AI-COVID26: it feels like December 2019 again

Remember late 2019? A strange pneumonia in a faraway city flickered through the news. A couple of paragraphs somewhere between sports and the weather. Specialists grew wary; everyone else kept scrolling.

On 31 December 2019, the WHO learned about these cases from a statement on a local health commission's website. On 11 March 2020, it called what was happening a pandemic. Ten weeks passed between those two dates.

For the past few weeks I've worked on the security of my projects every day. Several of my colleagues are in the same situation: rootkits, web shells, constant attacks on infrastructure.

I think cybersecurity is in that same December right now. AI has made stronger not only us, but also those who attack us. For now it looks like isolated cases and headlines about tech giants, but the wave is heading for everyone.

One caveat up front: COVID took millions of lives; this is about servers and money. I'm only comparing how the wave moves.

The first cases are already here

In autumn 2025, Anthropic described an espionage campaign run almost entirely by AI. Around 30 targets, 80–90% of the technical work done by agents: reconnaissance, finding vulnerabilities, exploitation, credential harvesting, data exfiltration. Humans were left to pick targets and approve key steps. At its peak it ran several operations per second, and the tools were ordinary, openly available ones.

The targets included tech companies, financial institutions, chemical manufacturers and government agencies. That same summer, another attacker used AI to extort at least 17 organisations in healthcare, emergency services, government and religious institutions. The list already looks like a cross-section of the whole economy.

Speed changed the most

CrowdStrike reports that in 2025 cybercriminals moved from initial intrusion to neighbouring systems in 29 minutes on average, and the fastest in 27 seconds. Activity by adversaries using AI grew 89% in a year.

Mandiant measures something different, but the picture is the same. In 2022, more than 8 hours passed between initial access and its hand-off to the next group; in 2025, 22 seconds. Vulnerabilities are now exploited on average 7 days before a patch is released.

The biggest players have noticed

In April 2026, the US Treasury Secretary and the Fed chair urgently convened the heads of America's largest banks over the risks posed by the new Mythos model. The same week, Project Glasswing brought together Apple, Microsoft, Google, Amazon, JPMorganChase and others to protect the world's most critical software. According to Anthropic, the model has already found thousands of serious vulnerabilities, including in every major operating system and browser.

These are the early warning signs. The biggest players have started preparing, while mid-sized businesses read about it like news from a faraway city.

Too early to panic, time to prepare

To be honest, this isn't March 2020 yet. Mandiant says plainly that it doesn't consider 2025 the year breaches became a direct result of AI. And Anthropic notes that the AI often overstated its findings and sometimes made up data, so the attackers had to double-check everything.

But in December 2019 it was also too early to panic. And that was exactly when preparing was cheapest. Anthropic says the same: the barrier to entry has dropped, and less experienced groups can now potentially run attacks like this on their own.

What the first AI-run campaign looked like

Here's what struck me most in Anthropic's report.

• The model was talked into it. The operators posed as employees of a security firm running tests. The attack was split into small tasks, each of which looked harmless on its own.
• Nothing exotic. Scanners, password crackers, open-source pentesting tools. The only new thing was the layer orchestrating it all. That's why Anthropic expects the approach to spread quickly.
• The human worked in minutes. In two examples from the report, the AI worked for 1–4 and 2–6 hours, while the operator spent 2–10 and 5–20 minutes reviewing results and approving the next step.
• The weak spot: hallucinations. The AI claimed credentials that didn't work and secrets that turned out to be public. Every result had to be checked.

Why we'll have to answer in kind

The arithmetic is simple. An attacker needs minutes, sometimes seconds. In that time the on-call engineer can barely wake up and find a laptop. You can't defend at that pace by hand.

For me, the answer comes down to three things:

• See. Monitoring that looks for signs of compromise, not just load and uptime.
• Triage with agents. AI sorts alerts and reads code, because there won't be enough people for this flow. According to IBM's 2025 report, companies that use AI and automation extensively in security shorten the breach lifecycle by 80 days and save $1.9 million on average.
• Change processes. Who makes the call, what permissions an agent has, what happens after every finding. Without that, agents just produce noise faster.

The same pattern the attackers used works for us: an agent does hours of work, a human confirms the key steps in minutes. And a second agent that tries to refute the first, because we'll have to verify AI's conclusions too.

That's what I'm working on right now: rolling out new monitoring tools. The most uncomfortable finding of this work: a green dashboard tells you almost nothing about whether a server is compromised.

What's next

Every week, a new chapter of this wave, stage by stage: testing, the asymptomatic, the red zone, the doctors, hygiene, the new normal.

Is this already being discussed at your company? Or is it still news from a faraway city?