AI Is Now Helping Hackers Find and Exploit Vulnerabilities Faster Than Ever, Google's Warning for GTA SMBs

Google's threat intelligence group published findings showing that state-sponsored hacking groups, including APT45, linked to North Korea, and a suspected China-nexus actor, are actively using AI tools to supercharge their vulnerability research. APT45 was observed sending thousands of repetitive, automated prompts to AI systems to recursively analyze CVEs (known software vulnerabilities) and validate working exploits. The China-linked group was caught deploying agentic AI tools called Hexstrike and Strix against technology firms in Asia, tools that can autonomously map a target's attack surface, pivot between reconnaissance methods, and verify exploitable weaknesses with minimal human involvement. Google also confirmed it is fighting back with its own AI: Big Sleep, an AI agent built by Google DeepMind and Project Zero, has already discovered a real-world vulnerability that threat actors were about to weaponize, and stopped them cold. But not every business has Google's resources protecting it.

Here's the uncomfortable truth: when AI helps hackers scan thousands of vulnerabilities automatically, they're not just targeting large corporations. They're running broad, indiscriminate sweeps across the internet, and your small business in Vaughan or Oakville is just as likely to show up on that scan as a bank in downtown Toronto. Every piece of unpatched software in your office is a potential entry point. Dental clinics running legacy practice management software, accounting firms with outdated server configurations, construction companies using older project management platforms, all of these are now on the radar of automated AI-driven attack tools. The difference between you and a large enterprise isn't that attackers don't want to breach you. It's that large enterprises have dedicated security teams patching vulnerabilities within hours of disclosure. Most SMBs patch weeks later, if at all. That gap is exactly what AI-powered attackers are designed to exploit.

Traditional hacking required a skilled attacker to manually research vulnerabilities, test exploits, and build payloads, a slow, expensive process. AI automation has fundamentally changed that equation. Today, a threat actor can feed an AI agent a list of thousands of known CVEs, publicly disclosed software vulnerabilities, and have it automatically determine which ones have working exploits, which targets are running vulnerable software versions, and how to chain multiple vulnerabilities together for maximum impact. Tools like Strix function as multi-agent penetration testing frameworks that automate the identification and validation of weaknesses in a target's environment. Hexstrike goes further, using a memory system called Graphiti to maintain a persistent, evolving map of the attack surface, so the AI agent remembers what it has already discovered and intelligently decides what to probe next. The result is an attacker that works around the clock, never gets tired, scales effortlessly across thousands of potential targets, and continuously refines its approach. For an SMB with no dedicated security team, this is an asymmetric threat of enormous proportions.