AI-Driven Hacks Trim Breach Response to Minutes, Microsoft Warns

Microsoft has alerted the security community that adversaries are now able to compress the post‑compromise phase of a cyber‑attack from days or hours down to a matter of minutes by leveraging artificial‑intelligence tools.

The company’s security researchers say threat actors are employing generative AI to automate many of the routine steps that traditionally slowed an intrusion, such as credential harvesting, script writing for lateral movement, and rapid data exfiltration. By feeding large language models with code snippets and network configurations, attackers can generate functional malware or phishing content on the fly, accelerating the pace at which they move through a victim’s environment.

While defenders have increasingly turned to AI‑based analytics and automated threat‑hunting to keep pace with the growing volume of alerts, Microsoft notes that the same technology is now being weaponised by attackers. The dual‑use nature of AI means that the line between defensive and offensive capabilities is blurring, and the speed advantage now tips toward the intruder.

Microsoft’s observations are based on telemetry from its cloud services and endpoint protection products, which have recorded a noticeable uptick in AI‑generated attack scripts and rapid progression of compromised accounts. The pattern suggests that adversaries are no longer limited by manual coding or the need to craft bespoke tools for each target; instead, they can adapt in real time to defensive measures.

Experts say the shift forces organisations to rethink their incident‑response playbooks. Faster detection, automated containment, and the use of AI to anticipate attacker behaviour are becoming essential components of a resilient security posture. Industry groups are already discussing the need for shared threat‑intelligence feeds that include AI‑generated indicators of compromise.

Microsoft plans to incorporate these findings into upcoming security updates and advises customers to harden authentication, monitor anomalous AI‑related activity, and consider deploying AI‑driven defence solutions that can match the speed of modern threats. The warning underscores a broader trend: as AI tools become more accessible, both attackers and defenders must evolve rapidly to maintain the balance of power in cyberspace.