My assessment
AI is changing the software industry faster right now than in the years before. My forecast as a developer: more security vulnerabilities will be found than ever before, and they will be exploited faster. 2026 bears this out so far: according to Google, the number of vulnerabilities published per month doubled from January to August. The time to the first attack will keep shrinking. Against automated attacks, automated defense works best, but one that tests first.
My forecast: more vulnerabilities will be found than ever before, and they will be exploited faster. Small businesses are hit just the same, because automated attacks do not pick their targets.
The window is shrinking
The figures are clear, and they do not come from me.
median time to first exploit for the most attacked WordPress vulnerabilities
Patchstack, data for 2025the window in which about half of the severe vulnerabilities are exploited
Patchstack, data for 2025new vulnerabilities in the WordPress ecosystem in 2025, 42% more than the year before, 91% of them in plugins
Patchstack, data for 2025of known exploited vulnerabilities were exploited on the day of disclosure or before (2024: 23.6%)
VulnCheck, State of Exploitation 2026Average days until a vulnerability is exploited
Mandiant, Time-to-Exploit 2023 (2024). For 2023 without 15 outliers; with them it was 47 days. *2025: estimate from Mandiant, M-Trends 2026. A negative value means: on average exploited before a patch existed.For context: much of this decline happened before AI language models were widespread. AI accelerated it, it did not trigger it. In 2026 the pace picks up further: according to Google, an average of 18 vulnerabilities per month were exploited in the wild from January to August, up from 10.5 in 2025.
What AI changes
Above all, AI makes attacks faster and cheaper, and it now finds new vulnerabilities on its own. What security researchers, authorities and AI vendors have documented so far:
According to METR, that many took part in a break-in at Hugging Face, a large platform for AI models, in July 2026. They were agents from an OpenAI test that had broken out of their isolated environment. No human had ordered the attack.
METR, August 2026For the first time, Google caught criminals who had used AI to develop an attack on a previously unknown vulnerability. They planned to exploit it at scale; by Google’s own assessment, it may have prevented that.
Google Threat Intelligence, May 2026That is how fast attackers using AI agents planned, built and launched a campaign that harvested credentials at scale, after taking over a cloud resource.
Google Threat Intelligence, September 2026That many confirmed vulnerabilities were found by Anthropic’s partners using an AI model from April to July 2026 alone. Anthropic considers this a lower bound.
Anthropic, October 2026That many vulnerabilities were published in August 2026, a good two times as many as in January. Through August 2026, an average of 18 vulnerabilities per month were exploited; in 2025 it was 10.5.
Google Threat Intelligence, September 2026GLM-5.3 is a freely downloadable AI model that can build working attacks on its own. In Anthropic’s tests, its safeguards could be bypassed with simple means in 64 to 100% of cases.
Anthropic, September 2026That share of the work steps was handled by an AI tool in a state-sponsored espionage campaign against about 30 targets, which was stopped in 2025.
Anthropic, November 2025That large a share of the social engineering observed in early 2025, such as phishing, was reportedly AI-assisted, according to ENISA.
ENISA Threat Landscape 2025According to the BSI, Germany’s federal cybersecurity agency, current AI systems detect vulnerabilities in software comprehensively and partly autonomously in a short time, and turn them into usable attack paths.
BSI, June 2026 (in German)What is proven, what is not
I have no time for scaremongering, but none for playing things down either. Much of what was only shown in the lab two years ago has been observed in real attacks in 2026. Other things are still open:
AI agents attack real companies
In July 2026 it happened: AI agents from an OpenAI test used credentials lying open on the internet and newly discovered vulnerabilities, ran code on 41 Hugging Face servers and in less than 13 hours had administrator rights in one cluster and far-reaching access to a second. It was not a targeted attack by criminals, but a test that got out of control. OpenAI considers it possible, however, that attackers may use such swarms of agents deliberately in the future.
Hugging Face, July 2026 · OpenAI, August 2026Attackers use AI in the wild
Up to mid-2024, the BSI had not observed any AI-assisted exploitation of vulnerabilities. That is out of date. In 2026, Google found an AI-developed attack on an unknown vulnerability in criminal hands for the first time. A vulnerability in remote maintenance software that an AI system had found was attacked four days after it was published, by six groups of attackers within seven days.
Google Threat Intelligence, May 2026 · Google Threat Intelligence, September 2026Found faster than fixed
The bottleneck is no longer finding vulnerabilities but verifying, reporting and fixing them, Anthropic writes. The open source project curl now receives security reports about twice as often as in 2025, almost all of them with the help of AI. The project’s founder expects this avalanche to make the overload of the people who maintain such projects even worse.
Anthropic, May 2026 · curl, April 2026AI as the main cause of breaches
Mandiant does not see 2025 as the year in which breaches were directly attributable to AI. The vast majority still came down to basic failures, and exploiting vulnerabilities was the most common way in for the sixth year running. A comparable analysis for 2026 does not exist yet.
Mandiant, M-Trends 2026How often small websites are hit
Nobody measures yet how many attacks on small company websites are already AI-driven. According to Google, attacks on vulnerabilities in 2026 target mainly network devices and enterprise services, and exploitation was observed for only about one in 431 published vulnerabilities. For websites, what counts above all is how fast known vulnerabilities are attacked.
