AI is about to make cybersecurity worse before it makes it better, and the Axios breach is your early warning.

The Summary

  • Axios suffered a supply chain attack that exposed the vulnerability of modern software dependencies, while Claude's code was leaked, revealing how AI models actually work under the hood.
  • Short-term outlook: AI dramatically lowers the barrier for sophisticated attacks, turning script kiddies into competent threat actors overnight.
  • Long-term thesis: AI defense systems will outpace human attackers, but we're entering a dangerous transition period where offense has the advantage.

The Signal

The Axios attack hit through a compromised dependency, the classic supply chain vector that keeps security teams up at night. But here's what's different now: the attack surface isn't just expanding, it's being actively mapped and exploited by AI agents that can identify vulnerable dependencies faster than human teams can patch them. The leaked Claude code matters because it shows exactly how these models reason about code, which means defenders and attackers alike can now study the playbook.

We're in a weird transition moment. AI coding assistants are writing more code, which means more code to audit. Junior developers empowered by AI are shipping faster, which means less experienced eyes on security implications. Meanwhile, threat actors are using those same AI tools to find zero-days, craft better phishing campaigns, and automate reconnaissance at scale. The economics favor offense right now because one AI-assisted attacker can probe thousands of targets simultaneously while defense still requires human judgment at key decision points.

The Claude leak reveals something crucial about how we got here. These models are pattern-matching machines trained on mountains of existing code, good and bad. They'll happily reproduce security anti-patterns they've seen before unless explicitly told otherwise. They don't understand threat models. They don't think adversarially. They optimize for "works" not "secure." That's fixable with better training and guardrails, but it takes time we don't have while the models are already deployed everywhere.

The long-term argument is that AI defense will beat AI offense because defense benefits more from comprehensive monitoring, instant pattern recognition across millions of signals, and perfect consistency in applying security policies. Humans get tired, miss things, take shortcuts. AI doesn't. But getting from here to there requires surviving the next few years when attacks are AI-augmented and defenses are still mostly human.

The Implication

If you're building anything right now, assume your dependencies are compromised and your code will be read by hostile AI. That means defense in depth isn't optional anymore. Multi-layered security, zero-trust architecture, aggressive input validation, these aren't best practices, they're survival tactics. Watch your supply chain like it's 2026, because it is.

For the broader agent economy, this is the tax on velocity. Moving fast and breaking things works until the things that break are your customer data or your infrastructure. The companies that figure out AI-native security first will have a structural advantage. Everyone else is building on sand.

Source: Stratechery