a person reading them would, just never sleeping. A non-tech company with 100x the surface area and much more valuable data could be in big trouble.

Of course I used LLMs for the defense too, and they were amazing at log forensics and fixes. The annoying part was when I asked Opus 5.5 for clear repro cases of exactly what the attackers did, I hit the cyber safeguards. Opus was trying to keep the exploits for my own bespoke applications away from me. It was happy to fix things of course, but I worry if it really can't 'think' about actual exploits, its fixes will be less informed.

billion dollar companies are not exempt from this, in fact they tend to be the worst offenders

I suspect open source projects are better off than proprietary software - they already have many eyes on them, whereas commercial software that’s not a prominent and profitable target (e.g. windows, ios) hasn’t had much attention until LLMs made attacking them significantly easier