CrowdStrike's Adam Meyers: AI Hacking Panic Is Misplaced

By Daniel Okafor

Six Korean banks were hacked in a single incident, and Adam Meyers learned about it mid-flight from the United States to South Korea. By the time his plane landed, his team at CrowdStrike had found the attacker's server, recovered records of the activity and identified a suspect. The hacker had left personal information behind while using AI tools.

CrowdStrike investigated the incident. The attacker used Artex, an open-source AI-powered penetration-testing tool, alongside large language models from several providers. The speed and scale of the attack explain why AI has fueled fears about the future of cybersecurity.

Meyers is not among the fearful. "I thrive on chaos," he says. Speaking to Fast Company at CrowdStrike's Fal.Con conference in Barcelona, he argued that much of the alarm around AI-powered hacking is misplaced.

"Fundamentally, this is nothing new. It's just speed and volume," Meyers says. "AI hasn't come up with new exploit paths or new vulnerability classes, right? It's all the same stuff we're already aware of."

That does not make the technology harmless. But Meyers believes the industry risks confusing what sophisticated AI models can do with the threat they actually pose to organizations.

Why do experts say the panic is overblown?

Ciaran Martin, former head of the U.K.'s National Cyber Security Centre, argues the discussion around AI-enabled hacking has detached itself from the realities of cybercrime.

"To some extent, we've lost our mind in 2026 because of the extent of the capabilities," Martin says.

He believes frontier AI developers focus on what their systems can theoretically accomplish while ignoring the motivations and constraints of real attackers. "They don't understand threat actors. They don't understand hackers. They don't understand the economics and the sociology and the politics of hacking," Martin says.

The result is an industry alarmed by a growing volume of automated activity, even though more attacks do not necessarily mean more successful compromises. Security teams must sift through an ever-growing pile of potential threats.

Eerke Boiten, a cybersecurity professor at De Montfort University in the U.K., sees the same gap. AI accelerates the discovery of vulnerabilities, he explains, but the ability to exploit them is not advancing at the same pace. There is an upside: the same AI that helps attackers find flaws could help defenders fix them and gauge how hard they are to exploit.

When does every vulnerability become an emergency?

For Meyers, the problem is older than AI. He says the industry leans too hard on the Common Vulnerability Scoring System, CVSS, which rates flaws from one to 10. PHP2Shell, a pair of vulnerabilities in the widely used PHP language, each scored 9.2.

CrowdStrike examined the issue before public disclosure and concluded exploitation would be far from straightforward. Woodward agrees, noting it required exceptionally precise timing and chaining vulnerabilities together. Still, the flaws were not theoretical: the Cybersecurity and Infrastructure Security Agency, part of the U.S. Department of Homeland Security, added both to its catalog of known exploited vulnerabilities on October 26 and called for urgent action.

Woodward maintains CVSS remains useful because it captures potential attack impact. Meyers argues severity scores alone should not drive the response. Organizations should also weigh evidence of active exploitation in the wild.

"I like to think about things in terms of what's being actively exploited," he says.

Otherwise the industry risks a boy-who-cried-wolf outcome. "The more people get burned out, the more they're going to make mistakes," Meyers warns.

Boiten finds reason for optimism. He believes the collaboration behind vulnerability identification could extend to fixing flaws, and AI-assisted coding could reduce the number introduced in the first place. That marks a shift in his thinking: a year ago, he expected the rise of vibe coding to produce more vulnerabilities, not fewer.

Amid the focus on AI, one persistent vulnerability gets overlooked: humans. For all the technological change in cybercrime, attackers still frequently get in by exploiting human weakness.

Who benefits from the AI panic?

Meyers points at the companies building the technology. "There's a lot of fearmongering going on, and I think the frontier labs have been stoking that fire for their own benefit," he says.

He suggests frightening predictions about AI capabilities could serve the commercial and regulatory interests of frontier AI companies, especially those considering going public. Emphasizing the catastrophic potential of their own products also reinforces perceptions of their power.

The danger is twofold. Organizations may spend resources on the wrong threats. Worse, a steady drumbeat of warnings could dull their response when a genuinely serious threat appears.

"I think we need to be careful not to overhype it or we'll find people stop listening, and then there will be something they really need to take care of," Woodward says.