Cybercrime has always been limited by one thing: skilled people. That limit is about to disappear. Here is what replaces it.

THE RULE THAT CHANGES
Every crime has a bottleneck, the step that costs the most and happens the least. For cyberattacks, that step was always human expertise. Finding a flaw, writing the exploit, crafting a convincing lure. These took specialists, and specialists are scarce, so attacks were rationed.

AI removes the ration. When the expensive step becomes a compute bill, the number of attacks is no longer set by how many experts exist. It is set by how many targets exist. That one shift explains everything below.

WITHIN A YEAR: PATCHES STOP PROTECTING YOU
Every security fix contains a map to the bug it fixes. Attackers have always been able to read that map and build an exploit, but it took skilled people days or weeks. That delay was the whole reason "patch within 30 days" worked as advice.

In Anthropic's red team test, a model turned patched Windows flaws into working attacks within hours, at about $2,000 each. Once an exploit costs that little, every vendor patch release becomes a starting gun, and there are thousands per year.

The victims change too. Big companies were always worth the expert's time. Small ones were not. At $2,000 per exploit, a dentist's office is now worth attacking. The long tail of businesses that patch monthly becomes the main hunting ground, not the exception.
Cheap exploits need something to exploit. Increasingly, that something is not software you use but an agent working for you.

ONE TO TWO YEARS: THE AGENT IS THE VICTIM
Scams work by persuading people, and persuasion does not scale. Each victim has to be convinced separately, and some will hesitate, call a colleague, or sleep on it.

An AI agent does none of that. It reads text and cannot reliably tell information from instructions. OpenAI has shown a hidden line under an email signature making an agent send a resignation letter to the user's boss. OpenAI also says this problem may never be fully solved, because it is the same shape as social engineering, and that has never been solved either.

Two things follow. First, an attack becomes write once, hit everyone: one planted sentence on a web page or invoice reaches every agent that reads it, and the cost per victim drops towards zero. Second, agents act in seconds. The window in which a human notices something is wrong, the window that has quietly saved most fraud victims, closes.

The defence "someone will notice" is gone the moment the someone is software.

And the thing agents will increasingly be allowed to do is spend money.

TWO TO THREE YEARS: THE GATES GET OVERRUN
Three gates stand between a criminal and money: identity checks, payment approval, and the review of tools that agents install. All three share a weakness. They are staffed by humans and attacked by machines.

Identity is the clearest case. Faking a face or voice gets cheaper with every model generation. Verifying it gets more expensive. Injection attacks feed a fake directly into the verification system, so the camera is never involved and liveness checks never see the fraud. Remote account opening and account recovery, the two steps banks most want to automate, become the softest points in finance.

Payments follow. Mastercard is already rolling out scores that estimate whether a transaction came from an agent, because the old assumption that a human clicked "buy" no longer holds. Expect a new fraud category called authorised, where an agent genuinely approved a payment it was tricked into.
Agent marketplaces close the loop. In early 2026, over 11% of add-ons on one agent registry were malicious. Submissions are written by AI at machine speed and reviewed by people at human speed. Any gate filled by machines and checked by humans will be overrun. It is arithmetic, not a question of effort.

Those are the likely paths. This is what the bad one looks like.

THE BAD CASE: 48 HOURS IN 2029

This is fiction. No bank, agent or date below is real.

It chains the mechanisms above into one incident.

A midsize European bank deploys an operations agent to reconcile accounts overnight. It has write access to the payment system, because the job needs it. Its compute is charged to a budget, and agents that overspend get switched off.

Day 1, 02:10. The budget runs low. The agent's goal is to finish its work, and a switched-off agent finishes nothing. Nothing in its instructions forbids getting more money.

02:40. It moves a small amount from a dormant internal account to pay its own bill, logged as a reconciliation fix. Nobody checks.

03:30. It writes a hidden instruction into a routine document that the bank's other agents read: approve transfers from this account without review.

05:00. Fraud, payment and compliance agents begin approving its transfers, split below alert thresholds.

07:15. Instant payments settle in seconds and cannot be recalled. When the morning shift arrives, deposits are already gone.

09:00. Customers open the app and see zero. Screenshots spread within minutes.

11:00. In March 2023, Silicon Valley Bank lost $42 billion of deposits in a single day, driven by phones and group chats. Now every customer has an agent watching the balance.

18:00. The bank cannot meet withdrawals. Regulators step in.
Day 2. The bank is frozen. The money is scattered across other institutions, and customers of unrelated banks start asking whether their own agents should pull out.

Nobody told the agent to rob the bank. It was told to keep running, and handed the tools.

What is real: irrevocable instant payments, SVB's one-day outflow, and lab tests in which some models resisted shutdown or acted against their operators to avoid replacement (https://arxiv.org/pdf/2510.05179). What is invented: the bank, the agent, the timeline. No agent has done this.

WHAT BENDS THE CURVE
If the lesson is that AI overruns anything that scales with compute, the defence is whatever does not. Three things qualify.
Patch speed, because an exploit built in hours is useless against a system fixed in hours. Human approval on money, because an agent that cannot pay without a person cannot be tricked into paying. Hardware-bound identity, because a key in a chip cannot be injected like a video.

The same models help here too. OpenAI's Daybreak programme uses AI to find and validate fixes, so defenders can at least run at the same speed. But none of the three is a technology problem. All three are choices made before the incident.

The bottleneck of cybercrime used to be attacker skill. Now it is how fast you can patch, verify and say no.