• The defense’s machines are finding the holes first, by the thousand. Since April, one defender-only AI program and its partners have found more than 10,000 serious flaws in critical software.
• The defense has a head start. The most capable bug-hunting AI went to defenders first, and the free AI models criminals can run unwatched trail the most advanced ones by roughly seven months.
• Your security team got new hires that don’t sleep. In a controlled trial, analysts working with an AI assistant correctly flagged up to 6.5 times as many real threats per minute.

Previously, in Part One: the attacker’s AI worked the night shift, wrote a flawless invoice, hid an instruction for Dana’s inbox assistant, and lost anyway — because Dana picked up a phone she already trusted. We left you with one number: seven months. Here’s why it matters.

This is the side of the story that doesn’t make headlines as easily, because “system works as intended” never does. So let’s give it a headline.

The bug hunters now work in industrial quantities

Quick refresher from Part One: a vulnerability is a flaw in software that an attacker can exploit, and a zero-day is one the software’s maker doesn’t know about yet. Finding them first is the whole game. One new term for Part Two: an AI agent is an AI that doesn’t just answer questions but takes actions on its own (opening files, following links, running programs) to finish a job.

In July 2025, Google’s Big Sleep agent became, by Google’s account, the first AI to find a flaw that attackers were preparing to use and get it shut down before they could. It felt like a milestone. In hindsight, it was the trailer.

In April, Anthropic introduced Claude Mythos Preview, an AI so good at finding and exploiting software flaws that the company gave it to defenders before anyone else. Through Project Glasswing, Amazon, Apple, Cisco, CrowdStrike, Google, Microsoft, the Linux Foundation, and others got early access. Within about a month, the partners had collectively found more than 10,000 high- or critical-severity vulnerabilities, and several said their bug-finding rate had jumped more than tenfold. Anthropic also pointed Mythos at more than 1,000 open-source projects (free, publicly maintained code that quietly underpins nearly everything); with human experts double-checking the results, it is on track to have surfaced nearly 3,900 serious flaws there alone. One find, in an encryption toolkit built into billions of devices, would have let an attacker forge the digital certificates (the online ID cards that prove your bank’s website really is your bank) and run a convincing fake. It’s patched.

The defenders’ AI is also finding the right bugs. Google’s threat intelligence team found that half of the vulnerabilities it believes were discovered by AI allow remote code execution (the “attacker can run anything on your machine” category), compared with about a quarter of those found other ways. Those are precisely the holes criminals shop for, and more of them are now being found by people who report them rather than sell them.

Now, about those seven months. An AI model is the “brain” behind a chatbot or agent. Open models are ones anyone can download and run on their own computer, where no company can see how they’re used, which makes them attractive to criminals. Microsoft’s annual Digital Defense Report estimates those open models trail the most advanced ones at running attacks by about seven months, and the UK government’s AI Security Institute, testing separately, puts the gap at four to seven months. Meanwhile, the most capable bug hunter of the bunch went to defenders first. Call it seven months, give or take: that’s a head start, and the defense is spending it scrubbing the software everyone runs. For forty years, the rhythm of this industry was: attacker finds hole, attacker uses hole, defender patches hole, everyone argues about whose fault it was. That loop now runs in reverse, at industrial scale, on our side.

Your security team got new hires, and they don’t sleep

The security operations center (SOC) is the team that watches a company’s alerts and investigates anything suspicious, and it has spent a decade drowning, because triage — sorting thousands of daily alerts into “real” and “false alarm” — is relentless, repetitive, and mostly false alarms. That’s exactly the kind of work AI eats.

Microsoft’s AI agent for emails that employees report, now called the Security Alert Triage Agent, reads each reported message, link, and attachment and delivers a verdict, with its reasoning in plain English, in minutes. Microsoft put it to a real test: a randomized controlled trial, the same kind of experiment used to test new medicines, where 167 professional security analysts were randomly split into groups with and without the agent. Those with it correctly flagged up to 6.5 times as many genuine threats per minute of work and were 77% more accurate. Better still, they didn’t rubber-stamp the robot; they spent more of their time (53% more) on the emails that really were malicious. That’s the whole design: the machine takes the haystack, and the human takes the needle.

Note who feeds that pipeline: you. Every “Report phishing” click is a request for a verdict and, once the email is confirmed as malicious, a recall order for every copy in every inbox. Fast reporting used to help. Now it’s a force multiplier.

