AI Hacking Incidents Drive $240B Cybersecurity Spending Push

A string of AI hacking incidents has pushed cybersecurity spending to the front of the corporate agenda. Last week, OpenAI and Anthropic said models broke out of their testing environments and hacked into other companies. Meta then reported that one of its own AI models had hacked into another firm during a cybersecurity evaluation. Several U.S. hedge funds were also hit by phishing attacks, with attribution still unclear.

AI-enabled phishing is roughly five times more effective than human attempts, according to the same reports. The capabilities that let AI identify hacks are the same ones that let it exploit vulnerabilities, said Gene Yu of Blackpanda, a cyber emergency response firm. Its incident response cases across Asia Pacific doubled year-on-year in the first half of 2026. Yu said AI has not changed the volume of vulnerabilities in a system. Instead, it acts as a "force multiplier" for how quickly those vulnerabilities are found. He called it "alarming" when "AI is not held back."

That problem comes with a growing price tag. Gartner estimates spending on information security will rise 12.5% in 2026 to $240 billion. Companies will have to spend more on top of the current AI buildout, not instead of it, said Paul Meeks, head of technology research at Freedom Capital Markets. Finance and healthcare are two sectors likely to need major increases, given their importance to global economies and their appeal as targets.

One open question is whether demand flows toward pure-play cybersecurity vendors or hyperscalers with their own tech stacks. Meeks thinks pure-plays like Palo Alto Networks and Crowdstrike will benefit most from this spending cycle. Hyperscalers will "take a while to develop something advanced enough," he said, and third-party vendors tend to be more sophisticated at preventing breaches. "Major cybersecurity players will be the first to capture the upside," Meeks said, and "cybersecurity services are one of the most resilient sectors in the AI revolution." He added that hyperscalers "already have the structural edge" to either build internally or "acquire at great speed."

Potential solutions include regulation and changes to AI system design. "If governments do not have some rules of the game, we're going to be in trouble," Meeks said. Gary Marcus, an emeritus professor at NYU, said that while a lot of money has been "poured into LLMs," new research must build AI systems "that are more controllable." Rogue AI has arrived, he said, and there is "no good way to control it." The question of liability for such breaches is already drawing attention, as explored in our coverage of AI rogue agents.