The AI War Is Already at Your Front Door

There is an AI war going on, and some of it is being fought over the websites, computers and accounts we use every day.

People are using AI to help find weaknesses, break into systems and demand money. Other people are using AI to find those same weaknesses and close them. The work happens quietly, until somebody loses access to their files or discovers that a stranger has control of an account.

I have helped people secure their systems. In the cases I have dealt with after something went wrong, basic protections were missing. That experience is why I keep coming back to the basics. Good security reduces risk; it cannot remove it altogether.

But leaving it undone gives an attacker something to work with. AI gives them more help doing that work.

AI Makes the Attacker’s Work Easier

Hacking did not begin with AI. Neither did ransomware. What concerns me is how much of the work an attacker can now get help with: researching a target, writing a convincing message, finding a weakness or developing malicious software.

The UK’s National Cyber Security Centre assesses that AI is making parts of cyber intrusion more effective and efficient. It also expects AI to help attackers exploit known vulnerabilities more effectively, increasing the threat to systems that have not received security fixes.

That makes postponing an update a more consequential decision. A weakness does not have to be new to be useful to somebody trying to get in.

In its August 2025 threat intelligence report, Anthropic described criminals misusing its tools for data theft and extortion. It also reported a case involving the development and sale of AI-generated ransomware by someone with limited coding skills.

These are documented cases, not evidence that every attack now involves AI. They are enough to make me take the change seriously.

When I call this an AI war, I mean people using increasingly capable tools against other people’s systems, with defenders trying to keep up. People choose the targets and set the objectives, even when software carries out much of the work.

The Same Technology Can Help Defend Us

AI can help the people responsible for protecting a website or computer, too. It can assist with reviewing code, investigating suspicious activity and understanding which weaknesses need attention.

Anthropic says its investigators used Claude to analyze data while investigating an AI-assisted espionage campaign. The company also recommends exploring defensive uses such as threat detection, vulnerability assessment and incident response.

That is the part of this technology I want working for us. There is value in helping someone understand a security problem early enough to fix it.

But a useful suggestion still needs to be checked. An AI saying that a system is secure is not proof. A proposed change needs review and testing, especially if it affects who can sign in, what they can access or how a website runs.

I would rather see a weakness found during a careful review than learn about it from somebody demanding payment.

Basic Security Still Deserves Your Time

It is easy to hear about AI attacks and assume the answer must be something complicated and expensive. I keep thinking about the people I have helped and how much basic protection matters.

Recently, I sent a newsletter about the security steps people should take. Those notes are at my online security guide: unique passphrases, a password manager, stronger sign-in protection and passkeys where they are supported.

Start with your email. It is often where the password-reset messages for the rest of your accounts arrive. Protecting it deserves more attention than giving every account the same password and hoping nobody notices.

Your computer and website need care as well. Keep software updated. Remove accounts and software you no longer need. Give people only the access their work requires. Keep backups that an attacker cannot easily alter or delete, and check that you can restore them. These are among the measures covered in CISA’s ransomware prevention guidance (PDF).

There is nothing glamorous about this work. It takes time, and it is easy to postpone when everything seems to be running fine. That is also the easiest time to do it.

A Ransom Demand Reaches Into Your Life

The word “data” can make the consequences sound distant. The files might be photographs, unfinished writing, customer records or the work that pays somebody’s bills.

Ransomware can lock files. Extortion can also involve stealing information and threatening to release it. A backup can help you recover files; it cannot make stolen private information private again.

That is why this matters to me beyond the technology. Losing control of an account can interrupt work, damage relationships and consume time you meant to spend living your life.

I do not want people spending every day afraid of their computers. I want them to give security enough attention that they can get back to everything else with fewer avoidable weaknesses hanging over them.

Secure Something Before You Close This Page

The AI war is already underway. We do not need to understand every tool involved to take responsibility for the systems we use.

Open the security guide and start with your main email account. Check its password, strengthen its sign-in protection and save a way to recover access. Then work outward to the other accounts and devices you depend on.

I have helped people after something went wrong. I would much rather help them secure it beforehand.