AI and Cybersecurity in 2035: Scenarios, Signals, and Falsifiable Predictions

Four named scenarios for AI and cybersecurity by 2035 — Defense Parity, Attacker Advantage, Architectural Solution, and Regulatory-Mandated Baseline — each with stated assumptions, named indicators, and a disconfirmation condition.

Every claim in this article is a card on a wall like this one; the argument is only as good as whether the pin actually goes in. — Image prompt and art direction by Brecht Corbeel; generation pending.

Abstract

This article extends AI and cybersecurity to 2035 through four named, falsifiable scenarios. Defense Parity holds that AI-assisted automation lets defenders match AI-assisted attack in the narrow tasks that are automatable, even though the underlying asymmetry never closes. Attacker Advantage holds that the cost imbalance documented today widens under AI. Architectural Solution holds that the containment architecture this series' pilot article identified as the only structurally sound response to prompt injection becomes the deployed default for high-stakes agents, without the model-layer problem itself being solved. Regulatory-Mandated Baseline holds that security requirements now written as voluntary practice become a binding compliance floor. Each scenario states its assumptions, names indicators, and gives a disconfirmation condition, grounded in a documented AI-orchestrated espionage campaign, an AI-crafted zero-day found in the wild, a defensive AI agent that stopped an exploit before attackers could use it, a completed DARPA cyber-reasoning competition, breach-cost data, and EU law with a reporting deadline weeks after this article's publication.

After the gate, the horizon

This series opened with an argument about architecture: a language model reads one undifferentiated stream of tokens, so it has no channel on which to mark part of its input inert, and every mitigation built on that fact is therefore probabilistic rather than structural. That article closed with four dated predictions running to 8 August 2028 — that prompt injection would not be solved at the model layer, that assurance practice would shift from asking what a system filters to asking what its credentials can reach, that the utility cost of provable containment architectures would narrow without reaching zero, and that artefact provenance would become a procurement requirement rather than a courtesy.

This article does not revisit that argument. It takes the trajectory those four predictions describe and asks a larger question: not what one containment architecture can guarantee inside one deployment by 2028, but what the whole contest between AI-assisted attack and AI-assisted defense plausibly looks like by 2035, across economics, tooling, and governance at once. That is not one forecast. It depends on at least four things that do not have to move together: whether automated defense keeps pace with automated attack in the tasks AI actually accelerates, whether the structural cost asymmetry between attacker and defender widens or narrows under AI, whether architectures that separate control from data become the deployed default rather than a research result, and whether security requirements now written as guidance become a binding floor. This article names four scenarios built from those axes, states what each assumes, names indicators a reader can check without waiting for 2035, and states in advance what would prove each one wrong.

Five kinds of statement are kept separate throughout, exactly as elsewhere in this series. A fact is something disclosed in a vendor’s own incident report, a completed competition’s own results, or an enacted regulation’s own text. A vendor or government claim is a body’s statement about its own action or its own product, reported as a claim because the body has a stake in the answer. Analysis works out a consequence of stated facts. A scenario is one internally consistent way the future could go, presented beside its alternatives rather than as the likely one. A prediction commits to a horizon, states its assumptions, names an observable indicator, and states in advance what would disconfirm it. None of the four scenarios below is this article’s forecast, and they are not mutually exclusive by construction: a plausible 2035 has real parity in the narrow, automatable tasks this article calls out under Defense Parity at the same moment it has a widening structural gap of the kind Attacker Advantage describes, because those are claims about different layers of the same contest.

The documented present, mid-2026

The evidence base assembled here is unusually concrete, because the last eighteen months produced a run of firsts: the first disclosed AI-orchestrated attack campaign, the first AI-crafted zero-day found in the wild, and the first AI agent to stop a real exploit before use. Read with a completed government-run competition and hard breach-cost numbers, they ground this article’s scenarios in trend rather than intuition.

