• A Windscribe update from July 2026 appears to credit AI engine Fable for identifying necessary fixes
• The AI audit successfully spotted complex vulnerabilities across the provider's Windows, macOS, and Linux applications.
• Rival providers remain seriously apprehensive of the technology, warning of the possible consequences of error.

Windscribe appears to have quietly revealed that it used artificial intelligence to audit its software.

Hidden within the changelog for release 2.33.11, deployed on July 6, 2026, the company mentions that the update includes security fixes stemming directly from an AI review by Fable 5, an advanced AI model developed by Anthropic.

Should this be true, it’d be the first instance of a commercial VPN provider relying on a large language model to conduct a comprehensive security evaluation of its core infrastructure.

What did the Fable 5 audit find?

A closer look at the release notes shows that the Fable 5 audit successfully identified highly technical areas for improvement, helping developers secure the app against potential local attacks and data leaks.

According to Windscribe, the update includes "App hardening from the Fable 5 audit, including WireGuard key validation, Control D API key log redaction, IPC exposure hardening, safer logging, installer argument redaction, and package/dependency handling fixes."

In simpler terms, the audit identified several ways to secure how the VPN handles encryption keys for the popular WireGuard protocol and ensure that sensitive API keys aren’t accidentally saved in the software's error logs.

It also identified how Windscribe could tighten up how different parts of the application communicate with each other (known as IPC exposure), which stops bad actors from exploiting the app locally on your device.

The changelog also lists a staggering number of accompanying fixes deployed in this same update. Windscribe patched a "DLL planting vulnerability" in its Windows bootstrapper, a flaw where malicious code could be loaded in place of a legitimate file, and resolved a local privilege escalation vulnerability on Linux.

Will AI replace human audits?

Historically, VPN providers undergo independent, third-party audits to prove they do not keep logs of user activity or harbor hidden security flaws.

While an AI like Anthropic's Fable 5 can process vast amounts of code rapidly, its use raises new questions about transparency.

Can an AI audit provide the same level of assurance as a human expert? Rival providers are highly skeptical about completely handing the reins over to machines.

Speaking to TechRadar, Tomas Stamulis, CSO at Surfshark, explained that while the company uses AI models internally to spot vulnerabilities "at a scale and speed impossible for humans," formal public audits still require a human touch.

"We currently rely on independent, qualified auditors, such as Deloitte or Cure53, for our formal audits," Stamulis told us. "We strongly believe that independent validation requires external human oversight to maintain contextual analysis and ensure reliability."

Stamulis warned that relying entirely on an AI for external validation carries unique risks, particularly regarding how these language models are fed information.

He noted that "given the risk that AI findings could be manipulated through context and prompting, human-led independent oversight remains the only way to provide the level of contextual analysis and manipulation-proof assurance that authorities and customers expect."

We are still waiting to hear back from Windscribe regarding their decision to prioritize an AI-driven approach for this specific update.

However, as the industry continues bolstering protections against advanced threats, AI auditing, whether used internally or publicly, represents the next major evolution in digital privacy.

• NordVPN blocked over 5 million malware attempts in January alone
• 99% of phishing attacks impersonate just 300 brands
• AI tools and fraud kits mean attackers no longer need advanced skills

We are well past the days when a cyberattack meant mass-mailing a poorly spelled virus. In 2026, cybercriminals are heavily leveraging generative AI to make their scams highly personal, industrializing fraud on a massive scale.

That is the stark warning from the Consumer Cybersecurity Report: Dismantling the Evolving Threat Landscape, published today by NordVPN. Analyzing threat intelligence data from the first half of the year, the prominent cybersecurity and best VPN provider uncovered that the most exploited vulnerability right now isn't outdated software; it is human trust.

Armed with unrestricted AI models and ready-to-use fraud kits, scammers have drastically lowered the entry barrier for digital crime. The focus has decisively shifted from complex technical exploits to highly targeted campaigns that weaponize greed, urgency, and our faith in familiar brands.

"Bad actors are weaponizing our natural instinct to believe what we see and hear," says Marijus Briedis, CTO at NordVPN, warning that these attacks no longer require advanced skills or significant resources. "Anyone with an internet connection can launch them."

It's in this context that "A single human error is now more likely than ever and likely to be more devastating than ever," Briedis added.

The numbers behind the threat

NordVPN analyzes 12 million unique URLs daily, blocking an average of 130,000 malicious pages every 24 hours before they can reach a user — a critical defense mechanism as NordVPN’s antivirus tool continues to block massive volumes of malicious sites.

Malware remains the single largest threat by volume. January 2026 saw a massive peak of over 5 million blocked attempts as attackers preyed on post-holiday shoppers. Most of these were infostealers aiming to grab saved login credentials.

The US was the hardest hit with 4.89 million attempts across the first half of the year, followed by the UK (2 million) and Germany (1.32 million).

Phishing is equally rampant. NordVPN blocked over 4.4 million phishing attempts in the first half of the year, noting that 99% of these attacks impersonate a narrow list of just 300 brands, often disguised as fake job recruiter campaigns.

Microsoft was the most impersonated company (16.12%), followed by Roblox (12.32%), Google (9.94%), and Netflix (5.99%). Adding to the danger, attackers frequently exploit the trusted .com domain, which accounts for 43.2% of all intercepted scams.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Hijacked sessions and the Dark Web

While users are increasingly wary of downloading fake apps or clicking shady links hidden in pirate sites, attackers are finding stealthier ways in.

Between January 1 and May 26, 2026, a staggering 94 billion cookies were exposed online. Of these, 1.2 billion were active session cookies, which cybercriminals can use to hijack accounts without needing a password, often completely bypassing multi-factor authentication (MFA).

Once data is stolen, it is swiftly commodified. Using its Dark Web Monitoring tools, NordVPN identified 8.4 million compromised accounts in just 90 days.

Frighteningly, over 47% of the exchanged data involved physical addresses and full names, allowing attackers to weave digital and real-world identifiers together into comprehensive victim profiles.

Telephony isn't safe, either. Between the service's launch and June 16, NordVPN blocked nearly 29,000 scam calls and issued spam warnings to over 525,000 users.

How to stay safe

Because technical barriers for criminals are lower than ever, defensive strategies must evolve. NordVPN's report stresses that consumer protection now requires a mix of both technological defenses and behavioral resilience.

Alongside using security tools like a virtual private network (VPN) and antivirus software, users must cultivate a healthy skepticism. If a message, email, or website demands urgent action or offers something too good to be true, pause and verify.

In the age of AI-driven fraud, a moment of hesitation is your best line of defense.