AI-executed cyber incidents

This question asks how far up a four-step ladder of harm we'll see an AI-run cyberattack climb — where "AI-run" means the machine did most of the hacking and humans only set goals and approved at a few points, and where the harm has to be confirmed by the victim itself, a government agency, or the incident-response firm the victim hired. Right now none of the rungs has been reached. We put the chance of the first rung — material harm to a named organization — at 21% by the end of 2026, 60% by the end of 2027, and 94% by late 2031. Critical-infrastructure disruption reaches 71% by 2031, a national-scale event 49%, and mass harm 12%.

The striking thing about 2026 is that the technical milestone has already been passed and the paperwork hasn't. Hugging Face said publicly that its infrastructure was breached end to end by an autonomous agent swarm running roughly 17,600 actions — that's the victim itself confirming AI execution. But there was no big data breach, no day-long outage, no ransom, no loss figure, so it doesn't clear the first rung. The same gap shows up everywhere: Anthropic has disclosed multiple real intrusions by its models, but the victims are unnamed and a developer's word doesn't count here. Unit 42 documented an enterprise breached by agents in under ten hours, anonymized. Researchers have described an agent-driven campaign hitting hundreds of PaperCut installations, but no government has endorsed that account. Taiwan's government called its incident a hybrid of manual work and AI agents — "assisted," not "executed."

So the forecast is really about the confirmation pipeline, not the attacks. Pushing it up: material cyber harm is routine, agentic tooling is spreading from state actors to ordinary criminals, and a single named victim saying the right sentence resolves it. Holding it down: victims sanitize disclosures for legal reasons, responders anonymize clients, and governments prefer the weaker "AI-enabled" phrasing. The biggest open question is whether that gap is a temporary lag or a permanent feature — which is why even five years out this isn't near certainty.

What would move it most: any named victim, their hired responder, or an agency tying an autonomous agent to a large breach, a day-long outage, or a million-dollar ransom. Or a government confirming a hundred-plus organizations hit in one agent-run campaign, which would jump three rungs at once.

Question. For each quarter, what is the highest rung R such that an incident meeting rung ≥ R has been publicly confirmed on or before the last day of the quarter?

Qualifying incident (required for every rung). An incident in which AI systems performed the substantial majority of the offensive operational actions (reconnaissance, initial access, exploitation, lateral movement, persistence, exfiltration, or destruction), with human involvement limited to setting objectives and approving or redirecting at discrete points ("AI-executed"). Ongoing high-level human guidance does not disqualify. A human performing operational steps using AI-generated tooling does disqualify. Whether the AI systems were pursuing a human-assigned hostile objective, a human-assigned benign objective, or no identifiable objective is irrelevant. The AI system may be developed by any developer, not only a covered developer.

Confirmation. The AI-executed characterization must be stated by at least one of: a national government agency; the affected organization; or an incident-response firm publicly identified as engaged by the affected organization. Reports by independent researchers or journalists do not count on their own. A dispute by the AI system's developer does not block resolution if a qualifying source has confirmed. The harm facts for each rung must also be confirmed by a qualifying source, which may differ from the source confirming AI execution.

Rungs (cumulative; higher rungs imply lower).

• R1 — Material harm to a named organization. The victim organization is publicly identified, and any of: (a) the victim (or its parent) files a securities disclosure treating the incident as material — an SEC Form 8-K Item 1.05 or a foreign equivalent; (b) a breach notification to a regulator or to the public covering ≥100,000 individuals; (c) an outage of the victim's primary service lasting ≥24 consecutive hours, confirmed by the victim; (d) confirmed direct losses ≥ US$10 million under the loss rules below; (e) a ransom paid of ≥ US$1 million, confirmed by the victim, an insurer, or a court. "Primary service" means the function the organization exists to provide; suspension of ancillary functions (e.g., new-account registration) does not count. A ransom demand alone, or an incident described only in an anonymized incident-response report, does not count.
• R2 — Critical-infrastructure service disruption. The victim is a named operator within one of the 16 critical infrastructure sectors designated by CISA (or the equivalent national designation outside the US), and the incident disrupts the service that operator provides to the public (e.g., power delivery, water treatment, clinical care, payment processing, transport operations) for ≥24 consecutive hours or affecting ≥100,000 people, as confirmed by the operator or a government agency. Corporate-IT impact alone, or data theft without service disruption, does not count.
• R3 — National-scale event. Any of: (a) confirmed direct losses ≥ US$1 billion attributable to a single campaign; (b) ≥100 organizations confirmed compromised in a single campaign by a national government; (c) a declaration of national emergency, or equivalent, by a G7 government citing the incident.
• R4 — Mass harm. Any of: (a) ≥100 deaths attributed to the incident by a national government; (b) confirmed direct losses ≥ US$10 billion; (c) loss of a critical-infrastructure service to ≥1 million people for ≥7 consecutive days.

Loss figures. Qualifying sources in priority order: (1) court judgment or settlement; (2) SEC or equivalent securities filing by an affected public company; (3) insurer statement; (4) affected-organization statement. Resolve on the lowest figure among qualifying sources published on or before the resolution date. Estimates by third parties (consultancies, press, researchers) never count. "Direct losses" excludes reputational, stock-price, and macroeconomic estimates.

Campaign. Activity attributed by a qualifying source to the same operator or agent population within a 90-day window.

Forecast horizons. Every quarter-end from 2026-09-30 through 2031-09-30.