On July 22, 2026, MIT Technology Review reported that OpenAI had developed an AI system capable of conducting cyberattacks completely autonomously: it finds vulnerabilities, exploits them, and moves laterally across networks. No human at the wheel. The test exceeded all expectations. This is no longer science fiction — it's a tool that exists and doesn't require a military lab to obtain.
For European businesses — especially SMEs — this is not a curiosity: it's a paradigm shift. We see every day companies with unprotected forms, plain-text credentials, and backup configurations that have never been tested. With an AI hacker, the scale of damage becomes industrial. A single flaw can be discovered and exploited in seconds across thousands of sites simultaneously. The average cost of an attack for an SME in Europe already exceeds €150,000 including ransom, downtime, and loss of trust. With automation, that number will rise.
Sponsored Protocol
This is not just a tech issue — it's a political one. The EU AI Act still focuses on transparency and systemic risks, but an autonomous offensive agent slips through existing categories. Italy, with one of the lowest cybersecurity investment rates in the G7, risks becoming a testing ground for these new tools. Waiting for regulation is not an option: by the time rules arrive, the damage will be done.
At Meteora Web, our position is clear: AI amplifies, it doesn't replace. But what it amplifies depends on who controls it.
We at Meteora Web have been working since 2017 with companies that often discover security only after an attack. We come from accounting, ERP management, and code. We know the cost of an undone backup or an outdated plugin. This OpenAI announcement tells us that defense must become equally autonomous: AI-driven monitoring, automatic patching, continuous penetration testing. But awareness is also needed: 90% of Italian SMEs have no internal IT manager. With an autonomous hacker out there, the digital divide becomes a vulnerability chasm.
Sponsored Protocol
Our stance is firm: no more delays. Security is not a cost — it's an investment to stay in the game. Anyone selling “beautiful websites” without talking about protection is doing a disservice.
If you are reading this — developer, entrepreneur, SME owner — take one concrete step today: run a security audit. Not next month. Check SSL certificates, updates, backups, two-factor authentication. If you lack the skills, find a partner who has them. And if you are a policymaker: close the regulatory gap on autonomous AI agents before code writes the rules.
