Skip to content

Back to the catalog

malwaretech.comarticle

Machine Speed is a lie: stop trying to fight AI with AI

Long-form critique arguing that autonomous, self-propagating attacks (Morris Worm, SQL Slammer, Emotet, WannaCry) are decades old and that vendor claims of AI-driven "machine speed" attacks are largely hype. It uses CrowdStrike's 2026 average breakout time (29 minutes), the UK AISI evaluation of Mythos Preview (3 of 10 full compromises on an undefended range, at high token cost), and the delay between SOC alert and remediation to argue AI SOCs are a band-aid. It recommends proactive hardening (Credential Guard, LAPS, segmentation, least privilege), automatic EDR isolation and credential rotation on high-fidelity alerts, and realistic assumed-breach exercises.

TL;DR Marcus Hutchins argues "machine speed" AI attacks are marketing hype and AI SOCs are a stop-gap; proactive hardening and automatic EDR containment beat reactive AI.
Open original ↗

Organisations named here

  • AI Security Institute
  • breakout time
  • Marcus Hutchins

Technologies named here

  • Credential Guard
  • SMB
  • Windows lsass.exe credential caching
  • LAPS
  • Windows local administrator accounts with reused passwords
  • EDR
  • Enterprise Windows networks / Active Directory
  • AI SOC / SOC-as-a-Service
  • IoT devices
  • CrowdStrike 2026 Global Threat Report
  • Red team / assumed-breach exercises
  • CrowdStrike
  • Windows
  • Active Directory
  • LLM
  • Mythos

Techniques named here

  • LSASS dumping
  • Pass-the-hash
  • Initial access via automated hacking campaigns
  • Self-propagating worm spread via SMB exploit
  • Reuse of local admin passwords across machines
  • Network-wide ransomware deployment
  • Data exfiltration after breakout

Threat actors named here

  • Morris Worm
  • SQL Slammer
  • WannaCry
  • NotPetya
  • BadRabbit
  • Mirai botnets
  • PROMPTLOCK
  • Ransomware actors
  • State-sponsored espionage actors
  • Emotet
  • Mirai

Related in Blue Team & Detection