AI-powered cyberattacks: toward “continuous and persistent” offensives

Chris Lehane, OpenAI's Chief Global Affairs Officer, warned that the new capabilities of AI models are changing the very nature of cyber risk: instead of one-off attacks, organizations now need to anticipate offensives carried out continuously, automated, and increasingly hard to distinguish from normal behavior. According to him, attackers equipped with freely available models will be able to launch prolonged campaigns, forcing defense teams to rely on significantly more capable tools.

An already concrete threat, not just theoretical

This isn't a hypothetical scenario. France has experienced a series of cyberattacks in recent months targeting institutions such as Santé publique France and France Travail. The group behind some of these attacks justified their success by pointing to insufficient security at the targeted services; and behind this type of attack sometimes lie very young profiles, exploiting well-identified vulnerabilities rather than sophisticated techniques. The government itself has acknowledged a technical debt accumulated over several decades in protecting critical infrastructure.

This is exactly the scenario OpenAI fears on a larger scale: it's not so much the sophistication of the attack that's concerning, but its ability to repeat, adapt, and persist, powered by models capable of automating what used to require an entire team.

Closing off models won't be enough

OpenAI is calling for a national and international legislative framework to address these risks. Regulation makes sense, but it has its limits: cyberattacks aren't a new phenomenon created by AI, they've existed as long as networks have. What's changing is the author – yesterday a human, potentially an AI today – and the volume that author can produce.

Restricting access to the most powerful models won't fundamentally change the picture: the most determined attackers will always find a model, whether open or repurposed, to achieve their goals. The real race isn't about closing off models, but about how fast defense can keep up.

AI defense as the real lever

This is where, in our view, the good news lies in this announcement: AI-assisted cybersecurity is advancing at least as fast as offensive uses. Real-time anomaly detection, automated code auditing, large-scale log analysis; the same capabilities that raise concerns on the attack side are available on the defense side. Companies that make this shift early, integrating AI into their own security tools rather than being caught off guard by it, have every chance of staying ahead, even against persistent attacks.

What to Remember

• AI-driven cyberattacks aren't a distant hypothesis: they're already happening, and their automated, continuous nature is set to intensify.
• Relying solely on regulation or closing off models won't be enough.
• What will make the difference is defense teams' ability to adopt AI at least as fast as those using it to attack.