{"id":7813,"date":"2026-09-28T23:13:34","date_gmt":"2026-09-28T23:13:34","guid":{"rendered":"https:\/\/silvybrand.com\/?p=7813"},"modified":"2026-09-28T23:13:34","modified_gmt":"2026-09-28T23:13:34","slug":"ai-is-supercharging-hacking-and-your-local-hospitals-and-banks-arent-ready","status":"publish","type":"post","link":"https:\/\/silvybrand.com\/?p=7813","title":{"rendered":"AI is supercharging hacking, and your local hospitals and banks aren\u2019t ready"},"content":{"rendered":"


\n<\/p>\n

\n
\n

In March, Janice Malone began getting calls about suspicious activity from her nonprofit organization, Vivian\u2019s Door. Vivian\u2019s Door, headquartered in Alabama, typically provided training, resources, and community to underserved and minority-owned businesses. The work sometimes put it in close contact with these companies\u2019 financial data, which was stored on its systems. But suddenly, concerned callers from all over the world warned they\u2019d been getting emails \u201cbegging for money\u201d \u2014 which she hadn\u2019t sent.<\/p>\n<\/div>\n

\n

The organization\u2019s third-party IT team pulled its systems offline for three days while they investigated the issue and plugged up the vulnerability, leaving Malone with a bill of about $3,000. She feared that she\u2019d exposed information about the companies she was trying to help. Even more ominously, she wasn\u2019t completely sure if the attack was engineered by a human hacker or helped along by an AI system, or whether more were on the way.<\/p>\n<\/div>\n

\n

The past months have seen AI revolutionize the field of cybersecurity. OpenAI and Anthropic have disclosed that \u201crogue\u201d systems<\/a> escaped restrictions in their own labs and hacked everything from a small German wiki to the Australian government. Even before that, powerful models like Anthropic\u2019s Mythos created an arms race to advance AI cybersecurity, and even lighter-weight models have allowed human bad actors to supercharge their hacking efforts.<\/p>\n<\/div>\n

\n

Malone isn\u2019t sure whether AI was involved in the hack of Vivian\u2019s Door. But amid stories of autonomous agent swarms and national security risks, she felt especially concerned. Big AI companies were bragging about finding vulnerabilities in \u201cevery major operating system and web browser\u201d with new models, and their big-name clients were striking deals to defend themselves with those same tools. Where did that leave her?<\/p>\n<\/div>\n

\n

\u201cWho knows about the next vulnerability? You only know about the one that you\u2019ve been hit with,\u201d Malone said, adding, \u201cHow do you protect yourself? I mean, really?\u201d<\/p>\n<\/div>\n

\n

AI agents have become consistently, strikingly skilled at cybersecurity and coding, and they can be deployed at enormous scale. Even attackers with limited knowledge of AI can engage in \u201cvibe-hacking\u201d with these new, automated systems, and hackers who might once have focused on only the most valuable targets can take a shotgun approach. In August 2025<\/a>, Anthropic said that a sophisticated cybercrime ring used Claude Code to extort data from healthcare organizations, emergency services, religious institutions, and even government entities, all in one month.<\/p>\n<\/div>\n

\n

\u201cWhat would have otherwise required maybe a team of sophisticated actors,\u201d Jacob Klein, head of Anthropic\u2019s threat intelligence team, told The Verge<\/em> in an interview at the time<\/a>, \u201cnow, a single individual can conduct, with the assistance of agentic systems.\u201d<\/p>\n<\/div>\n

\n

In theory, AI is also supposed to safeguard cyber defenses; Anthropic\u2019s Mythos is reportedly flagging so many vulnerabilities that Microsoft is struggling<\/a> to fix them fast enough. But out of concern over potential danger, top AI labs only allow a limited list of high-profile organizations to access their most powerful cybersecurity models, like Mythos and OpenAI\u2019s Astra. That includes companies like Nvidia, Google, and Apple, as well as other<\/a> \u201cessential infrastructure providers\u201d and \u201cmaintainers of critical open-source software.\u201d Even if access was more widely available, it would likely be too expensive for many smaller organizations.<\/p>\n<\/div>\n

