The robots can't hack alone: AI in 8% of Q3 attacks, none fully autonomous

Rapid7's Q3 2026 threat analysis found AI as an operational component in just 8% of the incidents it tracked — and in every documented case, humans still chose what to attack and why. “The board-deck version of this year has been wall-to-wall AI attackers, and the data doesn't support that story,” director of vulnerability intelligence Douglas McKee told SecurityWeek.

McKee drew a line between two things people keep mashing together: “AI finding flaws versus AI exploiting them. Finding is real, and it's accelerating. The AI exploitation wave everyone is bracing for didn't show up in our data this quarter.” What is growing is automation of the ‘tactical middle’: technique selection, target triage, and recovering from a failed step, now able to run without a human present.

The rest of the quarter was familiar: high-severity flaws exploited in about three days on average (71% within a week), ransomware the dominant threat (The Gentlemen 342 incidents, Qilin 339), and the US absorbing 60% of attacks. Rapid7 frames it as an early warning, not an all-clear — fully automated AI-assisted attacks are likely within the next few years.