If the vulnpocalypse is the apocalypse, where are the agentic attacker hordes? (joshuasaxe181906.substack.com)

The article delves into the current state of cybersecurity in light of advancing AI capabilities, particularly addressing the PHP2Shell incident. While the tech community perceives such events as harbingers of doom, the author argues that they reflect a trend of improved detection and patching of vulnerabilities rather than an escalation in cybercrime. Despite the surge in AI's cybersecurity capabilities post-2022, data indicates that incidents of significant damages have not seen a corresponding increase, raising questions about the actual effectiveness and threat level of AI-enhanced cyberattacks. The piece highlights several reasons for this phenomenon: cybercriminals often lack the sophistication imagined by the safety community, relying instead on unskilled labor from low-income regions and facing substantial barriers, including law enforcement and talent shortages. Moreover, governments struggle to adapt rapidly to new technologies and operationalize them effectively. The author warns that while the current landscape may seem stable, the potential for catastrophic damages from AI-driven cybercrime and conflicts remains, emphasizing the urgency for the AI community to prepare for possible future threats.