Key Takeaways
- • Andreessen Horowitz's report "The Exploit Was the Bottleneck," published November 5, 2026, found that an AI-assisted campaign launched by a single operator in late August breached 11 organizations in 26 seconds during the attack sequence described.
- • GreyNoise counted 395 compromised organizations across 48 countries in the campaign against print-management servers, with half of the victims being schools.
- • The first intrusion took less than four hours from an empty workspace, using a cheap, open-weight AI model that wrote exploits for two vulnerabilities disclosed four days earlier.
- • Verizon's breach investigations report put the median time to fully remediate exploited vulnerabilities at 43 days, up from 32 days a year earlier, widening the gap between attack speed and defensive patching.
- • Between 2.6 million and 4.4 million internet-facing PHP installations remain exposed, with about 80% running unsupported versions, according to Andreessen Horowitz.
Summary
Andreessen Horowitz's report "The Exploit Was the Bottleneck," published on November 5, 2026, argues that artificial intelligence is sharply lowering the cost and expertise required to conduct cyberattacks, with the greatest exposure falling on schools, hospitals and small businesses whose security updates lag behind. The report describes a campaign launched at the end of August by a single operator using hundreds of AI agents against print-management servers. According to the report, the agents built a test environment, wrote exploits for two vulnerabilities disclosed four days earlier, and obtained a target list from an internet scanning service. The first intrusion took less than four hours from an empty workspace, and the attack relied on a cheap, open-weight model. GreyNoise counted 395 compromised organizations across 48 countries, half of which were schools.
The authors contend that the time and expertise needed to convert vulnerabilities into working exploits had long constrained attacks, and that work once requiring days or months now takes minutes or hours. AI also reduces the cost of scouting networks and moving through compromised systems, making hands-on attacks more economical against smaller organizations with limited security resources.
Defensive timelines remain far longer. Verizon's breach investigations report put the median time to fully remediate vulnerabilities exploited in attacks at 43 days, up from 32 days a year earlier. A quarter of the previous year's industrial-control security advisories had no patch, and power-grid operators can spend 35 days assessing a patch and another 35 days deploying it.
The report also examined two critical vulnerabilities in PHP, a programming language used by 70% of websites, which leaked before patches were available. Attack attempts appeared four days before disclosure, and a week after disclosure millions of attempts yielded few confirmed compromises, as reliable exploitation proved difficult and hosting providers and content networks blocked attacks within a day. Even so, Andreessen Horowitz estimates that between 2.6 million and 4.4 million internet-facing PHP installations remain, about 80% running unsupported versions and several hundred thousand lacking a fix. As attack costs fall, these old blogs and small-business websites could become economical targets and serve as infrastructure for phishing, malware or follow-on campaigns.
The authors do not expect a collapse of the power grid or the internet. They instead anticipate outbreaks resembling the 2017 WannaCry incident, with damage concentrated in systems that cannot be updated quickly and in targets where a single intrusion could be worth billions of dollars.
The authors contend that the time and expertise needed to convert vulnerabilities into working exploits had long constrained attacks, and that work once requiring days or months now takes minutes or hours. AI also reduces the cost of scouting networks and moving through compromised systems, making hands-on attacks more economical against smaller organizations with limited security resources.
Defensive timelines remain far longer. Verizon's breach investigations report put the median time to fully remediate vulnerabilities exploited in attacks at 43 days, up from 32 days a year earlier. A quarter of the previous year's industrial-control security advisories had no patch, and power-grid operators can spend 35 days assessing a patch and another 35 days deploying it.
The report also examined two critical vulnerabilities in PHP, a programming language used by 70% of websites, which leaked before patches were available. Attack attempts appeared four days before disclosure, and a week after disclosure millions of attempts yielded few confirmed compromises, as reliable exploitation proved difficult and hosting providers and content networks blocked attacks within a day. Even so, Andreessen Horowitz estimates that between 2.6 million and 4.4 million internet-facing PHP installations remain, about 80% running unsupported versions and several hundred thousand lacking a fix. As attack costs fall, these old blogs and small-business websites could become economical targets and serve as infrastructure for phishing, malware or follow-on campaigns.
The authors do not expect a collapse of the power grid or the internet. They instead anticipate outbreaks resembling the 2017 WannaCry incident, with damage concentrated in systems that cannot be updated quickly and in targets where a single intrusion could be worth billions of dollars.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.