Agreed. My fairly obscure company got hit by something like this last weekend. What stood out was the speed: attackers found something small, used it to uncover something else, and pivoted to clever exploits for the new thing within minutes. It hit a dozen of our apps in parallel within the span of a day, from a rotating pool of residential proxies, Tor, GCP and Cloudflare IPs.
I'm fairly confident it was LLM-driven. The payloads and throwaway accounts had names like "PT59553 TEST IGNORE" and "PocCorp1659r2", and it adapted to error messages the way a person reading them would, just never sleeping. A non-tech company with 100x the surface area and much more valuable data could be in big trouble.
Of course I used LLMs for the defense too, and they were amazing at log forensics and fixes. The annoying part was when I asked Opus 5.5 for clear repro cases of exactly what the attackers did, I hit the cyber safeguards. Opus was trying to keep the exploits for my own bespoke applications away from me. It was happy to fix things of course, but I worry if it really can't 'think' about actual exploits, its fixes will be less informed.