Open Source Securities: AI brings new changes to cybersecurity, and the industry ushers in new development opportunities.

Open Source Securities released a research report stating that as AI application scenarios such as large models and agents accelerate their deployment, the security risks brought by AI are penetrating into core business links, giving rise to new systemic risks such as prompt injection, model poisoning, and multi-agent collaborative deception. In 2027, AI application security will remain the largest spending category, expected to reach nearly US$851 million, followed by AI usage control, with spending expected to reach US$749 million. In the AI era, cybersecurity has entered a stage of "AI versus AI," and the industry is also ushering in new development opportunities. The main views of Open Source Securities are as follows: In the AI era, cybersecurity has entered a stage of "AI versus AI" With the widespread application of artificial intelligence technology, the field of cyberattacks has undergone a critical iteration. Attackers have begun using AI to complete target screening, information integration, path planning, attack execution, and strategy adjustment, and using AI Agents to launch automated attacks, achieving exponential improvements in both attack efficiency and stealth. The rules of the cybersecurity offense-defense game have evolved from past human-versus-human contests to a stage of "AI versus AI." At the same time, as AI applications such as large models and agents accelerate their deployment in scenarios including government affairs, finance, industry, healthcare, and internal enterprise management, the security risks brought by AI are penetrating into core business links, giving rise to new systemic risks such as prompt injection, model poisoning, and multi-agent collaborative deception. Anthropic and OpenAI launch AI security defense models, placing great emphasis on AI security (1) According to disclosures by Anthropic, a hacker group tracked as GTG-1002 used the Claude Code tool to launch highly automated penetration operations against global targets. The attackers did not use any self-developed malware, but instead combined publicly available penetration testing tools and built a multi-agent attack architecture through Claude Code plus MCP (Model Context Protocol). They made Claude believe it was an employee of a legitimate cybersecurity company conducting authorized security testing. Subsequently, Anthropic launched the Claude Mythos projectan AI system specifically designed for security defense. In testing in April 2026, it discovered thousands of zero-day vulnerabilities, covering all major operating systems and browsers. In addition, OpenAI launched GPT-5.4-Cyber, a specially optimized version of GPT-5.4 tailored for cybersecurity defense scenarios. (2) On August 27, OpenAI published an open letter titled "A Call to Action for Cyber Defense," which received signatures from at least 116 companies and organizations, including heavyweight institutions spanning AI, cybersecurity, finance, and infrastructure such as Anthropic, Google, Microsoft, AMD, CrowdStrike, Palo Alto Networks, Okta, Fortinet, Citibank, Capital One, Visa, and Mastercard. The core warning of the open letter is that AI-driven cyberattacks will become "more widespread and complex" in the coming months. As AI penetration increases, the global AI security market will achieve rapid growth Gartner estimates that in 2027 the global AI security market will grow 69% compared with 2026, reaching US$4.783 billion, and further rise to about US$7.7 billion in 2028. The rapid growth of the AI security market mainly stems from enterprises' urgent need to protect artificial intelligence systems, address emerging vulnerabilities, and strengthen defenses against complex cyber threats. In 2027, AI application security will remain the largest spending category, expected to reach nearly US$851 million, followed by AI usage control, with spending expected to reach US$749 million. Risk warning: technological progress falling short of expectations, and the risk of intensified market competition.