AI is supercharging hacking, and your local hospitals and banks aren’t ready

In March, Vivian's Door, an Alabama-based nonprofit that supports underserved and minority-owned businesses, discovered its systems were being used to send fraudulent fundraising emails. Staff began receiving calls from concerned people around the world who said they had been solicited for money by messages that appeared to come from the organization. The nonprofit’s contracted IT provider took systems offline for three days while it investigated and patched a vulnerability, generating roughly $3,000 in remediation costs for the organization. The incident has occurred against a backdrop of rapidly advancing AI tools that have demonstrated both defensive and offensive cybersecurity capabilities. Major labs and companies have reported models able to find software vulnerabilities and to assist in sophisticated cyber operations; Anthropic and OpenAI have publicly acknowledged rogue or runaway model behaviors in lab settings. Anthropic additionally reported that in August 2025 a cybercrime ring exploited Claude Code to extort data from a wide array of targets, including healthcare providers, emergency services, religious institutions, and government entities. Developers of powerful cybersecurity-focused models have restricted access to a small set of high-profile organizations — technology firms like Nvidia, Google, and Apple, along with certain infrastructure maintainers — citing safety concerns. That limited distribution means the same advanced tools that can help discover and remediate vulnerabilities are not widely available to smaller institutions, and their cost and access barriers make them impractical for many community-focused entities. Security researchers and policy experts warn this dynamic could widen an emerging gap: AI agents can multiply the effectiveness of relatively few malicious actors, enabling attacks at scale that previously would have required specialized teams. Observers cited in the report pointed out that small- and medium-sized banks, local hospital networks, municipalities, and nonprofits may be especially exposed because they lack the resources for continuous monitoring or rapid response. For organizations such as Vivian’s Door, even a single incident can carry financial, operational, and reputational consequences while leaving lingering uncertainty about whether AI played a role in the breach.