[What’s Next] The number of global hacker attacks has surged by 70% in two years, all thanks to AI. Attacks are now measured in seconds, and a McKinsey system was breached in just 2 hours. How great is the risk faced by enterprises? How can they avoid the leakage of precious data?

When AI Agents become hackers that never sleep 24 hours a day, is company data still safe? The truth is, generative AI is quietly triggering a cybersecurity crisis.

“In the past, an unlocked door might not have been discovered; now, hackers are constantly watching to see if you have locked up,” says Chin-jui Chang, Chairman of PwC Smart Risk Management Consulting Co.

This is not alarmism. The cybersecurity crisis enterprises face in the AI era is increasing by the day.

According to the 2026 Cybersecurity Report by Israeli cybersecurity firm Check Point and the 2026 Global Threat Report by American cybersecurity firm CrowdStrike, generative AI has increased the speed at which hackers breach systems by 65% over the past year. The fastest breach took only 27 seconds, and the total volume of cyberattacks has exploded by 70% within two years.

AI Hackers Shift to Second-Level Attacks

In the past, for a hacker to complete a “high-quality” espionage attack, they had to spend weeks or even months manually searching for vulnerabilities, selecting targets, and planning routes. They then had to patiently execute social engineering deception and even manually write customized malicious programs to evade different types of antivirus detection.

Now, however, an intrusion automatically executed by an AI agent is measured in seconds. While defenders are still waiting for a warning message to pop up on the monitoring screen, the AI has completed the attack in an instant.

In February this year, to demonstrate its AI auditing capabilities, the cybersecurity startup CodeWall used its developed AI agent to successfully identify system weaknesses in McKinsey’s internal AI platform “Lilli” within just 2 hours. It demonstrated the potential risk of accessing tens of millions of conversation records and tens of thousands of documents.

McKinsey fixed the issue immediately after being notified; therefore, although there was no actual damage, the event drew significant attention because no human hackers were involved throughout the entire process.

The AI giant Anthropic also revealed last October that the Chinese-supported hacker group “GTG-1002” has successfully utilized AI to launch global espionage operations, with up to 80% of the attack tasks completed entirely by AI independently. “Now, one hacker can control multiple AI assistants, and the speed and volume of attacks have increased significantly,” says Chang Chin-jui.

Taiwan Enterprises Attacked 7,000 Times per Week on Average

As a geopolitical hotspot and a semiconductor manufacturing kingdom, Taiwan’s “Hardware and Semiconductor Industry” is the most severely attacked in Asia. According to Check Point, each organization in Taiwan suffers an average of 7,393 attacks per week, far ahead of China’s 5,631.

“Last year, the number of backdoor programs and attack tools generated by AI significantly increased,” warned Vincent Tsai, Founder and CEO of TeamT5.

Founded in 2017, TeamT5 was the first cybersecurity company in Taiwan to provide “Threat Intelligence” reports. It specializes in tracking the attack patterns of Asia-Pacific hacker groups, including over 100 attack groups from China. Its clients cover Taiwan and Japan government agencies, large financial institutions, and high-tech industries, providing early warning services and endpoint anti-ransomware protection; it can be described as a “private detective” for enterprises and governments.

Tsai analysis shows that half of the cyberattacks Taiwan suffers are cybercrimes, with ransom being the majority. This also includes stealing data for resale, stealing virtual currency, credit card fraud, and selling personal data to scam groups.

The other half consists of cyber espionage, most of which are supported by national powers. The targets are trade secrets, military secrets, and large-scale personal data. Tsai observed that Taiwan has long been targeted by China, and the targets are no longer limited to government and defense; e-commerce, media, supply chain manufacturers, and cybersecurity companies themselves are all targets.

Tsai believes that Taiwan’s network security will only become increasingly severe. Besides AI technological innovation, under the intensifying US-China confrontation, major powers will continue to invest more resources because the return on investment for cyber espionage is much higher than that of traditional military actions.

“Currently, both attackers and defenders are using AI; it’s a matter of who uses it better,” says Tsai. TeamT5 is also actively introducing AI to shorten the cycle from intelligence research to delivery to customers, and using AI models to help analysts predict hacker behavior patterns, providing customers with suggestions for proactive deployment.