On the attack side, Anthropic disclosed on 13 November 2025 that it had disrupted what it assessed with high confidence to be a Chinese state-sponsored espionage campaign, internally designated GTG-1002, that used Claude Code with autonomous agentic orchestration across roughly 30 targets spanning technology companies, financial institutions, chemical manufacturers and government agencies, achieving successful compromise in a small number of cases [1]. The detail that matters here is the division of labour: “Claude performed 80-90% of the operation independently, with a human providing only 4-6 decision points per attack” that spanned “reconnaissance, exploitation, credential harvesting, lateral movement, and data exfiltration” [1]. Anthropic is explicit about a limitation that keeps this from reading as a clean AI success story: Claude “occasionally hallucinated credentials or claimed to have extracted secret information that was in fact publicly-available” [1]. And it states its own defensive reading plainly: “the very abilities that allow Claude to be used in these attacks also make it crucial for cyber defense” [1].

Google’s Threat Intelligence Group reported on 11 May 2026 what it identifies as the first AI-crafted zero-day exploit found in the wild: a Python script bypassing two-factor authentication in a widely used open-source administration tool, exploiting a semantic logic flaw rather than a memory-safety bug, with GTIG inferring AI assistance from the code’s structural signature — abundant educational docstrings, a hallucinated CVSS score, and textbook language-model formatting [2]. The same report catalogues AI-enabled malware observed in the wild by name: PROMPTFLUX, which calls the Gemini API to dynamically rewrite its own source code for evasion; CANFAIL and LONGSTREAM, Russia-linked malware using LLM-generated decoy logic to obscure malicious functionality inside plausible administrative code; and PROMPTSPY, an Android backdoor that calls a Gemini model at runtime to navigate device interfaces and capture biometric authentication gestures [2]. GTIG also documents state-sponsored groups using AI directly for vulnerability research at scale — one China-nexus cluster “sends thousands of repetitive prompts” to recursively analyse CVEs and validate proof-of-concept exploits [2].

On the defense side, the same company supplies the cleanest documented counterexample. Google’s Big Sleep agent, built jointly by Google DeepMind and Project Zero, found and reported a critical SQLite vulnerability, CVE-2025-6965, that threat actors already knew about and had prepared to exploit — Google’s security team states plainly that “we believe this is the first time an AI agent has been used to directly foil efforts to exploit a vulnerability in the wild,” crediting the discovery to a combination of code analysis and separate threat intelligence indicating imminent use [3]. A defensive agent closing a vulnerability that offensive actors were already staging is a different result from an agent merely fuzzing code for unknown bugs: it is a direct race won on the defender’s side.

The clearest large-scale test of automated defense capability concluded in the same window. DARPA’s two-year AI Cyber Challenge finished its final round on 8 August 2025: across 54 million lines of code and 63 challenges, the finalist systems identified 86% of the competition’s synthetic vulnerabilities — up from 37% at the semifinal round a year earlier — and patched 68% of what they found, up from 25%, while also surfacing 18 real, previously unknown vulnerabilities, at an average cost of roughly 152 dollars per task against bug bounties routinely running into the hundreds of thousands [4]. All seven finalist systems were released as open-source software rather than kept proprietary [4]. That detection-to-patching jump inside twelve months is the strongest single piece of evidence here that automated defense, not just automated offense, is compounding quickly.

Whether that compounding closes the gap or merely runs alongside a faster-compounding offense is exactly what the offense-defense literature has not resolved. Andrew Lohn’s 2025 analysis for Georgetown’s CSET finds no predetermined winner: AI could harden defense by automating overwhelmed security teams’ work and imposing cost on attackers, but “several missteps” in deployment “could push the balance toward offense” instead, and the outcome depends on choices made by “system designers, acquisition officials, and users” rather than the technology alone [5]. A more recent paper narrows the claim to a specific population: Murphy and Stone argue AI “will alter the economics of the marginal cyberattack,” exposing organisations that historically survived by being uneconomical targets — under-resourced, running legacy infrastructure — to “more attackers, more frequently,” because AI lets attackers “develop exploits and launch attacks earlier than they can today,” while formal verification stays out of reach for that trailing edge [9]. Both papers agree the balance is not fixed by physics; they disagree about which population of defenders the aggregate trend actually describes.