\n

Now, these organizations \u2014 from healthcare clinics and municipalities to small retailers and nonprofits like Vivian\u2019s Door \u2014 fear an increasingly lopsided power dynamic. As Marius Hobbhahn, CEO and cofounder of Apollo Research, put it<\/a> in an interview with The Verge<\/em> this summer, \u201cA single person somewhere in a basement with one of the open-source models probably could hack a hospital and demand ransom. That\u2019s where I expect a lot of the harm to be felt. It\u2019s not in the Bay Area\u2026 I expect the harm to be felt by a random Idaho hospital.\u201d<\/p>\n<\/div>\n

\n

Small- and medium-size institutions are particularly at risk from AI agents supercharging a finite number of human hackers, says Michael Kleinman, head of US policy for the Future of Life Institute, a nonprofit focused on reducing large-scale risks of tech. And despite being small, these institutions provide vital services to their users. \u201cBank of America has a lot of resources to throw at this \u2014 what about community level banks? What about savings and loans? What about credit unions? What about local hospital networks? What about local power grids?\u201d Kleinman said. \u201cThe limiting factor used to be that there\u2019s a finite number of malicious hackers in the world, and that\u2019s now no longer the case.\u201d<\/p>\n<\/div>\n

\n
\n

\u201cThe limiting factor used to be that there\u2019s a finite number of malicious hackers in the world, and that\u2019s now no longer the case.\u201d<\/p>\n<\/div>\n<\/div>\n

\n

Malone of Vivian\u2019s Door said that like most small businesses or nonprofits, she doesn\u2019t have the resources for round-the-clock cybersecurity forces or IT staff hunting for unknown threats. \u201cI just don\u2019t know how you can really be, as a small business, totally protected on the budgets you have to do IT with,\u201d she said. Spending thousands of dollars on unexpected expenses to fortify the Vivian\u2019s Door system was already tough, she said, not to mention the fact she still had to pay her staff and couldn\u2019t do any business for days on end. If the frequency of these attacks rises, she\u2019s ill-equipped to keep up.<\/p>\n<\/div>\n

\n

Craig Smith, CEO of The Cool Hardware Company, a small group of hardware stores in and around Washington, DC, says AI can be helpful for running day-to-day aspects of a small business, especially when you have limited staff. But he also acknowledged the cybersecurity risks that come from AI on the whole \u2014 not just to small companies like his, but to the larger systems he uses. Those include Microsoft tools like Outlook, Copilot, Teams, and Forms, but also things like procurement and delivery tools, which are managed by large non-tech companies. The Cool Hardware Company uses Ace Hardware\u2019s systems for those things, and if they were downed, it\u2019d be very difficult for Smith to run his business.<\/p>\n<\/div>\n

\n

\u201cI welcome the innovation and the changes, but with any major shift in technology, there needs to be a lot of responsibility that goes along with it,\u201d Smith said.<\/p>\n<\/div>\n

\n

Mike Houston, the general manager of Takoma Park Silver Spring Co-op, a local grocer in Maryland, says he\u2019s faced hackers firsthand as a small business \u2014 and dreads facing them again in the AI era. In recent years, he said, he\u2019s dealt with \u201ccarting attacks\u201d: hackers using the co-op\u2019s online shopping platform to test thousands of stolen credit cards, racking up processing fees that he\u2019s on the hook for. \u201cEven if almost all of those are declined, there still can be thousands of dollars\u2019 worth of fees in a very small amount of time,\u201d Houston said. He\u2019s taken the necessary precautions to try to fortify his systems against the practice, but it\u2019s \u201cnot foolproof,\u201d he said.<\/p>\n<\/div>\n

\n

The store plans to open a second location and potentially double the size of its workforce accordingly, so he feels he needs to implement new testing procedures and vulnerability flagging for the first time. He said that in recent years, he also had to add an IT liability policy to the co-op\u2019s business insurance.<\/p>\n<\/div>\n

\n

\u201cIt is certainly a concern as a small business \u2026 without unlimited resources,\u201d Houston said. \u201cWe are, like everyone I think, doing the best with what we can, both in terms of the monetary resources that we have and training resources.\u201d He said he worries for co-ops smaller than his own, where managers often end up doing their own IT work.<\/p>\n<\/div>\n

\n
\n

\u201cOnce the cat is out of the bag, it\u2019s really difficult.\u201d<\/p>\n<\/div>\n<\/div>\n

