Healthcare ransomware attacks up 6x since 2018 as AI agents close the patch gap, a16z says

luisdans · x · 2026-11-07

a16z's Asaf Ezra and Steph Zhang argue in "The Exploit Was the Bottleneck" that AI has collapsed the offensive-cyber time gap:

Confirmed ransomware attacks on healthcare providers grew from 37 in 2018 to 437 in 2024 (6x); the first nine months of 2026 already matched all of 2025, with Q3's 192 the highest quarter on record. Average US downtime per attack rose from 4 days (2018) to 18 days (2024).
In late August, a single operator pointed a few hundred AI agents at a print-management server: they built a test lab, wrote exploits for two bugs disclosed 4 days earlier, and went from empty workspace to first real break-in in under 4 hours. 395 organizations in 48 countries were compromised, half of them schools — using a cheap open-weight model, not a frontier one.
In the PHP leak case, exploits hit Amazon's decoy servers 4 days before disclosure and 12 hours before the fix, with working shells within 3 days. Amazon's CISO says the 7/30-day patch SLA assumes a delay that no longer exists.
The authors' conclusion: the bottleneck has shifted from exploit-writing expertise to patch-response speed, and traditional patching cadences are obsolete.

More from AGI Musings