Billionaire entrepreneur Mark Cuban has compared AI-powered hacking agents to cockroaches, warning that their ability to operate at scale could make cyberattacks harder to contain. Speaking at Reuters Events: Total Health in Nashville on October 23, 2026, Cuban argued that businesses can also use artificial intelligence to strengthen their defenses against automated attacks.
Cuban’s central argument is that AI does not necessarily need to invent new hacking techniques to make cybercrime more dangerous. By automating existing methods and repeating them across large numbers of targets, AI agents can increase the speed and scale of attacks. However, he believes defenders can apply the same technology to detect suspicious activity, identify vulnerabilities and respond to threats more efficiently. His comments come as cybersecurity researchers report growing use of AI-assisted tools in real-world attack attempts.
Key Takeaways
- Cuban’s warning: AI hacking agents resemble cockroaches because large numbers of them can keep finding ways into inadequately protected systems.
- Scale is the concern: AI can automate familiar attack techniques and increase the number of attempts made against potential targets.
- AI can defend, too: Cuban argues that businesses can deploy AI-powered security tools to counter automated attacks.
- Real-world evidence: Amazon reported detecting PHP2Shell exploitation attempts before public disclosure of the vulnerabilities in October 2026.
- Security remains essential: Organizations still need patch management, strong authentication, access controls and continuous monitoring.
- Not a guarantee: Defensive AI can improve response capabilities, but it cannot eliminate cyber risk or replace sound security practices.
What Did Mark Cuban Say About AI Hacking Agents?
Cuban made his remarks during a Reuters event focused on healthcare and related business issues. He said he was not pessimistic about AI and compared the persistence of malicious agents to cockroaches repeatedly finding ways into a home.
His analogy describes a problem of scale. A single attacker may have limited time to investigate systems and attempt intrusions. An automated agent can repeat similar activities across many targets, potentially increasing the likelihood that an exposed or poorly configured system will be discovered.
Cuban also challenged the idea that AI-powered attacks necessarily depend on entirely new forms of hacking. His argument is that existing techniques can become more consequential when automation makes them cheaper and easier to repeat.
His proposed response is to use AI on the defensive side as well. Organizations could deploy automated systems to identify suspicious behavior, monitor vulnerabilities and respond to attacks at a speed that would be difficult for human teams working alone.
Cuban’s remarks represent his assessment of the technology’s risks and potential defenses. They should not be interpreted as evidence that all AI agents can independently compromise systems or that automated defenses will always succeed.
Why AI Hacking Agents Are Becoming a Cybersecurity Concern
AI agents differ from conventional chatbots because they can be connected to tools that execute tasks. Depending on their permissions, those tools may let an agent inspect files, run code, browse websites, analyze logs or interact with software systems.
In cybersecurity, these capabilities can be used for legitimate testing and defense. They can also be abused to automate reconnaissance, search for exposed services, test known vulnerabilities or process stolen information.
The main concern is that automation can reduce the effort required to carry out repeated tasks. Attackers may be able to investigate more targets, adapt their approach based on results and continue operating with less direct supervision.
That does not mean every attack becomes successful. Outcomes still depend on the quality of the tools, the systems being targeted and the defenses in place. But organizations can no longer assume that low-effort attacks will necessarily remain small in scale.
How AI can change the attack process
| Attack activity | Potential role of AI agents | Security implication |
|---|---|---|
| Reconnaissance | Collect and organize information about exposed systems | More targets can be examined quickly |
| Vulnerability assessment | Compare software versions and configurations against known weaknesses | Unpatched systems may be identified sooner |
| Attack automation | Repeat known techniques across multiple targets | Security teams may face higher volumes of attempts |
| Credential abuse | Analyze or test improperly exposed credentials | Strong authentication and credential protection become more important |
| Evasion and adaptation | Change tactics based on observed responses | Detection systems need to consider behavior, not just fixed signatures |
These capabilities are not unique to AI, and many have existed in conventional automation for years. AI can make some workflows more flexible by helping tools interpret information and select subsequent actions.
The PHP2Shell Incident Shows Why Speed Matters
A recent example illustrates the time pressure facing defenders. On October 21, 2026, Amazon Threat Intelligence disclosed that it had observed attempts to exploit two PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, before their public disclosure and patch release.
According to Amazon’s security blog, its MadPot honeypot detected an exploitation attempt on October 17—four days before the vulnerabilities were publicly disclosed. Additional attempts followed around the time the fixes were released.
Amazon said it was unclear whether the observed attempts would have succeeded against real-world systems, and investigators had not established how the earliest actor obtained information about the vulnerabilities.
The incident does not prove that AI agents were responsible for those specific attempts. It does, however, illustrate why security teams need to act quickly when vulnerabilities are disclosed and why defenders should not assume that exploitation begins only after a public announcement.
Amazon also warned that AI-assisted analysis can make it easier for more actors to turn vulnerability information into exploit attempts. That creates pressure to patch exposed systems rapidly and investigate activity that predates a public disclosure.
