Picture a worm crawling across the internet that carries its own brain. Not a payload phoning home to some command server in a basement somewhere, waiting for instructions. A worm that lands on your file server, spins up a language model right there on the box, looks around, and decides what to do next based on what it sees.

That’s not a thriller pitch. Researchers built a proof of concept of exactly that. And once I sat with the image for a minute, I realized most of how I think about endpoint defense quietly assumes the attacker is either a human at a keyboard or a dumb script following a flowchart. Neither of those assumptions is safe anymore.

Hear me out.

The shift from AI-assisted to AI-native threats

For the last couple of years, “AI in cybercrime” mostly meant humans using LLMs as productivity tools. Better phishing emails. Faster reconnaissance writeups. Polished social engineering scripts in languages the attacker doesn’t actually speak. Annoying, sometimes effective, but conceptually familiar. The human is still the agent. The model is the assistant.

AI-native is a different category. The model isn’t helping the attacker. The model is the attacker, or at least the part of it that makes decisions in the moment. When inference runs locally on the compromised host, a few things change at once.

There’s no command-and-control round trip for every decision. That’s the loud one. A lot of our detection story, from network egress monitoring to beaconing analysis, assumes the malware needs to talk to mom. If the malware can reason on its own about which file looks interesting, which account looks privileged, when to stay quiet, you lose one of the more reliable tells.

Signatures were already on life support. Behavioral baselines start getting noisier too, because “what this process does next” stops being a deterministic decision tree and starts being something closer to judgment. Bad judgment, maybe, but judgment.

I don’t want to overclaim here. A proof of concept in a research lab is not the same thing as a worm chewing through actual SMB networks tomorrow morning. But the gap between “demonstrated feasible” and “showing up in the wild” has historically been measured in months, not decades.

Vulnerability discovery at machine speed

The other half of this story is on the offense-research side. Frontier models are now autonomously identifying exploitable vulnerabilities at a pace that doesn’t really fit our existing mental models of disclosure and patch cycles.

Think about what patch management has implicitly assumed for years. A flaw gets found, usually by a human researcher or a security team. There’s a disclosure window. A vendor ships a fix. Defenders apply it. Attackers reverse-engineer the patch and start exploiting unpatched systems. The whole rhythm depends on humans being the rate limiter on discovery.

Take the human rate limit off the discovery side, and the window between “this bug exists” and “this bug is being exploited” compresses in a way our patch cadences were never built for. Monthly cycles start to look optimistic. Quarterly cycles start to look reckless.

Here’s the thing though. The same capability is, in theory, available to defenders. Code review at machine speed. Continuous fuzzing guided by something that understands intent, not just syntax. In a perfectly symmetric world, defenders use the same tools to find bugs before attackers do.

We do not live in a perfectly symmetric world. A Fortune 100 bank can staff a team to operationalize that. An SMB with one IT person who also handles the printer cannot. The asymmetry isn’t about who has access to the model. It’s about who has the people and processes to do something with it.

I keep coming back to that. The tooling gets democratized faster than the operational capacity to use it.

What this actually changes for an SMB security posture

I want to be careful here, because the temptation is to say “everything is different now, panic accordingly.” Most of what I’d tell a small business client this year is still what I’d have told them last year. Patch the things. Turn on MFA. Back things up in a way that survives ransomware. Don’t let your finance person click links.

That said, a few assumptions feel worth revisiting.

Patch windows are one. If you’ve been comfortable with “we patch within thirty days of release,” I’d at least be asking what your exposure looks like inside that window for internet-facing systems. The honest answer is usually “more than we’d like,” and the gap is widening, not closing.

Identity and segmentation get more important, not less. Lateral movement was already the part of the attack chain where defenders had the most leverage. If the thing moving laterally can actually reason about your environment instead of just running a predictable playbook, the cost of a flat network goes up. In my experience with Entra and similar identity stacks, the policy logic is rarely the hard part. The hard part is the exceptions that have quietly accumulated over years, and that’s where an adaptive attacker is going to find oxygen.

EDR coverage gaps matter more too. The machine with no agent on it, the contractor laptop, the legacy box nobody wants to touch. Those were always weak spots. They become more attractive weak spots when the attacker can recognize them as such.

And the vendor conversation. If you’re talking to an MSP or a security vendor in 2026, I’d ask them, plainly, how they’re thinking about autonomous threats. Not AI-generated phishing, which everyone has a slide on by now. Autonomous. On-device. Reasoning at the endpoint. If you get a blank stare or a pivot back to their phishing simulation product, that tells you something.

Let’s be honest about the limit though. Most SMBs cannot outspend this problem. The question isn’t “how do we build a SOC that matches the threat.” The question is which fundamentals get hardened first, and which headlines we deliberately choose to ignore until they become real.

There’s an uncomfortable symmetry in all of this. Defenders and attackers are reaching for the same tools, from the same labs, with the same capabilities. The difference is who can operationalize them faster, and on whose timeline.

For the businesses I work with, the practical question isn’t whether AI-native attacks will arrive. It’s whether we’re spending our finite attention preparing for the threat landscape we currently have, or the one that’s quietly assembling itself in research papers right now.

I don’t think those are the same answer anymore. And I’m honestly not sure most of us have caught up to that yet.