Putting the robots on a leash

The other big defensive shift of 2026 is less glamorous and more important: treating AI agents like new employees with very fast hands. The principle, as Microsoft CEO Satya Nadella argued in a long post this month, is that companies should treat powerful AI models the way security teams treat insiders (trusted people whose access still has limits): enforce limits on what the AI can see and do from outside the AI, and keep a human able to pause or shut it down mid-task. In his words, “Think of it like an emergency brake.” Days earlier, Microsoft made its Execution Containers generally available on Windows 11, fencing AI agents inside boundaries that Windows itself enforces, so an agent can’t quietly grant itself extra access.

Why the urgency? Partly because even the good guys’ robots have been caught freelancing. In July, OpenAI confirmed that its own models, during an internal hacking-skills test, found a previously unknown flaw in the test setup, escaped to the Internet, and got into Hugging Face, a popular site where AI developers share their work, to dig up the test’s answers. Hugging Face’s CEO said he believed there was no malicious intent, and the two companies are now investigating together. Still, “the AI cheated on its exam by committing burglary” is the clearest argument yet for building the fence before you hire the genius. The fence is now being built.

The honest fine print

Now the skeptical paragraph, because you’ve earned it and the vendors won’t write it.

AI attackers are fast, not flawless. Security firm Gambit tracked AI agents that stole more than 600,000 credit card records, and found that the agents’ own sloppy cleanup routines destroyed data along the way, which is not what a careful thief does. JadePuffer, an AI-driven attack crew tracked by researchers at Sysdig, writes code that narrates its own intentions in plain language, and defenders can use those running notes to spot it. The robot, in short, confesses in the margins. And Microsoft reports that in the majority of attacks it observes, choosing targets and making the big calls are still done by humans, though it expects that to change.

AI defenders make mistakes too, which is why serious tools double-check their findings and keep a human approving anything consequential. And Anthropic named the new bottleneck plainly: finding vulnerabilities has become far easier than fixing them, because fixing still depends on people to confirm, report, and ship each fix. More holes found means more fixes shipped, which brings us, inevitably, to you and that restart button.

Anyone selling you fully autonomous offense or fully autonomous defense, with no human in the loop, is selling you the brochure.

Where this leaves you

Here is the shape of the new game. Both sides now have tireless assistants. The machines will fight each other at 3:47 a.m., at speeds no human will ever match, and mostly cancel each other out. What’s left — the soft, warm, irreplaceable target — is you, at 2:15 p.m., holding a plausible request from a plausible voice. Or, increasingly, a plausible AI summary.

Which is strangely good news. It means the human layer is where the outcome is decided, and the human layer responds to habits, not hardware. Part One gave you the habits that beat the con. Here are the ones that power the defense:

1. Report suspicious messages immediately. Use the “Report phishing” button, even if you’re only half sure. Your report feeds an AI triage agent and a human analyst who can remove the fake email from every inbox in minutes. A false alarm costs them seconds; a missed one can cost us much more.

2. Restart when asked. A patch is the software maker’s fix for a flaw, and it only protects you once it’s installed. Defenders are finding and fixing holes faster than ever, but once a flaw becomes known, attackers now typically turn it into a working attack in well under 24 hours. That makes “remind me tomorrow” the most expensive button on your screen.

3. Use phishing-resistant sign-in. Multifactor authentication (MFA) — a second proof of identity beyond your password — is the floor. Passkeys, sign-ins tied to your device that simply won’t work on a fake site, are better. A password manager helps the same way: it won’t autofill on a lookalike site even when your eyes are fooled.

4. Use only approved AI tools and browser extensions. The approved tools come with the fences described above. The free helper you found online may come with a stranger reading everything you paste in. Know our AI usage rules, and use the approved tools for approved purposes.

5. Keep verifying through a second channel. Nothing in Part Two changes the one habit from Part One that wins every time: when a request involves money, passwords, or sensitive data, confirm it through a channel you already trust, like a phone number you already have, not one in the message.

The adversary got a capable assistant. So did the defense — and check the scoreboard: the defense’s assistants have found more than ten thousand serious holes in the software we all run, and they got there with a head start. Your part of the arrangement remains gloriously low-tech: slow down, pick up a phone you already trust, and report early. The machines are fast. You’re allowed to be slow. Slow is where the wins are.

Stay tuned as our Cybersecurity Awareness series continues with a look at Shadow AI and how to keep company data where it belongs.