How AI Can Help Defenders Fight Back
Cuban’s argument is that the same automation that helps attackers can also help security teams. AI-powered defensive tools can analyze large volumes of alerts, correlate events and identify patterns that would otherwise require considerable manual investigation.
Faster threat detection: AI can help prioritize suspicious logins, unusual network traffic and unexpected changes to system behavior.
Automated investigation: Security systems can gather relevant logs, identify affected devices and summarize evidence for analysts.
Vulnerability prioritization: AI can help teams understand which exposed systems require urgent attention, although decisions should be grounded in verified vulnerability and asset data.
Incident response: Under carefully defined policies, automated systems can isolate affected endpoints, disable compromised credentials or block suspicious network connections.
Continuous monitoring: AI-assisted systems can operate around the clock, helping organizations respond to activity outside normal working hours.
These applications can reduce the time needed to detect and investigate threats. However, their effectiveness depends on the quality of the underlying data, the controls placed on automated actions and the ability of security teams to verify results.
An AI system that incorrectly identifies legitimate activity as malicious can disrupt operations. A poorly controlled agent could also take an inappropriate action while trying to contain an incident. High-impact responses therefore need clear permissions, audit logs and appropriate human oversight.
Why Businesses Cannot Rely on AI Alone
Cuban’s optimism does not remove the need for conventional cybersecurity controls. AI can assist with security operations, but it cannot compensate for every weak configuration, unpatched application or exposed credential.
Businesses should maintain a clear inventory of internet-facing systems, apply security patches promptly and require strong authentication for sensitive accounts. API keys and other secrets should be stored securely, with access restricted to the systems that need them.
Organizations deploying AI agents should also limit what those agents can access and execute. A tool designed to analyze logs should not automatically have permission to change production systems or access unrelated customer data.
Security teams should test AI tools against realistic attack scenarios and monitor their decisions. Where an automated action could cause significant disruption, such as shutting down a critical service, the organization should define when human confirmation is required.
The goal is not to automate every security decision. It is to use automation where it improves speed and consistency while retaining meaningful control over consequential actions.
What Cuban’s View Means for the Future of Cybersecurity
Cuban’s comparison points to an emerging contest between automated attackers and automated defenders. As AI tools become more accessible, organizations may face more frequent scanning, more attempts to exploit known weaknesses and more automated activity across the internet.
Defenders can use AI to improve detection and response, but attackers also benefit from the same advances. The balance will depend on factors such as how quickly organizations patch vulnerabilities, how effectively they protect credentials and whether their monitoring systems can distinguish malicious activity from legitimate behavior.
This is likely to increase the importance of security operations that combine automated analysis with skilled human oversight. AI can help teams process information faster, while people remain responsible for setting policies, validating findings and deciding how to manage complex incidents.
The Bigger Picture
The significance of Cuban’s comments lies in the changing economics of cybersecurity. AI can lower the effort needed to perform some attacks, making persistent and repetitive activity easier to scale. The same technology can help defenders examine more signals and respond more quickly, but the benefits are not automatically equal on both sides.
For businesses, the practical lesson is to treat AI as both a potential security risk and a defensive capability. Organizations should strengthen basic controls first, then deploy AI where it can demonstrably improve detection, investigation and response. The most effective defense will combine automation with good security engineering, clear permissions and accountable decision-making.
FAQs
1. What did Mark Cuban say about AI hacking agents?
Cuban compared AI hacking agents to cockroaches because large numbers of automated agents can repeatedly find weaknesses in systems. He argued that businesses can also use AI to strengthen their defenses.
2. Why are AI hacking agents a concern?
AI agents can automate parts of reconnaissance, vulnerability testing and other attack workflows. This may allow attackers to make more attempts across more targets, although automation does not guarantee a successful intrusion.
3. Can AI stop AI-powered cyberattacks?
AI can help identify suspicious activity, prioritize alerts and automate some defensive responses. It cannot eliminate cyber risk, and its output must be evaluated carefully to avoid missed threats or disruptive false positives.
4. Was AI responsible for the PHP2Shell exploitation attempts?
Amazon reported that exploitation attempts occurred before the PHP2Shell vulnerabilities were publicly disclosed, but it did not establish that AI agents were responsible. The incident demonstrates the importance of rapid patching and monitoring, rather than proving that a specific AI system carried out the attacks.
5. How can businesses protect themselves from AI-driven attacks?
Businesses should patch vulnerable systems quickly, secure credentials, enforce multifactor authentication, limit access privileges, monitor network and account activity, and test their incident-response plans. AI tools can supplement these measures but should not replace them.
Looking Ahead
As AI agents become more capable, cybersecurity teams will need to shorten the time between detecting a vulnerability, applying a fix and identifying attempted exploitation. Automated systems may help organizations process alerts and respond at greater scale, but their value will depend on reliable controls and verified results.
Cuban’s message is ultimately that the technology can be used on both sides of the cybersecurity equation. The challenge for businesses is to turn that potential into practical protection through faster patching, careful automation and security policies that keep both human users and AI agents within clearly defined boundaries.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
