Key Takeaways

  • Model obliteration removes guardrails from open-weight models on platforms like Hugging Face, allowing anyone with a local machine to generate full ransomware packages.
  • Agentic technology eliminates the capability gap between amateur hackers, criminal rings, and nation-states, creating what CrowdStrike calls the "agent state."
  • AI models have not created new hacking primitives; instead, they dramatically accelerate the speed and volume of vulnerability discovery.
  • The bottleneck for cyber offense and defense has shifted from human tradecraft to raw compute capacity and token cost.

The Rise of the Agent State

Security teams used to rank threats by budget and sophistication. A lone hacker caused annoyance. An organized cybercrime syndicate demanded a ransom. A foreign intelligence service breached hardened infrastructure with zero-days.

That hierarchy is dead. At CrowdStrike's Fal.Con conference, Jordan Curts explained how open-weight models flattened the playing field. The apex predator in cybersecurity is no longer a government agency with hundreds of analysts. It is what Curts calls the "agent state."

“Because the knowledge has now been democratized where whether it's a activist, an e-crime actor, a nation state, they're all now equivalent because of agentic technology,” Curts noted. “And we called it the rise of the agent state.”

The shift comes down to uncensored model availability. An attacker does not need an API account with strict usage policies. They download an altered, open-weight model directly from Hugging Face onto a high-end local machine.

“We talked about obliteration really taking the guard rails off an openweight model and you go to Hugging Face now and you can download these obliterated models and you can run them basically on a beefy system,” Curts said. “You put a question in and you're like there's no way it can answer this and it builds like you want a full malware ransomware kit. Boom. It's done.”

Attack Speed Replaces Novel Tradecraft

When founders worry about AI cyberattacks, they often imagine an autonomous model writing exotic, science-fiction exploit chains. The reality is more mechanical, but equally dangerous.

“It really hasn't come up with a new invention of hacking,” Curts clarified. “This is very important. It's come up with it can find more vulnerabilities. So more of and faster.”

Instead of inventing new attacks, obliterated models scan thousands of lines of code, spot mundane errors, and write targeted exploits in seconds. An attack that once required three weeks of human reverse-engineering now happens in minutes.

Because offensive models use existing techniques at high speed, the primary limitation on an adversary is no longer expertise. It is infrastructure.

“The limitation for these attacks are really going to come down to sort of compute and cost,” Curts said. Defense must adapt to the same math. Human security teams cannot manually review alerts when an agent fires hundreds of distinct exploits against an API in a single afternoon. As Curts put it, “Security parallels the slope of the technology curve.”

What to Do With This

Assume your next attacker has the offensive capabilities of a nation-state funded team, even if they are a solo actor operating on a single gaming PC. Run an automated static code analysis tool across your public-facing endpoints this week, and set up automated rate-limiting and IP throttling on all authentication routes before Friday. If your defensive posture relies on an engineer manually reviewing intrusion logs once a day, an automated agent will find and exploit your open ports before lunch.