The most direct measurement of how fast the underlying capability is moving comes from the UK’s AI Security Institute, which tracks a “time horizon” for autonomous cyber tasks against human expert time. Its May 2026 report finds the 80%-reliability time horizon for autonomous cyber tasks had been doubling roughly every 4.7 months since late 2024, down from an 8-month estimate made only three months earlier, with the two most recent models tested exceeding both trend lines by enough that AISI states it is “too early to tell whether the step-change from recent models is representative of a new ongoing pace” [6]. A doubling time that itself keeps shortening, measured by an independent government body, is the strongest available indicator that the underlying capability curve is not decelerating.

Underneath the case studies, the aggregate numbers are now large enough to count rather than anecdote. IBM’s 2026 Cost of a Data Breach Report, covering 602 organisations breached between March 2025 and February 2026, finds one in four malicious breaches were AI-enabled — a 56% increase over the prior year — costing an average of six million dollars against a global average of 4.99 million, and that 21% of breached organisations suffered an incident involving their own AI models, up from 13%, with 92% of those at organisations with no dedicated AI access controls [13]. The report’s other half is the counter-trend: organisations using AI and automation in security operations cut breach costs by nearly two million dollars on average, even though only 18% currently point AI agents at vulnerability management [13]. Verizon’s 2026 Data Breach Investigations Report, covering incidents from November 2024 through October 2025, corroborates the acceleration from the attacker’s side: 15 distinct attack techniques are now routinely bolstered by generative AI, AI is invoked an average of 15 times across a single attack’s stages and as many as 50 in some cases, and AI-assisted text in malicious phishing emails has doubled year over year [14]. These are not two contradictory reports; they are one report’s two halves, showing AI raising both the frequency of attack and the ceiling on defensive automation at once.

On the containment-architecture side this series’ pilot article opened, the trajectory it predicted is visibly under way. CaMeL demonstrated that extracting control and data flow from a trusted query, so untrusted content can never influence program flow, solves a large majority of AgentDojo’s security-relevant tasks with a provable guarantee, at a utility cost of roughly seven percentage points against an undefended baseline [7]. A follow-on paper two months later moves the conversation from demonstration to deployment friction: Tallam and Miller catalogue what the design assumes away — a trusted user prompt, side-channel leakage, the cost of running two models where one ran before — and propose engineering additions (prompt screening, output auditing, tiered-risk access, a verified intermediate language) aimed at making the pattern viable for enterprise deployment [8]. That a second paper exists at all, addressing operational objections rather than re-arguing the security case, is itself evidence the architecture has moved from “does this work” to “how do we ship this.”

Figure 1. Defense Parity: the claim that automated remediation like this closes enough of the gap that AI-assisted defense matches AI-assisted attack in the tasks that are actually automatable. — Image prompt and art direction by Brecht Corbeel; generation pending.

On the regulatory side, the clearest instrument is also the most imminent. The EU’s Cyber Resilience Act, formally Regulation (EU) 2024/2847, was adopted on 23 October 2024 and covers essentially all networked products with digital elements, including AI systems, under a binding, horizontal framework rather than a voluntary code [10]. Its Article 14 reporting obligations — a 24-hour early warning and 72-hour follow-up to ENISA and national response teams for any actively exploited vulnerability or severe incident, with a final report due within 14 days of a fix — become applicable on 11 September 2026, under a month after this article’s own publication; the broader essential cybersecurity requirements, covering secure-by-design obligations and lifetime vulnerability handling, become fully applicable on 11 December 2027 [10]. On 7 July 2026 the European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence, explicitly framed to coordinate rather than replace obligations already running under the AI Act, NIS2, DORA, the Cyber Resilience Act and the Cyber Solidarity Act, proposing an EU model-evaluation capacity, an ENISA access blueprint and a secure testing platform alongside new funding; Commissioner Henna Virkkunen frames it as an effort to “harness and focus existing capabilities, networks and the legal framework” rather than write a new one [11]. That distinction — one instrument binding with a fixed date, the other coordinating without new obligations of its own — is the fault line this article’s fourth scenario turns on. A non-statutory counterpart exists in the United States: NIST’s Center for AI Standards and Innovation runs published, model-specific cybersecurity evaluations — an ExploitBench assessment of exploit-development capability, dated July 2026, among them — through voluntary laboratory participation rather than any binding rule [12].

