AI’s ability to weed out software vulnerabilities has provided both reinforcements for cybersecurity defenders and ammo for attackers.

A report published Tuesday by Digital.ai finds that 87% of the apps it tracks with it’s "App Aware" Threat Monitoring tool have experienced attacks in 2026, up from 55% in 2022. The number of attacks has risen steadily in that period, with peaks correlating closely with every major AI model release since ChatGPT launched in November of 2022.

The attack surface varied across industries and platforms:

• Financial services apps and automotive apps each faced an attack rate of 91% this year, the highest of any vertical.
• Medical device apps, meanwhile, saw an attack rate of 86%, facing the highest single-year jump of any vertical at 8%, up from 76% year-over-year.
• As for platforms, iOS apps experienced an attack rate of 86%, whereas Android experienced an attack rate of 89%. In particular, iOS attacks have increased 10% year-over-year.

The report’s core thesis is that agents have collapsed the cost and skill barrier needed to complete sophisticated cyberattacks. Now, relatively novice hackers can now infiltrate vulnerable platforms with relative ease. Experienced attackers, meanwhile, are able to commit far more complex attacks on higher-value targets with more dangerous consequences.

And with apps and software shipping faster than ever due to vibe coding, the question is whether this new wave of apps are secure enough when they’re published. An if not, will security teams be forced to react rather than proactively protect, said Derek Holt, CEO of Digital.ai, in a statement.

“The same AI your developers used to build your app this morning is being used to attack it this afternoon,” Holt said. "The gap between where the attacks are and where the security investment is, is no longer acceptable."

Our Deeper View

Cybersecurity has come sharply into focus over the past several months as major model providers like Anthropic and OpenAI produce systems capable of completely overhauling the vectors of risk in software engineering. Anthropic, for instance, has witheld its Mythos model from the general public due to concerns that it could pose threats to national security. Both companies have released some version of a tourniquet, with OpenAI’s Daybreak marketed as “frontier AI for cyber defenders,” and Anthropic’s Project Glasswing coalition to secure critical software. But the data in this study points to a clear trend: AI is putting advanced cyber capabilities into the hands of anyone with a laptop, an internet connection and a pulse. And though the data is already pointing to intensifying attacks, at the rate that AI is advancing, we don’t know the extent to which this could worsen. We also don't know whether the measures being taken by major AI firms and others will be enough. At the end of the day, these companies may be selling guns with the safeties on and hoping it will stop the worst possibilities from happening.