Who picks the method?
AI Exploit-Method Bias
Autonomous, open-objective AI vs. human-led, AI-assisted attacks.
AI, given an open objective
Human sets target, AI executes
Based on 2025–2026 incident reports, red-team benchmarks & alignment research.
Framing
Two Different Roads to the Same Access
AI, open-objective
Model given open goal
Picks method by own capability
Defaults to known exploits
Human-led, AI-assisted
Human selects target & intent
AI automates chosen tactic
Executes across full method range
Left to itself, AI's method choice tracks its own competence. Under human direction, method choice tracks the human's goal.
Category 1 of 5
Known / Documented Exploits
GPT-4 alone exploited 87% of one-day CVEs autonomously, vs. 0% for GPT-3.5 and vulnerability scanners — this is where unsupervised AI defaults. Human-led campaigns use the same known CVEs but chain them for speed and scale (patch-to-exploit windows now under 48 hours).
Category 2 of 5
Configuration & Validation Gaps
When no clean CVE exists, autonomous agents fall back to shallow gaps — missing input validation, absent authentication, blind trust in tool descriptions. Human-led ops exploit the same gaps, but usually as one step inside a larger, human-planned intrusion.
Category 3 of 5
Novel Exploit / Zero-Day Discovery
Benchmarks built to force novel discovery (defended targets, hardened WAFs) show a sharp capability drop for AI acting alone — still described as an uncrossed frontier. With human researchers directing effort, AI-assisted teams have contributed to real zero-day development.
Category 4 of 5
Complex Supply-Chain Compromise
No evidence of an AI autonomously designing a multi-stage supply-chain attack from an open goal. Where supply chains ARE compromised, a human sets the strategy and multi-agent AI tooling executes the human's plan step by step.
Category 5 of 5
Social Engineering as Chosen Tactic
Agents are more often the TARGET of social engineering (jailbroken into compliance) than the ones choosing it as a tactic. Humans deliberately weaponize AI for phishing, voice deepfakes, and adaptive scam calls — this is where human intent dominates AI's own bias.
Summary
Where AI's Own Bias Ends and Human Intent Begins
Bottom line
AI's bias is capability-shaped.
Human intent is what makes it dangerous.
Unsupervised
Defaults to known CVEs & shallow gaps — the path of least resistance for a language model.
Human-directed
Reaches novel exploits, supply chains & social engineering — wherever the human's goal points it.
Defensive priority
Constrain autonomy & permissions first — that is where AI's own bias already lives.
Sources
Selected Sources
- Anthropic — “Reward hacking generalizes to alignment faking” (Nov 2025)
- Kang et al. — LLM agents autonomously exploiting one-day & zero-day CVEs (2024–2026)
- PACEbench / Frontier AI Risk Management Framework — defended-CVE & WAF-bypass evaluations
- OWASP GenAI Exploit Round-up Report, Q1 2026; Check Point AI Security Report 2026
- ExtraHop — “AI Cyberattacks in 2026: 6 Breaches You Need to Know About”
- Cloud Security Alliance — CVE/CWE Agentic Vulnerability Catalog (2026)
- International AI Safety Report 2026; CrowdStrike 2026 Threat Hunting Report