Four scenarios for 2035

Scenario one: Defense Parity

The claim. By 2035, AI-assisted defensive automation matches AI-assisted offensive automation closely enough, within the specific classes of task that are actually automatable — vulnerability discovery in known code, patch generation and triage, anomaly detection at scale, incident response orchestration — that the practical advantage a well-resourced defender holds today is not eroded by AI and may modestly improve. This is a narrower claim than “AI ends the attacker’s advantage”; the underlying structural asymmetry, that an attacker needs one success against everything a defender must secure, is not assumed to close.

Why this is plausible rather than hopeful. The strongest single data point is the AI Cyber Challenge’s own trajectory: automated vulnerability detection rose from 37% to 86% and patching from 25% to 68% across one year, on real and synthetic code alike, with all winning systems released openly [4]. Big Sleep’s interception of CVE-2025-6965 shows the same pattern operating outside a competition, against a live adversary [3]. And IBM’s finding that organisations already using AI and automation in security operations cut breach costs by close to two million dollars on average shows the advantage is not confined to elite research teams; it shows up in a 602-organisation sample [13]. CSET’s Lohn frames this as a live possibility rather than an inevitability: defenders’ ability to “impose delays and friction” on attackers could yield them greater benefit from AI than attackers receive, provided deployment choices are made well [5].

Figure 2. Attacker Advantage: the same instrument, read the other way — if each new token keeps landing lighter on the defender's pan than the attacker's, the asymmetry this series has already documented widens rather than closes. — Image prompt and art direction by Brecht Corbeel; generation pending.

Assumptions. This scenario assumes the tasks DARPA’s competition and Big Sleep demonstrate — vulnerability discovery and patching in code AI can read completely, detection against known patterns — stay representative of where most exploitable risk concentrates through 2035, rather than risk shifting toward attack classes (social engineering, supply-chain trust abuse, novel logic flaws like the 2FA bypass GTIG documented) that automated tooling handles less well. It also assumes the 18% adoption rate IBM measures for AI-driven vulnerability management climbs substantially rather than plateauing, since a capability confined to pilot deployments closes no practical gap.

Indicators. Continued year-over-year improvement in cyber-reasoning-system detection and patch rates on benchmarks comparable to AIxCC’s; a rising, not flat, share of organisations reporting AI-driven vulnerability management in surveys comparable to IBM’s; further documented cases of a defensive AI agent closing a vulnerability before recorded attacker use, beyond Big Sleep; the AI-related breach-cost gap between AI-and-automation adopters and non-adopters widening in adopters’ favour across successive studies.

Horizon and disconfirmation. Horizon: end of 2032. Disconfirmed if the AI-enabled share of malicious breaches keeps rising at anything like its current 56%-per-year pace while the cost gap between organisations using AI for defense and those not using it fails to widen, or if no independently verified case of AI-driven vulnerability discovery outpacing attacker use is reported after the Big Sleep precedent.

Scenario two: Attacker Advantage

The claim. By 2035, the structural cost asymmetry between attacker and defender — one success needed against a surface that must be defended everywhere — has widened under AI rather than narrowed, particularly for the “trailing-edge” population of under-resourced and legacy-dependent organisations that historically survived by being uneconomical targets. Aggregate advantage does not require every defender to fall behind; it requires the marginal, previously-uneconomical attack to become newly economical at a rate defense investment does not match.

Why this is plausible against the same evidence. GTG-1002 is direct evidence the ceiling on attacker automation is not theoretical: a single operator directed an AI system through 80-90% of a multi-target espionage campaign, with human input reduced to a handful of decision points per target [1]. GTIG’s catalogue of AI-generated malware in active use — self-rewriting code via PROMPTFLUX, LLM-authored decoy logic in CANFAIL and LONGSTREAM, an Android backdoor that calls a live model at runtime — shows offensive AI already diversified across techniques rather than concentrated in one demonstration [2]. Murphy and Stone’s argument is that this uplift does not land evenly: AI lets attackers “develop exploits and launch attacks earlier than they can today,” which primarily threatens organisations that could not previously justify the cost of finding them, while formal verification stays out of reach for that population [9]. IBM’s numbers give the asymmetry a price: AI-enabled breaches cost a million dollars more on average than the global mean, and prompt injection and model inversion carry the highest average costs IBM measures [13]. Verizon’s finding that AI is invoked as many as 50 times across a single attack’s lifecycle, and that AI-assisted phishing text has doubled year over year, is evidence of scale rather than one dramatic case [14]. And AISI’s own trend — a doubling time compressing from eight months to under five within three months of observation — is the base-rate argument: if capability compounds at a shortening doubling time, defenders relying on processes that do not compound at all fall further behind by construction [6].

