How Much Hacking Can One Person Automate? AI Is Shrinking the Team

Written By James Taylor
How AI Changes the Work a Lone Hacker Can Do

How AI Changes the Work a Lone Hacker Can Do

One Operator, Many Targets

Documented campaigns show machines taking on operational work, but speed, success and independence need separate measures.

One person can automate substantial parts of hacking: collecting information, processing technical results, drafting software and organising findings. With an AI agent connected to tools, the work can extend beyond advice into action. The harder question is how much of that activity produces a verified result without someone stepping in.

There is no defensible universal number of organisations one person can breach in a day. A campaign against poorly protected systems and an attempt to penetrate a closely monitored network are different undertakings. Public evidence supports a narrower conclusion: automation can reduce the labour required for some operations, without making every target accessible or every machine decision trustworthy.

What Changes When AI Can Use Tools

A chatbot normally returns an answer for someone to read. An agent can use software, examine the result and decide what to do next. That creates a loop in which the operator may supervise several steps rather than perform each one.

The distinction is between generating an instruction and executing it. A proposed action still depends on a person carrying it out. A connected agent may already have the access needed to act. Its practical power therefore depends on its tools, permissions and surrounding software as well as the model itself.

This makes discussions of AI agents and their security boundaries more useful than treating every AI product as an equally capable hacking system. A model confined to explaining a document presents a different problem from an application authorised to change a working environment.

A Documented Extortion Case

In August 2025, Anthropic described a cybercriminal using Claude Code in a data-theft and extortion operation targeting at least 17 organisations. The sectors included healthcare, emergency services, government and religious institutions.

The company said the tool helped with reconnaissance, credential harvesting and network penetration. It also described AI being used to analyse stolen information and support extortion decisions. Some demands exceeded 500,000 dollars. That was money demanded, not evidence of money paid.

Anthropic said it banned the accounts and shared technical indicators with relevant authorities. Its account provides evidence of observed misuse on its own service, rather than an independent audit of the entire operation.

The important labour shift extends beyond writing code. Once information has been taken, someone must understand it and decide what it means. Automating that reading and sorting work can expand an operator’s capacity even when gaining access remains difficult.

The number of organisations targeted must still retain its meaning. It is not interchangeable with a count of confirmed breaches, paid ransoms or simultaneous operations conducted without supervision.

What the 80 to 90 Per Cent Claim Shows

Anthropic’s November 2025 account concerned a separate espionage campaign detected that September. The company attributed it, with high confidence, to a Chinese state-sponsored group. It described attempted infiltration of roughly 30 targets, with success in a small number of cases.

Anthropic estimated that AI performed 80 to 90 per cent of the campaign, with humans involved at around four to six critical decision points per hacking campaign. These are the company’s estimates, not a general measure of what every hacker can automate. Nor does this group operation establish what one individual could reproduce.

The tool also made mistakes. Anthropic said it sometimes invented credentials or described publicly available material as secret information. The company corrected an initial speed claim: the activity involved thousands of requests, often multiple per second, rather than thousands per second.

A percentage of work is not a percentage chance of success. Automating most routine actions could leave a person responsible for the few decisions that determine the outcome. Counting actions also gives the same apparent weight to a trivial check and a difficult judgement unless the measurement explains otherwise.

The Workload Moves to Verification

Consider a hypothetical authorised security assessment. An automated system returns a long list of possible weaknesses. If a specialist must inspect every item, reproduce each finding and remove false positives, the system has accelerated discovery while leaving a substantial review burden.

That can still be valuable. The test is whether the reviewer reaches reliable conclusions faster, not whether the software produces more text.

The same constraint applies to an attacker. An agent’s claim that it obtained access cannot substitute for evidence that the access exists. A confident but false result may send later work down the wrong path. Running more agents can increase the number of results awaiting inspection rather than increase useful capacity in equal proportion.

For this reason, a meaningful demonstration should disclose the starting conditions, the task, the time allowed and the human interventions. It should explain what counted as success and whether another person could verify it. A polished final report reveals little about how much repair or guidance was needed along the way.

Does AI Make Beginners Equivalent to Experts?

Britain’s National Cyber Security Centre assessed in May 2025 that AI would almost certainly make elements of cyber intrusion more effective and efficient through 2027. It expected wider access to AI-enabled intrusion capabilities and faster exploitation of known vulnerabilities.

The same assessment judged fully automated, end-to-end advanced attacks unlikely through that period, with skilled people remaining involved. This was a forward-looking judgement made in 2025, not a timeless ceiling on subsequent systems.

Those findings allow for both a lower entry barrier and a continuing advantage for expertise. Help completing a task does not automatically confer the ability to recognise an unreliable result. Experience matters when the environment differs from expectations or a tool fails without explaining why.

A useful comparison is between two operators given the same assistant. One can assess whether its output fits the situation. The other must accept or reject its recommendations largely on trust. Both may work faster, but their ability to recover from an error differs.

Why a Lone Operator Is Not Working Alone

The phrase “one person” describes the visible operator, not necessarily all the labour behind the operation. Software, computing infrastructure and services supplied by other people can carry much of the workload. An AI model adds another layer of externally developed capability.

That distinction matters when judging claims that an individual has replaced an entire team. The immediate staffing requirement may shrink while dependence on outside infrastructure grows. Access, cost and service restrictions remain practical limits even if the person spends less time on each task.

It also explains why multiplying one successful demonstration into a forecast of unlimited attacks is unsound. Repeating a workflow requires more than copying its instructions. Each new environment brings different permissions, software and evidence to interpret.

The Defensive Question Is Where Authority Stops

For an organisation, a useful response begins with deciding which actions software should be allowed to take. Reading records, proposing a change and applying that change are separate grants of authority. A broad instruction to protect a business does not define all three.

The same issue arises when AI receives permission to move money. A sound recommendation and an authorised transaction are different things. Systems need a way to preserve that boundary when an automated process makes a mistake.

Oversight also needs an intervention point. A person who sees a report only after an action has finished has an investigative role, not an opportunity to prevent that action. Discussions of emergency controls for AI therefore need to establish what can actually be stopped and when.

The next persuasive claim about automated hacking should come with more than a target count. It should show verified outcomes, failures, human time and the access provided at the start. Without those details, readers cannot tell whether one person has gained a dependable operational capability or a much larger queue of work to check.

Sources

Next Reads

James Taylor
Previous

Bulgaria Approves Arrest Warrants for Two Germans Accused of Starlink Antenna Arson
Next

Meta Rewrites Scraping Terms After Publishers Raise AI Training Fears