Attackers are beginning to use AI for more than advice. Security teams need to prepare for faster, repeatable attack loops without assuming every incident is fully autonomous.
The change is not simply “AI makes attackers smarter”
Security teams have dealt with automation for decades. Scanners find exposed services. Scripts try stolen passwords. Malware moves from one machine to another. Calling every automated attack “agentic AI” would give an old problem a fashionable new name.
The meaningful change is narrower. An AI agent can inspect a result, decide what to try next and use tools to continue towards a goal. It can help with reconnaissance, write or adapt code, test a weakness and move to another step without waiting for a person after every action.
That does not make the attack all-knowing or fully autonomous. It does reduce the human attention needed to run parts of an intrusion. For defenders, the useful question is not, “Was AI involved?” It is, “Which parts of the attack loop became faster, cheaper or easier to repeat?”
What an agentic attack loop looks like
Traditional attack automation usually follows a script: run these commands in this order. An agent can use feedback from one action to choose the next. If one credential fails, it can try another route. If a service returns an unexpected response, it can revise the command instead of simply stopping.
| Attack activity | Conventional automation | Agent-assisted operation | Defensive signal |
|---|---|---|---|
| Reconnaissance | Fixed scan or query list | Changes queries after each result | Rapid shifts across services and identities |
| Exploitation | Runs a prepared payload | Revises commands or code after failure | Many related variations in a short period |
| Credential use | Tries a static list | Selects accounts or services from discovered context | Authentication followed by immediate discovery |
| Movement | Follows a known playbook | Chooses the next system from live findings | Fast transitions between tools, hosts and cloud services |
These are patterns, not proof. Fast or adaptive behaviour can come from ordinary tooling, and attackers may deliberately slow down. Detection still needs identity, endpoint, network and cloud context.
What the evidence supports
Public reporting now supports a careful claim: AI is being used across real cyber operations, and some operations give models enough tools and autonomy to perform substantial parts of the workflow.
Anthropic reported in November 2025 that it disrupted an espionage campaign it assessed as largely executed by AI, with human operators selecting targets and reviewing key decisions. In June 2026, Anthropic said it had mapped activity from 832 accounts banned for malicious cyber use to the MITRE ATT&CK framework. Google and OpenAI have also documented threat actors using models for research, scripting, phishing, malware development and other parts of established attack chains.
These reports come from model providers observing their own services. They are valuable primary evidence, but they are not a complete census of cybercrime. They also do not prove that most attacks are autonomous. The safer conclusion is that agent-assisted intrusion is now an operational capability, while its prevalence and effectiveness remain difficult to measure.
What changes for defenders
Correlate the sequence, not only the event
A failed login, a shell command and a cloud API call may each look harmless in isolation. The sequence may be the attack. Detection engineering should connect activity across identity providers, endpoints, SaaS platforms, cloud control planes and developer tooling.
Reduce standing authority
An agent can act only through the access it obtains. Short-lived credentials, narrowly scoped service identities, network boundaries and approval gates limit how far a successful step can lead. These controls matter whether the actor is a person, a script or an AI agent.
Automate reversible containment
Attack loops can run faster than a ticket queue. Security teams should pre-authorize low-risk responses such as revoking a suspicious session, isolating an endpoint or disabling a newly created access key. Destructive or business-critical actions should still require human approval.
| Response | Safe to automate in many environments | Usually needs context or approval |
|---|---|---|
| Enrich an alert with identity and asset data | Yes | — |
| Revoke a suspicious web session | Often | Confirm business impact and recovery path |
| Isolate a user endpoint | Often | Check critical operations and remote access |
| Disable a production service account | Rarely | Yes; it may stop a business service |
| Delete workloads or data | No | Yes; preserve evidence and recovery options |
Practise against compressed timelines
An incident exercise should not assume that the team gets an hour between stages. Test what happens when credential access, discovery and data movement appear within minutes. Measure time to validate, contain and recover—not only time to create an alert.
Know, use or master?
Know: Anyone responsible for business systems should understand that AI can shorten and connect parts of an attack. You do not need to study model architecture.
Use: Security analysts, platform engineers and incident responders should be able to correlate activity across systems, apply identity controls and run rehearsed containment actions.
Master: Detection engineers and security architects need to design cross-domain telemetry, risk-based automation and controls for both hostile agents and legitimate enterprise agents.
What should you do next?
Choose one internet-facing business service and trace the path an attacker could take after the first successful login. Ask four questions:
- Which identities and tools become available?
- Which logs would connect the steps?
- Which action could be contained automatically and safely?
- How long would a human decision take at 2 a.m.?
The agentic intrusion era does not invalidate basic security. It makes good identity design, joined-up telemetry and rehearsed response more urgent. Prepare for faster feedback loops without mistaking every automated attack for autonomous AI.
Go deeper
- Disrupting the first reported AI-orchestrated cyber espionage campaign — Anthropic, 13 November 2025. The provider’s account of a campaign it assessed as largely executed by AI, including where humans remained involved. Reviewed September 2026.
- Mapping AI-enabled cyber threats — Anthropic, 3 June 2026. Maps activity from banned accounts to MITRE ATT&CK techniques and explains the dataset’s limits. Reviewed September 2026.
- Disrupting malicious uses of AI — OpenAI, 25 February 2026. Case studies showing how threat actors combine models with conventional tools and services. Reviewed September 2026.
- GTIG AI Threat Tracker — Google Threat Intelligence Group, 12 February 2026. Documents adversarial use of AI for research, content and technical operations. Reviewed September 2026.