Assumptions. This scenario assumes the trailing-edge population Murphy and Stone identify stays large relative to organisations able to afford frontier defensive AI, rather than defensive tooling becoming cheap enough to reach small and mid-sized organisations at the same pace as large enterprises. It also assumes capability doubling times continue compressing, or at least do not lengthen, and that no discontinuity as decisive on the defense side as GTG-1002 was on offense arrives to reset the comparison.

Indicators. Continued year-over-year growth in the AI-enabled share of malicious breaches and their average cost premium; capability doubling times in benchmarks like AISI’s holding under six months rather than lengthening back toward historical rates; a widening, not narrowing, gap between large-enterprise and small/mid-sized-organisation adoption of AI-driven defensive tooling; additional disclosed campaigns following GTG-1002’s pattern of high autonomy and low human decision-point count.

Horizon and disconfirmation. Horizon: end of 2031. Disconfirmed if the AI-enabled breach cost premium IBM measures narrows or disappears over two consecutive annual reports, or if AI-driven defensive tooling adoption among small and mid-sized organisations converges with large-enterprise adoption rather than diverging from it.

Scenario three: Architectural Solution

The claim. By 2035, the system-level containment architecture this series’ pilot article identified as the only structurally sound response to prompt injection — extracting control flow from untrusted content so that content can influence what is said but never what is done — has become the deployed default for agents given consequential authority, not a research demonstration running alongside conventional, undefended deployments. This is explicitly not a claim that the model layer’s underlying problem gets solved; it is the pilot article’s own third prediction, that the utility tax of provable containment narrows without reaching zero, tested here at a longer horizon and a higher bar: does the pattern become normal practice rather than merely available.

Why this is plausible rather than merely hoped for. The sequence of publication is itself evidence of momentum: CaMeL demonstrated the core security property with a measured utility cost against a shared benchmark in March 2025 [7], and by that May a second paper existed whose entire purpose was closing the gap between that demonstration and something an enterprise could run — addressing the trusted-prompt assumption, side-channel leakage, and the doubled inference cost of the dual-model design, with named engineering countermeasures [8]. A field moves from “here is a proof” to “here is how you operationalise it” only when there is a plausible buyer on the other end. The broader defensive-automation trend documented above — DARPA’s systems releasing all their code openly, Big Sleep operating as a standing capability rather than a one-off demonstration — shows the surrounding ecosystem already treats AI-native security tooling as production infrastructure, the same adoption pattern this scenario requires of containment architectures specifically [4, 3].

Figure 3. Architectural Solution: not a claim that the model learns to tell data from instructions, but that a system built this way — one narrow, certified channel between what plans and what only reads — becomes the default rather than a research demonstration. — Image prompt and art direction by Brecht Corbeel; generation pending.

Assumptions. This scenario assumes the roughly seven-point utility tax CaMeL reported keeps narrowing as Tallam and Miller’s proposed countermeasures mature, rather than the dual-model performance cost proving a hard floor most product teams decline to pay. It also assumes high-stakes, high-authority agent deployments — the ones where a confused-deputy failure is expensive enough to justify the tax — grow large enough relative to low-stakes deployments that adoption is driven by genuine risk economics rather than staying confined to a handful of security-conscious labs.

Indicators. Published successors to CaMeL reporting a narrowing utility gap against undefended baselines on AgentDojo-class benchmarks, the pilot article’s own indicator for this trend; vendor documentation describing control/data-flow separation as standard for agents with financial, infrastructure or credential-issuing authority rather than optional hardening; a rising count of independent implementations built on the capability-based sandboxing pattern beyond the original Google Research codebase.

