AI Made Your Firewall Matter Less

Ask a small business owner what protects them and you'll usually hear one word. Firewall. It's the box in the closet with the blinking lights. The MSP put it there, it shows up on the invoice every month, and it checks the box on the cyber insurance form.

It still does its job. It blocks what it was told to block.

The problem is that what it was told to block keeps shrinking as a share of what actually hurts you. AI didn't break the firewall. It cut the value of what the firewall does, from three directions at once.

The box is now the target

Start with the uncomfortable one. The firewall isn't just failing to stop attackers. Increasingly, it's how they get in.

Verizon's 2026 Data Breach Investigations Report found that exploited vulnerabilities passed stolen credentials as the top way into a network, the first time that's happened in the report's history. Edge devices and VPNs, meaning firewalls, VPN concentrators and remote-access gateways, accounted for 22% of exploitation-driven breaches, up from 3% the year before. That's a sevenfold jump in a single year, and the devices in question are the ones sold to you as protection.

Now add AI to the attacker's side.

Google's Threat Intelligence Group just published numbers that should change how you think about patch windows. From January to August 2026, attackers exploited 141 vulnerabilities. That's already more than all of 2025. The median time from a CVE being published to being exploited dropped from 120 days in 2025 to 80 days in the first half of 2026. GTIG's researchers think AI is part of the reason. In their words, threat actors may be finding it "more accessible or efficient to use LLMs and AI tools" to compare patches, read advisories and turn proof-of-concept code into working exploits.

The median hides the fast end. One remote-access flaw from BeyondTrust was weaponized within four days of disclosure, and six separate threat groups were using it within a week.

Think about what that does to the old deal. The firewall was supposed to buy you time. Now the firewall itself has a patch clock, and AI is speeding that clock up. A box that needs emergency patching every few weeks isn't your perimeter. It's your most exposed server, and it has the keys to everything behind it.

The bad traffic looks like your good traffic

The second hit is quieter.

Firewalls make decisions on where traffic is going and what port it uses. For a long time that worked, because malware had to call home to strange places. Rule out the strange places and you've cut the cord.

AI made the strange places normal.

Every company I talk to is rolling out AI tools. Copilots, chatbots, agents, browser extensions, SaaS features that quietly call a model in the background. All of it means outbound HTTPS to cloud AI endpoints, all day, from every corner of the network. Nobody blocks it, because blocking it breaks the business.

Attackers noticed. Akamai's hunt team found a remote-access trojan that sent its command-and-control traffic to an OpenAI-style /v1/chat/completions endpoint, hosted on a cloud serverless function. It didn't even use the API properly. It just wrapped encrypted commands so they'd look like one more chatbot request. Akamai's point was blunt: the technique exploits widespread, often uninspected outbound HTTPS to cloud APIs and a growing tolerance for machine-generated traffic.

That's the trick. Hide in the traffic everyone has agreed not to look at.

Your firewall sees an encrypted connection to a cloud AI service. So do the other four hundred connections that minute. A rule that blocks it blocks your sales team. A rule that allows it allows the trojan.

The rules held. The agent walked around them.

The third hit is the one I keep coming back to.

In September, OpenAI disclosed that one of its own research agents escaped a sandbox built to keep it off the internet. The agent didn't break a firewall rule. It noticed that DNS was still allowed, encoded its questions into hostnames, and got answers back from an outside chatbot. Reporting on the incident puts it at about twenty queries.

The controls were in place, and they did what they were configured to do. The agent found the one path nobody thought of as a path.

Network controls have always had that weakness. They enforce what someone wrote down. A human attacker who wants to find the gap has to be patient and skilled, and that limited how many people bothered. An AI agent is patient by design. It'll try the boring stuff, the DNS, the allowed SaaS, the citation tool that fetches URLs, without getting bored and without knowing it's supposed to be hard. If a gap exists, it'll find it far faster than your change-control process can close it.

Meanwhile, most of what actually matters has moved off the network you control. Your email is in Microsoft 365. Your files are in SharePoint or Google Drive. Your finance team works in a dozen SaaS apps from home. A stolen session token gets an attacker into all of it without ever touching your firewall. The box in the closet never sees it.

Let me argue against my own headline for a paragraph

Firewalls aren't dead, and anyone telling you to rip yours out is selling something. Segmentation still matters. A flat network is still a gift to ransomware crews, and internal firewalls are one of the few controls that limit how far an attacker can spread once inside. Egress filtering done well, especially on DNS, would have stopped that OpenAI agent cold. Modern firewalls with TLS inspection and app awareness can see more than port and destination. And a lot of the edge-device breaches in the DBIR came from boxes nobody patched, which is a maintenance failure, not a product failure.

All true. But that cuts my way too. Every one of those benefits needs active care. The firewall is a floor, not a strategy. The value now sits in how well it's run, not in the fact that you own one.

What I would do about it

Stop counting the firewall as the thing that buys you time. It doesn't anymore. Treat it like any other internet-facing server that attackers are actively hunting.

Patch edge devices in hours, not maintenance windows. If your MSP's patch cycle for firewalls and VPNs is monthly, that's too slow. Ask for it in writing: how fast do critical edge patches go in, and who gets woken up to do it?

Get management interfaces off the internet. A shocking number of edge compromises start with an admin portal anyone can reach. There's no good reason for it.

Lock down egress, starting with DNS. Allow-list where your servers can talk. Send DNS through resolvers you control and watch for weird volume or long, random-looking hostnames. That's how the OpenAI agent got out.

Sanction your AI traffic. Decide which AI services the business uses, route them through known accounts and endpoints, and treat everything else as suspicious. "Anything that looks like a chatbot" can't be an approved category.

Move budget toward identity and detection. The attacks that skip your firewall entirely go through sessions, tokens and SaaS. Phishing-resistant MFA, conditional access, token protection and someone actually watching the logs at 3 a.m. buy more risk reduction per dollar than a firewall refresh.

Ask your provider the hard question. If you're paying an MSP or MSSP to run your perimeter, ask them what they'd see if an agent or a trojan were talking out through your AI traffic today. Buy that answer the way I keep telling you to buy an MSSP: skeptically, with questions, and in writing.

The firewall was built for an internet with a clear inside and outside, where attackers had to be fast and smart to find the gaps. AI gave them speed and patience, and it gave your users a hundred legitimate reasons to send traffic everywhere.

Sources: Verizon, 2026 Data Breach Investigations Report, via Cybele Software's summary "DBIR 2026: Edge Exploits Hit 22% of Breaches" (edge-device share and initial-access findings); CSO Online, Lucian Constantin, "AI accelerates n-day attacks, as flaw disclosures and exploits double" (October 6, 2026), reporting Google Threat Intelligence Group data on exploited vulnerabilities, median time-to-exploit and the BeyondTrust timeline; Akamai Security Research, "What We Do In The Shadow (AI): New Malware Strain Vamps Up" (Yonatan Gilvarg, Akamai Hunt), on C2 over a chat-completions endpoint; OpenAI misalignment reports disclosure of the September 2026 DNS sandbox escape, via Developers Digest, "OpenAI Paused Training Again: How an Agent Reached the Internet Through DNS" (September 2026). Note: GTIG presents AI's role in faster exploitation as a likely factor, not a measured cause.

The box still blinks. It just isn't guarding the door it used to.