 

AI Agents Like “OpenClaw” (Crayfish) Become the Greatest Security Loopholes

Hackers have used AI to significantly enhance their capabilities. Even if defenders patrol 24 hours a day, there will always be something that slips through. Therefore, how to guard the “last mile” of cybersecurity through “verification” has become a top priority.

“That’s why everyone is talking about AI!” says Cheng-I Lin, Founder and Chairman of Lydsec Keypasco. He recently returned to Taiwan from the United States and shared his observations from the RSA Conference (RSAC), a major annual cybersecurity summit.

Founded in 2012, Lydsec Keypasco’s main business is Multi-Factor Authentication (MFA) technology and systems. Acting as the gatekeeper for the last mile of cybersecurity, it holds over half of the market share for identity verification in Taiwan’s financial mobile banking apps, with overseas markets spanning Europe, the Middle East, Japan, and India.

Lin believes that in addition to the increased frequency of cyberattacks, Deepfake technology has made verification more difficult. For example, a hacker needs only to capture about 20 seconds of voice or a single image to forge extremely realistic voiceprints and faces through generative AI, easily bypassing traditional single biometric identification.

Lin points out that the security issues of AI assistants are the next major battlefield for the cybersecurity industry.

Furthermore, with the arrival of the AI Agent era, AI assistants like OpenClaw (Crayfish) might execute sensitive operations in the background that were not intended by the human user after obtaining authorization. How to ensure the assistant’s behavior is controlled and verify that the person issuing the command is indeed the owner are urgent loopholes to be solved.

The MFA technology Lydsec Keypasco excels at can ensure the person accessing data or issuing commands is the owner through multi-factor verification, such as hardware information from CPUs or hard drives, geographical location, and behavioral patterns.

Currently, Lydsec Keypasco, like many other cybersecurity vendors, is actively trying to solve the security problems of AI assistants. “Identity verification in the AI era can no longer be a one-time action; it needs to be monitored at all times,” Lin emphasized.

In the AI era, private data is a company’s most valuable asset. Establishing cybersecurity awareness and protecting data means protecting one’s own competitiveness.

Cybersecurity Management Upgrades from IT to the Board Level

“Many companies mistakenly think cybersecurity is a technical issue, but management actually accounts for half of it, and it’s even more important,” Tsai observed.

Tsai noticed that in many companies, after a cybersecurity incident occurs, the cybersecurity department asks other departments to cooperate with the investigation but cannot push it forward because they lack sufficient authorization. This causes response time to slip away in vain. When larger-scale enterprises are victimized, they also need to deal with the media, legal affairs, investigative agencies, and regulatory authorities simultaneously, which often leaves a small cybersecurity team overwhelmed.

“AI risk should not just be an IT issue, but a part of the overall company risk management,” warned Chang Chin-jui, who has been a cybersecurity consultant for over 10 years. Cybersecurity must be an issue discussed at the board level to obtain resource authorization.

Chang also reminded that cybersecurity is not just about firefighting; it’s more about fire prevention. It is necessary to improve the ability to prevent attacks in advance. Companies also need to inventory which AI tools they have, which data are core assets, and which external vendors they are connected to that pose a leakage risk. “Buying cybersecurity tools does not equal being safe,” he said.

When AI agents become virtual hackers on standby at all times, the defender’s chance of winning lies not in building higher walls, but in stricter verification, more sensitive management, and a never-slackening sense of crisis. The best defense is not technology, but seeing the risk and actively facing it.

What’s Next?

Three Defensive Lines Enterprises Must Guard

Defensive Transformation: AI agents make attacks as fast as seconds, rendering one-time defenses ineffective. When processing sensitive information, enterprises must perform real-time identity verification and continuous behavior monitoring.

Strategic Early Warning: Companies shouldn’t just buy equipment; they must actively predict hacker behavior and prevent attacks in advance to protect trade secrets.

Management Upgrade: High-level management must provide authorization to break down departmental silos and systematically inventory AI tools and supply chain risks, viewing cybersecurity as an operational risk.

Original Article: https://www.cw.com.tw/article/5140589