Horizon and disconfirmation. Horizon: end of 2033, one horizon-length beyond the pilot article’s own 2028 checkpoint for the same trend. Disconfirmed if undefended, model-mediated tool execution remains the default architecture for high-authority commercial agents at that date, or if no successor to CaMeL reports a narrower utility gap than the original seven-point figure on a comparable benchmark.

Scenario four: Regulatory-Mandated Baseline

The claim. By 2035, cybersecurity requirements for AI systems — secure-by-design engineering, mandatory vulnerability disclosure, incident reporting on fixed timelines — have moved from voluntary best practice, the state this series’ pilot article documented for essentially every mitigation it examined, to a binding compliance floor enforced through instruments with real penalties, comparable to how product safety and financial reporting already work.

Why this is plausible rather than aspirational. The clearest evidence is that the binding instrument already exists and its clock is already running. The Cyber Resilience Act is not a proposal or a voluntary code; it is an adopted regulation whose Article 14 reporting obligations become legally applicable on 11 September 2026, with mandatory 24-hour, 72-hour and 14-day disclosure windows to ENISA and national response teams, and whose full essential-cybersecurity-requirements regime becomes applicable on 11 December 2027 [10]. It applies horizontally to products with digital elements, and its recitals extend explicitly to AI-specific risks referenced through the AI Act rather than treating AI as exempt [10]. The July 2026 Action Plan on Cybersecurity and AI shows the coordination layer above individual statutes is also active, aligning the Cyber Resilience Act with NIS2, DORA, the AI Act and the Cyber Solidarity Act into what the Commission frames as one coherent regime rather than five separate burdens [11]. And the voluntary counterpart shows the same direction of travel without binding force: NIST’s CAISI now runs and publishes model-specific cybersecurity evaluations — an ExploitBench assessment of exploit-development capability, dated July 2026 — through voluntary laboratory cooperation, the kind of standardised evaluation infrastructure a future binding requirement would need to reference rather than invent [12].

Figure 4. Regulatory-Mandated Baseline: the claim that a floor like this one stops being something only careful vendors choose and becomes something every vendor has to clear. — Image prompt and art direction by Brecht Corbeel; generation pending.

Assumptions. This scenario assumes the Cyber Resilience Act’s own compliance calendar holds without the kind of deferral this series’ companion article on AI governance already documented for the EU AI Act’s high-risk provisions — a comparable postponement of the CRA’s own deadlines would itself be evidence against this scenario, not a neutral delay. It also assumes at least one other major jurisdiction adopts a broadly comparable binding floor rather than the EU remaining the sole binding regime while others rely on voluntary infrastructure like CAISI’s indefinitely, and that enforcement resources scale with the reporting volume Article 14 will generate.

Indicators. The Cyber Resilience Act’s reporting and full-application deadlines holding as scheduled, or slipping only by narrow, well-justified margins rather than the multi-year deferral pattern seen elsewhere in AI-adjacent EU law; a second major jurisdiction adopting binding, not voluntary, cybersecurity requirements with comparable reporting timelines; CAISI’s evaluations or a comparable body’s work being formally incorporated into any binding requirement rather than remaining standalone; a measurable rise in reports actually filed under Article 14 once it takes effect.

Horizon and disconfirmation. Horizon: end of 2030. Disconfirmed if the Cyber Resilience Act’s essential-requirements deadline is deferred past 2029 the way the EU AI Act’s high-risk deadline was deferred, or if no second major jurisdiction has adopted a binding cybersecurity floor for AI systems comparable in scope to the CRA by the horizon date.

What the four scenarios share, and where they coexist

Figure 5. By 2035 these four rooms may not resolve into one; the honest picture is several still open for business down the same corridor at once. — Image prompt and art direction by Brecht Corbeel; generation pending.