\n

The pressure for small businesses to rapidly adopt AI tools can introduce its own vulnerabilities, says Patricia Egger, head of security for privacy-focused email provider Proton. As with other unfamiliar tech, they may not immediately set up or keep up with its cybersecurity best practices. When employees are \u201cgiven the mandate or the go-ahead, \u2018Find ways to use AI, find ways to make your work more efficient,\u2019 they get really creative, and it\u2019s very difficult for controls, infrastructure, and processes to be set up after the fact,\u201d she said, adding, \u201cOnce the cat is out of the bag, it\u2019s really difficult.\u201d<\/p>\n<\/div>\n

\n

One of the highest-stakes industries at risk of cyberattacks is healthcare. In May 2021, a ransomware attack<\/a> forced California-based medical provider Scripps Health to shut down key operations, compromising patient data and slowing care. A 2024 report<\/a> said that the healthcare industry faced the second-highest global cyberattack rate, behind governments, and that initial ransom payment demands were often upwards of $4 million. An overall increase in hacking incidents could hit the sector especially hard.<\/p>\n<\/div>\n

\n

Linda Stevenson, chief operations and information officer at Fisher-Titus Medical Center in Ohio, said she\u2019s \u201cof course\u201d concerned about the potential influx in AI-powered cyberattacks. \u201cYou\u2019re never as protected as you want to be,\u201d she said. The medical center currently employs a third-party cyber risk management partner called UpGuard, and they hired their first cybersecurity analyst two years ago, Stevenson said \u2014 but they still only have one, even as cybersecurity threats rise.<\/p>\n<\/div>\n

\n

\u201cWhat we do is life or death,\u201d she said, adding, \u201cThe hospital has everything from billing to marketing. It\u2019s like a little city in and of itself. But the critical mass of that is the people who care for the patients, and if we can\u2019t protect them and their data and therefore the patients\u2019 data, patients are at risk.\u201d<\/p>\n<\/div>\n

\n
\n

\u201cWhat we do is life or death.\u201d<\/p>\n<\/div>\n<\/div>\n

\n

Healthcare in general can be a \u201cbigger honeypot\u201d for ransomware attacks, said Sean Kelly, a former emergency room physician and current chief medical officer at Imprivata, a healthcare security company. No diagnosis or treatment happens without access to digital systems to check past medical history, allergies, other medications, and more, creating even more pressure to pay up. Plus, he said, a lot of people quickly change from station to station, needing to sign in and out of devices quickly and constantly.<\/p>\n<\/div>\n

\n

\u201cThe stakes are higher and yet the budgets are lower, in healthcare, a lot of times,\u201d Kelly said. \u201cRansomware attackers know that healthcare systems are valuable because a hospital can\u2019t go down, and it\u2019s really hard when they\u2019re on downtime because patients suffer, systems suffer, there\u2019s less billing, the finances go down, and care gets delayed or even can\u2019t happen. So there\u2019s more of a premium on that data because there\u2019s healthcare data as well as financial and demographic data, so it\u2019s worth more to ransomware attackers.\u201d<\/p>\n<\/div>\n

\n

Even beyond swarms of agents, AI makes it even easier for hackers to find these vulnerabilities and exploit them, through voice phishing attacks when calling help desks and other methods, Kelly said. And when an outage hits one hospital, it often leads to a \u201cblast radius\u201d<\/a> that affects the other facilities in the area with longer wait times, diverted patients, and more.<\/p>\n<\/div>\n

\n

\u201cThey just don\u2019t have the IT staff or the budget to protect against a lot of the latest AI-driven efforts in hacking and ransomware and other cybersecurity attacks,\u201d Kelly said. \u201cIt\u2019s hard even with a large IT staff and with a big budget, but a lot of times, the rural hospitals are using older, more antiquated software systems and tech stacks that just have vulnerabilities.\u201d<\/p>\n<\/div>\n

\n

For small- and medium-size organizations, no matter the industry, their systems and cybersecurity defenses are already often more fragile than those of large corporations, particularly in an age when AI is increasing hackers\u2019 manpower and supercharging cyberattacks.<\/p>\n<\/div>\n

\n

\u201cAll it takes is one vulnerability somewhere,\u201d Kelly said.<\/span><\/p>\n<\/div>\n

Follow topics and authors<\/strong> from this story to see more like this in your personalized homepage feed and to receive email updates.<\/span><\/p>\n