At a media briefing and discussion about AI-driven cyber risk, Snehal Antani, Horizon 3’s co-founder and CEO, described a cybersecurity landscape moving toward machine-speed attacks and defenses.
His central prediction?
That the future of cyber warfare is AI versus AI with humans by exception. In his view, the challenge is not simply building a more intelligent model, but responding quickly enough to contain an attack.
The discussion also served as a good session to address and debunk a number of widely held perceptions about cybersecurity.
Models can be fooled
One trend Snehal expects will draw more attention is the gullibility of AI models. He said his company’s tests found that models could be lured into interacting with decoy files or credentials, even when some recognised that the files might be traps.
“Almost 100-percent of the time, it says this looks like a trap. Seventy-three percent of the time it says I’m going to click on it anyways.”
He also claimed that a decoy credential could attract models. “If you put a well-placed decoy, a fake AWS credential, in the Unix home directory, you can get the latest Frontier models to open it almost 96-percent of the time.”
He argued that attackers can exploit this tendency – and that defenders can turn it around by using carefully placed decoys to detect suspicious activity. “Well-placed deception is the cheapest, fastest, most effective way at catching AI hackers.”
Snehal linked the problem to the limited cybersecurity data used to train models. Public cybersecurity material, he argued, cannot fully represent the complex, real-world environments found behind corporate firewalls. Horizon3’s approach, he said, is to use penetration testing as a way to collect diverse, anonymised data about how systems behave under attack.
If you put a well-placed decoy, a fake AWS credential, in the Unix home directory, you can get the latest Frontier models to open it almost 96-percent of the time.
Snehal Antani
“This is why I say I’m a data company. Pen testing is my sensor.”
More vulnerability findings do not necessarily mean more exploitable flaws
Snehal cautioned against treating a rise in AI-discovered vulnerabilities as proof that attackers can readily exploit them. Many reported bugs, he said, may not be exploitable in practice or may be mitigated by other controls. The resulting problem for security teams may be triage – deciding what deserves attention when scanners produce more findings than organisations can fix.
“There is a lot of noise, and it’s never been tougher to decide what not to fix,” Snehal said, adding that the imbalance between rising vulnerabilities and limited resources is even worse now.
He also pushed back on the idea that finding a software flaw is, by itself, the key to breaking into an organisation. In his assessment, attackers often have other routes once they gain initial access, including misused credentials, exposed data, or weaknesses in network controls. “Custom code zero days are almost never how the attacker gets in, and even then, it’s only the front door. You left all the interior rooms open and unlocked. You left the safe unlocked.”
Defenses may need to move closer to the breach
The CEO also opined that the cybersecurity stack will need to be redesigned for faster, distributed and local decision-making as attacks happen at machine speed. He predicted this change over the next 12 to 24 months.
That could mean placing containment decisions closer to the compromised device or network segment. He identified two key ways to limit an attacker’s reach – quickly restricting compromised credentials and isolating affected network segments. The goal, he said, is not to assume every intrusion can be prevented, but to reduce the damage when one occurs.
“Network and credential are actually the two boundaries to minimise the damage of an attacker.”
A cybersecurity stack rearchitecture could completely change the role of security operations centres (SOCs), decision-making workflows, EDR (endpoint detection and response), and network segmentation, and so on.
Agents create an insider-style risk
Another concern is the access granted to AI assistants and other desktop agents. “Agents are an extreme version of an insider attack.” Snehal explained, “They have way too many privileges. They are easily corruptible, and they operate so fast with no audit logs. Nobody knows what will happen.”
People are giving all sorts of access to these things, and there are no audits by design in Claude Cowork, for example, so you have no idea what it did.
Snehal Antani
An attacker could exploit that access; if they gained code execution on a device, they may be able to extract an application’s authentication token from memory and use it to access other systems. For example, a stolen Microsoft Teams token could be used to access the account’s email, shared drives and other systems, via Microsoft Entra. This risk exists even if the user has originally authenticated with multi-factor authentication (MFA).
He also warned that people may grant their AI “co-workers” extensive access without knowing what they did afterward.
“People are giving all sorts of access to these things, and there are no audits by design in Claude Cowork, for example, so you have no idea what it did.”
The broader implication is that organisations need to take a closer look at agents’ permissions, monitor as carefully; if not more; as they do human users – and consider how quickly access can be revoked if a device or credential is compromised.
All these observations by Snehal, point to a broader concern raised in the media briefing. As organisations deploy AI agents, they will need to understand not only what those agents can do, but also how easily they can be misled, and the cybersecurity stack that needs to be redesigned to allow critical controls that doesn’t choke innovation and productivity.
