Anthropic's 17-victim case anchors a pentest CEO's argument for retiring the annual pentest

The load-bearing evidence in Seemant Sehgal's column is two incidents. In August 2025 Anthropic documented an operator who used an AI coding agent against at least 17 organizations, with the model handling reconnaissance through to setting ransom prices from the stolen financial data ^[1]. The other is a group called FulcrumSec, which used AI to read what it had already taken so it could negotiate from a position of knowledge ^[2]. Sehgal says he spent more than two decades on the offensive side of security, first in the CISO's office at one of Europe's largest banks. The past eight years he has spent building offensive security products ^[9]. He is also founder and CEO of BreachLock, which sells continuous attack surface discovery and penetration testing as a service ^[8]. The remedy his column recommends is continuous validation of exploitable attack paths in place of an annual pentest ^[11].

That overlap does not make the argument wrong, but it sets the standard of proof for the parts a buyer cannot check. The claim doing the most work is that the time for an attacker to find the one gap nobody closed and exploit it has gone from days to minutes ^[7]. Sehgal offers no measurement behind it, and the column puts no price on the tooling used in either case ^[2].

What is in the record is a narrower and more usable claim. Sehgal is explicit that vibe hacking, the label the industry has settled on ^[3], has not introduced a new category of vulnerability. The controls that would have stopped these campaigns a year ago are most likely still doing their job, he writes ^[6]. "The complexity of the attacks has stayed relatively stable, but the expertise required to launch one has dwindled," he wrote ^[4]. A test run once a year samples the environment once every 8,760 hours ^[1].

Seventeen victims in one vendor's report is not a population, and a company selling continuous testing has an obvious reason to describe annual testing as spent. Both objections are fair. Neither touches the part of the argument that rests on the defender's own books: most enterprise security programs already have more findings than they can remediate, and discovery was never the bottleneck ^[12]. Ordering that backlog by what an attacker can actually chain pays off whether or not the attacker has an agent.

Where the mechanism gets specific, it concerns adaptability. A model can rewrite a phishing lure once the first attempt is flagged, adjust an extortion negotiation according to how the victim responds, and generate enough payload variation that blocklists and signature matching struggle to keep pace ^[10]. Earlier waves of tooling, from exploit kits to phishing-as-a-service to ransomware affiliate programs, were static templates that still needed skill to use ^[15]. The training consequence Sehgal draws is that lures now read as grammatically clean and contextually relevant, so awareness programs have to move to out-of-band confirmation for sensitive requests ^[13].

The third recommendation carries the least evidence and the longest tail. Organizations rolling out AI agents and assistants internally are creating a layer of attack surface most security programs have not fully accounted for. Sehgal writes that vibe hacking increasingly involves manipulating the AI tools a defender has deployed ^[14]. He names that exposure. He does not describe how the manipulation works.