Six South Korean banks were hacked in a single incident investigated by CrowdStrike — and the alleged attacker left personal information behind by using AI tools carelessly. For Adam Meyers, head of counter-adversary operations at CrowdStrike, the case is a lesson in proportion, not panic.

Meyers learned of the breach mid-flight from the United States to South Korea, when colleagues messaged him that six Korean banks had been hacked and that he would likely face questions on landing. Before the plane touched down, his team had pinpointed the attacker's server, recovered records of their activity and identified a suspect.

The attack, which CrowdStrike investigated and disclosed publicly, used Artex, an open-source AI-powered penetration-testing tool, together with large language models from several providers. The scale and speed explain why AI has fueled fears about cybersecurity's future. Meyers is not among the fearful.

"Fundamentally, this is nothing new. It's just speed and volume," he said in an interview with Fast Company at CrowdStrike's Fal.Con conference in Barcelona. "AI hasn't come up with new exploit paths or new vulnerability classes, right? It's all the same stuff we're already aware of."

Why do experts say the alarm is overblown?

Meyers believes the industry confuses what AI models can theoretically do with the actual threat they pose. Ciaran Martin, former head of the U.K.'s National Cyber Security Centre, goes further. "To some extent, we've lost our mind in 2026 because of the extent of the capabilities," he said.

Martin argues that frontier AI developers focus on theoretical capability while ignoring how real attackers operate. "They don't understand threat actors. They don't understand hackers. They don't understand the economics and the sociology and the politics of hacking," he said.

The practical consequence: a rising volume of automated attacks and suspicious activity that does not translate into more successful breaches — but does bury security teams in alerts they must triage.

Eerke Boiten, a cybersecurity professor at De Montfort University in the U.K., sees the same pattern from a technical angle. AI accelerates the discovery of vulnerabilities, he says, but the ability to exploit them is not advancing at the same pace. Defenders get the same benefit: AI can help them fix flaws and assess how hard those flaws are to exploit.

When does a vulnerability deserve urgent action?

Meyers' broader complaint targets how organizations rank risk. The industry leans too heavily on the Common Vulnerability Scoring System, which rates flaws from one to 10.

Consider PHP2Shell, a pair of vulnerabilities in the widely used PHP programming language that each scored 9.2. CrowdStrike examined the flaws before public disclosure and concluded exploitation would be far from straightforward. Woodward — who also commented for the piece — agreed, noting that attacking them required exceptionally precise timing and chaining vulnerabilities together.

The flaws were not theoretical either. On October 26, the Cybersecurity and Infrastructure Security Agency, part of the U.S. Department of Homeland Security, added both to its catalog of known exploited vulnerabilities and called for urgent action.

Woodward defends CVSS as a measure of potential impact. Meyers argues severity scores alone should not drive response; evidence of active exploitation in the wild should carry equal weight. "I like to think about things in terms of what's being actively exploited," he said.

The alternative is burnout. "The more people get burned out, the more they're going to make mistakes," Meyers warned.

Boiten finds room for optimism on the defender's side. The collaboration now underpinning vulnerability identification could extend to fixing flaws, and AI-assisted coding could reduce the number introduced in the first place. That marks a shift in his own thinking: a year ago he expected the rise of so-called vibe coding to produce more vulnerabilities, not fewer.

For all the focus on AI, the most persistent vulnerability remains human. Attackers still frequently gain access by exploiting people, not code.

Who benefits from the AI panic?

Meyers points at the frontier labs themselves. "There's a lot of fearmongering going on, and I think the frontier labs have been stoking that fire for their own benefit," he said.

Frightening predictions about AI capabilities could serve the commercial and regulatory interests of those companies, particularly as they consider going public. Emphasizing the potentially catastrophic consequences of their own technology also reinforces perceptions of their power.

The risk of overreaction is twofold: organizations may spend too heavily on the wrong threats, and a steady drumbeat of warnings may dull their response when a genuinely serious threat arrives.

"I think we need to be careful not to overhype it or we'll find people stop listening, and then there will be something they really need to take care of," Woodward said.