AI can now find and exploit flaws faster than they can be patched, and state hackers are already using it. Backscatter maps your network the way they do, finds what's exploitable first, and puts it in front of you with the fix.
Frontier AI can find and exploit flaws faster than anyone can patch them. Chinese state actors have spent years inside the internet-facing gear the world runs on, and they're now running intrusions on autopilot.
In April 2026, Anthropic disclosed Claude Mythos Preview, an unreleased model that can find and exploit zero-days in every major operating system and every major web browser. Anthropic has kept it unreleased and given access only to defenders, through Project Glasswing.
"It will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely." Anthropic
of high-severity vulnerabilities found, including in every major OS and browser.
of them were still unpatched when Anthropic published.
The age of the oldest bug it found, in OpenBSD, an OS known for its security.
Engineers with no security training asked it for a remote-code-execution exploit and woke up to a working one. Anthropic
Beijing's hacking groups go after the routers, firewalls and VPNs that sit on the open internet, the same equipment Backscatter watches. Now they're adding autonomous AI, running on open Chinese models no lab can switch off.
Dutch intelligence warned in October 2026 that AI will drive an escalation in Chinese exploitation of edge devices, both zero-days and known flaws. AIVD / MIVD
Pre-positioned inside US communications, energy, transportation and water networks for disruptive attacks in a crisis. CISA · NSA · FBI
At least 200 US companies and victims in 80 countries breached, mainly through their routers. FBI
A Chinese state-sponsored group had AI agents carry out 80–90% of an intrusion campaign against about 30 organizations. Anthropic
Paired an open-source AI hacking framework with DeepSeek and Zhipu GLM to run 25 autonomous operations against at least 19 organizations, getting in at 10. Unit 42
Mandiant's estimated mean time-to-exploit in 2025. On average, attackers were using flaws before a patch existed. M-Trends 2026
of vulnerabilities first exploited in 2025 were hit on or before the day they were published. Edge devices were targeted most. VulnCheck
new CVEs in 2025, up 20.6%. Nobody without a security team can keep up with that list. CVE data review
Firewalls, VPNs, routers, remote desktop, forgotten servers. Machine-speed attackers will find them. Backscatter makes sure you find them first, and tells you how to shut them.
We run the same continuous recon attackers do, stop at the door, and hand everything we find to the people who own it.
Every public IPv4 address, all 65,535 TCP ports, on a continuous cycle. Our scanners say who they are in reverse DNS and on a public info page, and opt-outs are honored permanently.
When something answers, we read its banner, TLS certificate and headers to identify the software and version. Subdomains come in from certificate transparency logs, so new sites show up the day they get a certificate.
Each fingerprint is matched to known vulnerabilities and ranked by what's actually being exploited: CISA's KEV list, exploit likelihood and severity. Findings are flagged when a version could be a patched distro build.
Critical findings go straight to the owner, or to the network's abuse contact if the owner hasn't signed up, with the fix in plain language. Prove ownership with one DNS record to see everything. We rescan and confirm when it's closed.