The recent breach of an Alabama nonprofit illustrates the new threat landscape. Vivian's Door, which works with minority-owned businesses, was hit by an attack that sent fraudulent fundraising emails to contacts; the organization's IT team took systems offline for three days and faced a $3,000 bill. Founder Janice Malone was left unsure whether the attacker was human or AI-assisted.
The episode reflects a broader shift in cybersecurity. AI models have become skilled at hacking and can be deployed at scale, allowing even inexperienced attackers to conduct operations that previously required a coordinated team. Anthropic reported that a cybercrime ring used its Claude Code tool to extort data from healthcare providers, emergency services, and government entities within a single month.
Meanwhile, the most advanced defensive AI tools are not widely available. Anthropic's Mythos and OpenAI's Astra are reserved for a limited set of high-profile organizations such as Nvidia, Google, and Apple, plus critical infrastructure and open-source maintainers. Smaller institutions—community banks, local hospitals, credit unions—lack both access and budget, leaving them exposed. As one policy expert put it, the old limiting factor of a finite number of malicious hackers no longer applies.