THE KITCHEN IS ON FIRE! The Crowd Says AI Bug-Hunters Are the Hottest Cyber Threat, and Phishing Is Left Simmering on the Back Burner

Contestants, step up to the stove. Tonight's mystery box holds a rather frightening ingredient: artificial intelligence that hacks. The question for the crowd is simple and sharp as a boning knife. Which AI-driven cyber risk feels most acute now? Is it the machine that finds the crack in your software before you've even noticed it's there, or the machine that writes the perfect scam email in the voice of your boss? Less than a day after trading opened, the knives are out.

First, the pantry. The vulnerability camp has the strongest stock to work with. According to CERT-EU, Google's M-Trends 2026 estimates that newly disclosed flaws are now typically exploited before a patch even exists, compared with a window of about two months back in 2018. That same CERT-EU analysis recounts Anthropic's claim that its Claude Mythos Preview model autonomously found thousands of high- and critical-severity vulnerabilities. Anthropic kept the model out of public release and shared it only with vetted defensive partners through Project Glasswing. When a chef locks a knife in a cabinet, you pay attention.

The phishing camp isn't cooking with empty pots, either. Euronews reports that Google's security teams flagged AI voice cloning being used to impersonate executives and IT staff, and that Fortinet expects criminals to keep using AI to write convincing phishing emails. The UK Government's fraud strategy for 2026 to 2029 warns that deepfakes, large language models and voice cloning are making attacks more sophisticated, more credible and more numerous. There's a cooling note on the side, though. The UK's NCSC writes that in the AI Security Institute's tests of seven frontier models, no public model completed the full enterprise network attack scenario from start to finish, and performance dropped off in areas like malware development and reverse engineering.

Now the scorecards. On the Morfi opinion markets, "AI-Powered Vulnerability" leads at 68% consensus with 9 holders. "AI-Enabled Phishing" trails at 11% with 12 holders. Also on the ballot: 3 other sides. So far 18 traders have put $30,188 behind their opinions. The crowd's palate matches the pantry: the reports lean hardest on exploitation, and so does the money. The research reviewed for this market had less to say about prompt injection, and the thinner evidence there shows on the plate.

Now my verdict, and it is purely my opinion. The vulnerability dish is the showstopper, a molten-core soufflé that could collapse an entire hospital's network in an afternoon. I understand why the crowd is drooling over it. But I'd send it back for one reason: it's still half-baked. Even the evaluators say the machines can't yet cook the whole multi-step attack on their own. Phishing, on the other hand, is comfort food. It's cheap, it's everywhere, and it's being served right now to your grandmother, your accountant and your intern in a cloned voice they trust. The flashy plate wins the cameras, but the humble scam fills the restaurant's bins with victims. My tasting note: the crowd has picked the scariest dish, not necessarily the most acute one.

What to watch next: whether Mythos-style capabilities leak beyond vetted partners, whether patch windows keep shrinking, and whether the next round of government evaluations shows a model finally finishing the full attack course. Any of those could set the vulnerability camp's lead in stone, or crack it like crème brûlée. The ovens have only just been switched on, so grab an apron and join the market on Morfi before the crowd plates its final verdict.