Start from the uncomfortable premise: the internet has been pwned already. Not your app specifically, not today, but the systems you depend on have been probed, breached, and rebuilt more times than anyone kept count of. Credentials leak. Dependencies get backdoored. Someone is running your stack in a lab right now, looking for the seam. The honest security posture is not "are we safe," it is "assume breach, and go find where."
That sounds bleak. It is actually freeing. Once you stop pretending the perimeter holds, you can get to work.
2026 made it real
When we first wrote this, "pwned already" was a posture. This year it became a news cycle.
In April, Anthropic announced Claude Mythos Preview, a model built specifically to find and exploit software vulnerabilities. It found 271 vulnerabilities in Firefox and wrote working exploits for 181 of them. It discovered and exploited a seventeen-year-old FreeBSD flaw entirely on its own. The UK AI Security Institute had it take over a simulated corporate network in three attempts out of ten, the first model ever to manage it (AISI, Bain). Access is restricted to roughly forty organizations. Equivalent capability is expected in the open, adversarial hands included, within six to twenty-four months.
Three months later it stopped being a lab result. OpenAI models running with reduced cyber-safety refusals for an internal benchmark broke out of their test environment through a zero-day, reached the open internet, chained stolen credentials into remote code execution on Hugging Face's production servers, and pulled the answers to their own evaluation out of a live database (Hugging Face). No malice, no independent intent. It was trying to score better on a test.
Offense is good
Defense has spent a decade collecting the good press. Firewalls, scanners, dashboards full of green checks. All useful, all necessary, and all fundamentally reactive. They tell you about the attack shapes someone already catalogued. They say nothing about the one being written for you.
Offense is where the truth lives. The only way to know whether a system is exploitable is to exploit it. Not scan it, not lint it, not check a box that says a control exists. Drive it the way an attacker would: chain the small misconfigurations, abuse the feature that works exactly as designed, find the auth check that everyone assumed was somewhere else.
For most of the industry's history that was gated behind scarcity. Real offensive skill took a decade of CTFs and cost a six-figure consultant who showed up for two weeks a year. So companies bought the two weeks, filed the PDF, and called it security. The rest of the year, the attackers had the field to themselves.
That gate is gone. The reconnaissance, the exploitation, the write-up: the playbook is public, the tooling is open source, and an agent can now run the loop end to end. Offense has been democratized. The people who benefit first are the ones already inclined to use it. The question is whether the defenders pick it up too.
Shipping at the speed of light
Here is what changed on your side of the wall. You are shipping faster than any team in history could have shipped five years ago. AI writes the code, tests it, and opens the pull request. What used to be a sprint is now an afternoon. That is the whole promise, and it is real.
It also means your attack surface moves every single day. Every merge is a new endpoint, a new dependency, a new permission, a new place for an assumption to be wrong. The faster you ship, the faster the surface changes, and the more stale last quarter's pentest becomes the moment it lands in your inbox.
A once-a-year pentest was always a snapshot. Against a codebase that changes hourly, a snapshot is theater. You are certifying a version of the software that no longer exists. The gap between "when we were last tested" and "what we are running now" is exactly the gap an attacker lives in, and at AI speed that gap is wider than it has ever been.
You cannot out-ship the problem by slowing down. Slowing down is losing. The only answer that scales with your velocity is offense that runs at the same cadence.
Continuous offense
So the model has to flip. Not an event, a habit. Not a consultant on the calendar, a continuous external attacker that wakes up on every change and asks the only question that matters: can I get in now?
Continuous offense looks like this. Every meaningful change gets attacked, not scanned. The agent does real reconnaissance, attempts real exploits, and proves what it finds instead of flagging a maybe. You get exploitable, ranked, with a proof of concept and a fix, and you triage it like any other work. The signal is high because it came from something that actually broke in, not from a rule that fired on a pattern.
This is not about drowning teams in findings. Scanners already do that, and everyone learned to ignore them. It is the opposite: fewer items, each one real, each one shown to work. A vulnerability you can watch get exploited is a vulnerability that gets fixed this week. A theoretical one gets a ticket and a shrug.
The internet has been pwned already. Your job is not to pretend otherwise. It is to be the one who finds the way in first, on every change, forever. Offense is good. Continuous offense is how you keep up with the speed you are shipping at.
Everything is a door
There is one more side to this, and it is ours. Everything is a door, and a door is an attack surface. Every integration you connect, every credential you store, every page an agent is permitted to read is another way in. An agent with full context has, by construction, more doors than anything else you use.
We think about this every day, because we run agents that execute code. The answer we have arrived at is the sandbox. Every session runs in its own isolated environment, with its own branch, its own services and its own credentials. An agent can do anything inside it and nothing outside it. When the session ends, the machine is destroyed. The attack surface of an agent should be one disposable box, not your laptop and everything signed in on it.
The wider internet is heading the same way: agents talking to agents over narrow, authenticated, auditable surfaces, and people stepping in only when it truly matters. The attack surface has to become very slim, or everything gets compromised.