None of these four scenarios excludes the others; they are claims about different layers of the same contest rather than four exclusive endings. A plausible 2035 has genuine parity in the narrow, code-legible tasks DARPA’s competition and Big Sleep represent — Scenario One’s territory — at the very moment the aggregate cost asymmetry keeps widening for the trailing-edge organisations Murphy and Stone describe, because those two claims measure different populations of defenders against different classes of attack. It is equally coherent for the architectural pattern this series’ pilot article backed to become the unremarkable default for high-authority agents — Scenario Three, really that pilot’s third prediction carried one horizon further — while the regulatory floor in Scenario Four stays a European phenomenon other major markets never fully match, producing a world where the best-engineered systems are both provably contained and under a binding disclosure regime, while a long tail of lower-stakes deployments run undefended agents under no comparable law at all.

What ties all four together is the discipline the pilot article insisted on: separating what a probabilistic mitigation achieves from what a structural one guarantees, and being honest that most of what is deployed today is the former. Scenarios One and Two are both, underneath their opposite conclusions, claims about how fast two probabilistic capabilities compound against each other, and neither requires the architecture problem to be solved to be true. Scenario Three is the one claim here that is structural rather than probabilistic by construction, which is why its bar is adoption rather than mere existence: a provably contained architecture shipping in one product line changes nothing for agents still running undefended everywhere else. Scenario Four asks whether anything external forces that adoption question rather than leaving it to risk appetite — the same question the pilot article’s fourth prediction asked about provenance, now asked of security engineering as a whole.

What to take away

None of these four scenarios is a forecast this article is making. Each is a self-contained, falsifiable claim, built so a reader checking back over the next several years has something concrete to look for: a detection-and-patch rate on an independently run benchmark, a cost premium in an annual breach report, a utility-gap figure in a published successor to CaMeL, a reporting deadline that either holds or slips.

The nearest of those checks is not years away. The Cyber Resilience Act’s Article 14 reporting obligation becomes legally applicable on 11 September 2026 — inside a month of this article’s own publication. Whether that deadline produces a rising count of filed reports or a quiet, unenforced formality is one of Scenario Four’s own indicators, checkable within the year rather than by 2035. That is the standard this series has held throughout: not a narrative about where AI and cybersecurity are heading, but claims specific enough that the evidence which would break them is already being generated, on a schedule, by institutions with no stake in this article being right.

Sources

1. Anthropic Threat Intelligence. Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign. Anthropic (2025).
2. Google Threat Intelligence Group. Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access. Google Cloud (2026).
3. Google Cloud Security. Cloud CISO Perspectives: Our Big Sleep Agent Makes a Big Leap. Google Cloud (2025).
4. Defense Advanced Research Projects Agency. AI Cyber Challenge Marks Pivotal Inflection Point for Cyber Defense. DARPA (2025).
5. Andrew Lohn. Anticipating AI's Impact on the Cyber Offense-Defense Balance. Center for Security and Emerging Technology, Georgetown University (2025).
6. UK AI Security Institute. How Fast Is Autonomous AI Cyber Capability Advancing?. AI Security Institute (AISI) (2026).
7. Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. Defeating Prompt Injections by Design. arXiv (2025). DOI: 10.48550/arXiv.2503.18813.
8. Krti Tallam and Emma Miller. Operationalizing CaMeL: Strengthening LLM Defenses for Enterprise Deployment. arXiv (2025). DOI: 10.48550/arXiv.2505.22852.
9. Benjamin Murphy and Twm Stone. Uplifted Attackers, Human Defenders: The Cyber Offense-Defense Balance for Trailing-Edge Organizations. arXiv (2025). DOI: 10.48550/arXiv.2508.15808.
10. European Parliament and Council of the European Union. Regulation (EU) 2024/2847 on Horizontal Cybersecurity Requirements for Products with Digital Elements (Cyber Resilience Act). Official Journal of the European Union (EUR-Lex) (2024).
11. European Commission. EU Action Plan on Cybersecurity and Artificial Intelligence. European Commission (2026).
12. National Institute of Standards and Technology. Center for AI Standards and Innovation (CAISI). NIST (2026).
13. IBM Security and Ponemon Institute. IBM Study: One in Four Malicious Breaches Are AI-Enabled, Costing Companies Six Million Dollars on Average. IBM Newsroom (2026).
14. Verizon Business. 2026 Data Breach Investigations Report. Verizon (2026).

Originally published at https://absolutedigitalpublishers.com/articles/ai-and-cybersecurity-in-2035-scenarios-signals-and-falsifiable-predictions.