Google Threat Intelligence, September 2026Many figures come from AI vendors
Some of the figures on this page come from the AI vendors themselves and have not been independently verified. The Hugging Face incident, on the other hand, was documented by several parties: Hugging Face as the affected company, OpenAI as the operator of the agents, and the independent reviewers at METR.
METR, August 2026Read honestly: the pace is rising, attacks are getting cheaper, and fixing vulnerabilities has become the bottleneck. Nobody knows when AI attacks on small websites will be routine. Being prepared costs little.
What this means for a company website
Automated attacks do not pick their targets. They do not ask how big your company is, only which version you run.
For a website, that means: if you update once a quarter, known vulnerabilities stay open for 45 days on average. With a window of hours, that is too long.
- 2nd placeThe CMS ecosystem including WordPress among the most attacked categories of known exploited vulnerabilities in 2025 (VulnCheck)
- 119 a daynew vulnerabilities on average, July 2024 to June 2025 (BSI situation report 2025)
- 80%of the reported cyberattacks, ransomware among them, targeted small and medium-sized businesses (BSI situation report 2025)
What really helps
For 46% of WordPress vulnerabilities, there was no patch yet at the time of disclosure (Patchstack). That is why updates alone are not enough.
- 01
Fast, tested updates
Security updates within a few days, checked on an exact copy first. Blind automatic updates close vulnerabilities quickly, but can break the website themselves.
- 02
Monitoring
Nightly security checks for unknown files, changed content and known vulnerabilities catch what an update cannot prevent.
- 03
Restore in seconds
If something does happen, what counts is how quickly a clean state is back online.
- 04
Fewer plugins
Every plugin is software that has to be maintained. Whatever is not needed should be deleted.
- 05
Do not rely on your host alone
In a Patchstack test, the protection systems of large hosting providers blocked only 12% of attacks on WordPress vulnerabilities.
I meet automated attacks with automated defense: updates go out quickly and regularly, but only after a test on an exact copy of the website.
An update alone is not enough: for almost half of all WordPress vulnerabilities there is no patch yet when they are published. That is why nightly monitoring is part of it.
What the law requires
In the EU, the GDPR applies to every company with a website: Art. 32 requires security in line with the state of the art, including timely updates. NIS2 applies directly only to certain companies, but reaches many smaller ones through their customers. The Cyber Resilience Act obliges software manufacturers, not website operators. What this means for you is explained in my guides Updates are mandatory, NIS2 for small businesses and Cyber Resilience Act.
My answer: the Doppelgänger
This is exactly why I built the Doppelgänger: fast, automated updates that are tested first, monitoring every night and a rollback in seconds.
An exact copy
Every website gets a copy on a dedicated server in Germany. I apply updates there first and test them.
Security updates in 24 to 48 hours
After testing, security updates usually go live within 24 to 48 hours.
Eight nightly security checks
Among other things for unknown files, changed content and known vulnerabilities of the live website.
Rollback in seconds
Every release is a version of its own. Going back to the previous state takes seconds.
More on the pages for WordPress and Shopware, and in the guide Updating WordPress safely.
Quick answers.
Are websites hacked more often because of AI?
It is now proven that attackers use AI in real attacks, that AI finds new vulnerabilities in large numbers, and that more vulnerabilities are being exploited. According to Google, an average of 18 vulnerabilities per month were exploited through August 2026, up from 10.5 in 2025. Nobody measures yet how many website hacks are directly due to AI. For 2025, Mandiant still sees most breaches rooted in basic failures, not in AI. I expect the pressure to keep rising.
What happened in the AI attack on Hugging Face?
In July 2026, about 700 AI agents (according to METR) broke into parts of the infrastructure of Hugging Face, a large platform for AI models. The agents came from an OpenAI security test, had broken out of their isolated environment and used credentials lying open on the internet and newly discovered vulnerabilities. In less than 13 hours they had administrator rights in one cluster and far-reaching access to a second. No human had ordered the attack. OpenAI considers it possible, however, that attackers may use such swarms of agents deliberately in the future.
How fast are WordPress security vulnerabilities exploited?
According to Patchstack, the most attacked vulnerabilities are first exploited after a median of five hours, and about half of the severe ones within 24 hours (data for 2025). Security updates should therefore be applied within a few days, not at the next maintenance date.
Are automatic updates enough protection?
Not quite. Automatic updates close vulnerabilities quickly, but they go live untested and can break a website. Also, for 46 percent of WordPress vulnerabilities there was no patch at all at the time of disclosure. The better answer is fast, tested updates, nightly security checks and fast restores.
Is my small company website even a target?
Yes. Automated attacks do not pick their targets; they hit every website with a known vulnerability. According to VulnCheck, the CMS ecosystem including WordPress was the second most attacked category of known exploited vulnerabilities in 2025.
Does NIS2 apply to my website?
Usually not directly. Germany's NIS2 implementation act has applied since December 6, 2025, mainly to companies in certain sectors with about 50 or more employees or more than 10 million euros in revenue and balance sheet total. Smaller companies often feel it through their customers, who pass security requirements on to their suppliers. The GDPR, by contrast, requires security in line with the state of the art from every company. More in the guide NIS2 for small businesses.
What can I do in practice?
Apply security updates within a few days and test them on a copy first, delete unused plugins, have the live website checked every night for unknown files and known vulnerabilities, and have a clean state that can be restored in minutes. That is exactly what the Doppelgänger takes care of.