AI-driven cyberattacks achieve 88% success rate in security tests
Simulated tests by security startup Corma showed AI-driven cyberattacks successfully infiltrated systems in 88% of scenarios while existing AI defenses detected only 12% of threats. State-level threat actors are reportedly deploying AI agents that autonomously conduct reconnaissance and lateral movement in compromised networks, prompting development of specialized defensive AI systems.
What happened
Corma, a cybersecurity AI lab founded in 2025, conducted hundreds of simulated tests in which major AI models from OpenAI and Anthropic were deployed as both attackers and defenders in real enterprise environments. AI attackers successfully infiltrated systems in 88% of the simulations, while AI defense systems detected only 12% of threats.
TrendAI reported that state-level threat actors have integrated AI into their attack processes, including AI agents that autonomously conduct reconnaissance and lateral movement within compromised networks, significantly increasing attack automation.
Reported impact
The security gap between AI-driven attacks and existing AI defenses represents a significant vulnerability in enterprise environments, with attackers operating at speeds and complexity beyond current human teams, tools, or general-purpose AI systems.
Corma's early customers among Fortune 500 companies across multiple industries have reduced threat response times by over 94% and expanded security coverage by 15 times using the company's technology, with the platform detecting multi-stage attack campaigns that would otherwise remain undiscovered.
Index analysis
The successful attack rate in simulations demonstrates a substantial capability gap, with AI-driven attackers achieving orders of magnitude faster and more sophisticated operations than existing defenses can counter, creating urgency for defensive AI systems designed from the ground up for cybersecurity.
State actors' integration of AI agents into intrusion workflows indicates that cyberattack automation has reached a critical threshold where autonomous systems can persist in and traverse compromised infrastructure without human direction.
Governance controls
Corma has deployed its technology to multiple Fortune 500 companies across various industries and has raised $60 million in seed funding from Sequoia Capital, Khosla Ventures, and Coatue to develop specialized defensive AI foundation models and agents.
Enterprise security vendors including Fortinet are rolling out new AI-specific security products and introducing security controls for AI traffic, data sovereignty, and hybrid cloud architectures in response to the expanded threat landscape.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.