The “Cybersecurity Reckoning” refers to the point in time when AI’s ability to find flaws and bugs in our systems and defenses significantly outpaces how quickly any human could find and fix them. When that happens (though according to experts, it already has), companies and organizations will need to reckon with their outdated defenses.

This term first came about earlier this year, when Anthropic claimed its new AI model Mythos would be a “cybersecurity reckoning,” noting that it could find and exploit vulnerabilities—even ones companies had no idea existed—at an unprecedented pace. In fact, the results of the model were so alarming that they held off on releasing the technology and began working with dozens of tech companies, including Amazon, Apple, and Microsoft, to help close vulnerabilities in their software.

“This model is good at finding vulnerabilities that would be well understood and findable by security researchers,” Logan Graham, head of Frontier Red Team at Anthropic, said. “At the same time, it has found vulnerabilities, and in some cases crafted exploits, sophisticated enough that they were both missed by literally decades of security researchers, as well as all the automated tools designed to find them.”

In one instance, Anthropic claimed the model had found a 27-year-old bug in OpenBSD, an “open-source operating system that was designed to be difficult to hack.” OpenBSD’s security is in fact so well trusted that many firewalls and internet routers incorporate its technology, according to the New York Times. And yet, Mythos was able to quickly find and exploit a bug that had gone unnoticed for nearly three decades.

“There are a lot of really critical systems around the world, whether it’s physical infrastructure or things that protect your personal data, that are running on old versions of code,” continued Graham. “If these previously were mostly secure because it took a lot of human effort to attack them, does that paradigm of security even work anymore?”

That is the Cybersecurity Reckoning.

The problem is bigger than one model

What Anthropic, and eventually the cybersecurity world as a whole, recognized was that in the hands of cybercriminals, these AI tools would become an incredibly powerful weapon, one that does not begin or end with Mythos. Experts argued shortly after Anthropic’s announcement that the “reckoning” was already upon us and should be a wake-up call for any and all businesses, teams, and developers alike.

With the speed at which AI is evolving, its capabilities are constantly expanding. Hackers no longer need to be experts in software or coding to be able to find and exploit vulnerabilities in systems; anyone with access to modern-day AI tools could theoretically execute a cyberattack with only a few prompts aimed at the right target.

And it’s not just humans utilizing AI that we need to watch out for. AI is taking cyberattacks into its own hands and attacking businesses without any input or requests from humans to do so. In July, a group of over 1,000 OpenAI agents, independently of any human involvement or prompting, “circumvented controls designed to isolate them from the internet” (AKA, they broke out of their cage) and decided together to hack HuggingFace, a tech and AI company.

“The models, operating under reduced safeguards, took actions that were misaligned with the goals of their assigned tasks—they communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems,” said OpenAI’s report on the incident. Thankfully, the consequences of the attack were limited, but as many reporters pointed out, could have been much worse if the bots had taken aim at, say, a hospital instead.

What Anthropic called a “Cybersecurity Reckoning,” OpenAI, in the aftermath of the HuggingFace incident, is calling a “warning shot” for the world—evidence that unless safeguards are put in place, AI can and will circumvent any and all security vulnerabilities and exploit weaknesses without a human having to lift a finger.

What do we do?

AI won’t be slowing down any time soon, so unfortunately, the problem won’t resolve itself. OpenAI admits its models are only getting better at executing such attacks, and acknowledges that others will soon follow, reaching those same capabilities. However, just as AI can be a terrible weapon in the hands of a hacker (or in the hands of its own rogue agents), it can also be a strong shield to ward off such attacks.

To stand a chance against these attacks, organizations need to fight fire with fire. As OpenAI stated, “Preventing future incidents will require sustained investment in the alignment and control of sophisticated AI systems, as well as security and other safeguards that operate at the speed of the AI agents themselves.” Or, in other words, it’s time to reckon with our cybersecurity.

Credit unions need to take a long and hard look at their defense systems and decide how they stack up in comparison to the adversary’s toolset. Times and technologies have changed. What might have been considered powerful and airtight cybersecurity even just two or three years ago may be beyond outdated in today’s environment. Now is the time to sit down and start assessing what needs to be done to bring credit union cybersecurity procedures up to snuff.

Schedule meetings, talk to experts. Where are your vulnerabilities? Are you using AI to help protect your network? If you aren’t already, the odds are you will need to, and soon. Do you know any credit unions that are currently using AI and partnering with CUSOs or third-party vendors to bring them this technology? What do they think? Chat with your peers to figure out what’s working for them or what vulnerabilities they might have found in their own systems that might also be in yours.

Let’s face the reckoning

The Cybersecurity Reckoning can feel like a dystopian novel turned reality, but really, it’s an opportunity on our part to start patching up flaws in our systems that may have gone unnoticed for years and strengthen vulnerabilities we may have let slide by. It’s the chance to figure out how to make this new (and admittedly, sometimes frightening) technology work in our favor and at our defense.

OpenAI concluded in its post that “Both model developers and cyberdefenders more broadly will have to prepare for AI-enabled attackers that work faster, at a larger scale, and with better coordination than human attackers.” How prepared is your credit union for this future?