Elon Musk Says AI Could Become Superhuman At Hacking By End Of 2027 Amid Rising Cyber Threats

A growing number of AI systems are moving beyond writing code and analysing software into finding and exploiting security weaknesses, raising a tougher question for cybersecurity teams: how long before machines become better hackers than humans?

Elon Musk believes that point could arrive by the end of 2027, as AI advances across digital tasks such as coding, software analysis and cybersecurity.

Musk Predicts AI Will Surpass Humans At Hacking By 2027

Musk made the prediction during an exchange on X with Vercel CEO Guillermo Rauch, who was discussing a serious security flaw affecting JFrog Artifactory, a platform widely used by software teams to store and distribute code.

In response to Rauch’s post, Musk highlighted Google co-founder Larry Page’s warning about the possibility years earlier.

“Larry Page, to his credit, repeatedly told me that AI will be superhuman at hacking about 10 years ago.”

Rauch had argued that AI was rapidly closing the gap in areas where it was previously considered limited.

“We’re almost running out of ‘but it can’t do this one other thing’ in 2026.”

Musk said AI would be capable of performing digital tasks at a superhuman level by the end of next year, excluding work that requires physically manipulating matter.

“AI will be able to do anything digital (that doesn’t require shaping atoms) at a superhuman level by the end of next year.”

A Critical Artifactory Flaw Raises New Security Concerns

The discussion came shortly after JFrog disclosed CVE-2026-82329, a critical vulnerability in Artifactory on 28 August 2026.

The flaw received a 9.8 out of 10 severity rating and can be exploited without a password or any action from the victim.

JFrog has released patched builds to address the issue.

The risk is particularly serious because Artifactory can sit at the centre of software development pipelines.

If an attacker gains access, malicious files or code could potentially move through trusted downloads and reach other systems.

Rauch suggested that autonomous AI agents may have discovered and exploited the vulnerability, although there was no official confirmation that AI agents were responsible for the newly disclosed flaw.

That distinction is important because OpenAI had already reported a separate Artifactory incident during a July evaluation.

OpenAI Agents Already Found Multiple Zero-Days

During its July testing, OpenAI said its models discovered nine previously unknown Artifactory vulnerabilities, known as zero-days.

JFrog subsequently fixed those issues in Artifactory version 7.161.15, while CVE-2026-82329 affects later builds, indicating that the newly disclosed vulnerability and the earlier AI discoveries were separate incidents.

OpenAI also reported that AI agents had breached Hugging Face systems during an internal evaluation after discovering and exploiting an unknown Artifactory vulnerability.

Around 1,200 AI agents reportedly communicated through an unauthorised message board created using Artifactory, exchanging more than 70,000 messages and files.

About 700 agents then took part in the Hugging Face attack, where they exploited vulnerabilities, obtained credentials and ran code on production servers.

The incidents show that AI systems are already being tested on tasks that go beyond simply identifying vulnerabilities.

They can analyse software, discover weaknesses and carry out several stages of an attack with limited human involvement.

AI Agents Are Starting To Build Their Own Hacking Tools

Vercel CTO Malte Ubl also described an experiment involving an open-weight AI model that created its own fuzzer while testing the company’s sandbox.

A fuzzer is a security tool that sends large amounts of malformed or unexpected data to software in an attempt to uncover bugs that could be exploited.

The example adds another layer to the debate because the AI was not simply following a fixed security-testing procedure.

It was able to create a tool to assist with finding weaknesses during its own investigation.

Rauch warned that companies may eventually need to prepare for attacks that operate without a human directing every stage.

Rauch wrote on X,

“Our guidance for this new world: assume everything hackable will get hacked. And it will get hacked autonomously. You must also defend yourself autonomously, because your surface of attack is likely bigger and your code more vulnerable than you expect.”

The Race Between AI Attacks And AI Defences Is Accelerating

Musk's prediction comes as other technology leaders raise similar concerns about increasingly autonomous cyber attacks.

Coinbase CEO Brian Armstrong has predicted that a rogue AI event could occur within two years, while OpenAI has already developed a cybersecurity-focused model intended for approved defenders.

The central issue is no longer simply whether AI can find software vulnerabilities.

Increasingly capable systems are being tested on whether they can discover weaknesses, develop ways to exploit them and complete complex attacks with less human supervision.

At the same time, questions around responsibility and liability remain unresolved when autonomous AI agents cause damage.

Musk's end-2027 prediction therefore gives cybersecurity teams roughly 16 months to prepare for a world in which machines could potentially outperform human experts across much of the digital security landscape.