Fearmongering has always been part of the security landscape. Plenty of vendors lean into hypothetical "what if?" scenarios to sell their tooling, and plenty of orgs give into these explanations and buy said tooling.
Naturally, this fearmongering is kept very broad. "It's not a matter of if you get hacked, but when" is a broad statement you'll hear quite often. This completely ignores organisations' actual threat level and exposure, but in my experience the orgs likely to buy based off of broad statements like this lack the internal knowledge to evaluate their threat level; alternatively, leadership isn't listening to people on the ground who have already done this work.
Now, we have two new contenders in the fearmongering arena: OpenAI and Anthropic. The latter kicked off the race proper a few months ago with the release of Mythos, which was supposedly so good, it's the end of cybersecurity as we know it. Similarly, there's an increase of stories where AI either autonomously hacked into other companies (eg HuggingFace) or autonomously found vulnerabilities infecting millions of systems (eg PHP2Shell).
Most of these stories are exaggerated, however. In the case of PHP2Shell, a researcher used GPT 5.6 Sol to assist in vulnerability hunting, which OpenAI spun as "completely autonomous agents" doing all the work. Similarly, in the HuggingFace incident, Anthropic simply failed to implement basic safeguards you'd expect of a company of this stature.
Nevertheless, the impact these kind of incidents have had on reporting is undeniable. We're seeing a lot more mainstream coverage of security incidents, which is great, but most coverage leans heavily into the "autonomous agents are finding vulnerablities" angle. This, in turn, is used to proclaim "you should buy AI so you don't fall behind!", as if buying AI is the only thing that needs to be done.
We're not really using this moment to evaluate how AI can help us implement internal processes to increase the quality of written software (and, hopefully, reduce the amount of vulnerabilities in the process). It's undoubtedly a big boost to both engineers and security teams, but just like buying a single endpoint security tool will not prevent phishing, simply spending a bunch of money on tokens will not magically improve companies' security posture.