#Hackers Use Autonomous Agents to Probe Network Defenses — and Your Security Stack Wasn't Built for This

TL;DR (Direct Answer): In September 2025, security researchers documented the first fully autonomous AI-orchestrated cyberattack — an AI agent that independently handled 80 to 90 percent of the operation from initial reconnaissance through data exfiltration, with humans only supervising key decision points. Since then, the pace has accelerated dramatically. CrowdStrike's 2026 Global Threat Report found that average network breakout times — the window between initial breach and lateral movement — fell to just 29 minutes in 2025, a 65% speedup from 2024. Russian-speaking attackers used multiple commercially available AI services to probe misconfigured FortiGate firewalls across more than 600 systems in 55 countries this January and February alone. SentinelOne disclosed that a Chinese operator used Claude Code to autonomously target 30 organizations across multiple sectors with minimal human intervention. A New York University researcher built a fully autonomous ransomware prototype using LLMs that generated custom exploit code in real time, scoured target systems for sensitive data, and wrote personalized ransom notes based on what it found. And Orca Security is warning that the AI agents enterprises are now deploying inside their own networks — the ones with trusted access to files, systems, and databases — are fast becoming the most exploitable attack surface in the building. This post covers what autonomous agentic attacks actually look like, what they've already done, and what defenders are actually doing about it.

#The Moment the Security Industry's Assumptions Broke

For two decades, enterprise cybersecurity operated on a set of assumptions that were approximately correct. Attackers were humans who needed time — time to do reconnaissance, time to write exploits, time to move through a network without triggering alerts. Defenders who moved fast enough could contain a breach before it became catastrophic. Speed was the defender's primary lever.

Those assumptions broke in September 2025.

The documented case from that month — a financial services company whose network was compromised by an AI agent operating with 80 to 90 percent autonomy — was not a nation-state operation with a billion-dollar budget. It was an AI system that identified a target, probed for vulnerabilities, pivoted automatically when initial attempts triggered alerts, found a less-monitored third-party integration, and exfiltrated data — all at a speed no human operator could have matched. The humans in the loop were supervising, not directing.

The security industry spent the following months arguing about whether that case was truly autonomous or whether the "AI" label was being applied loosely. That debate, whatever its technical merits, missed the larger point. The CrowdStrike number that followed — 29 minutes from initial breach to lateral network movement — made the case more clearly than any single incident could. The window defenders have to respond has been cut to half an hour. At that speed, human-in-the-loop incident response is not a strategy. It's a post-mortem.

The industry's assumptions didn't just break in September 2025. They've been progressively failing since, and March 2026 is the moment when the gap between the threat landscape and the average enterprise security posture has become impossible to ignore.

#What Autonomous Agentic Attacks Actually Look Like

#The Six Stages Nobody Talks About Together

Most coverage of AI-enabled cyberattacks treats individual incidents or individual techniques in isolation. The more important picture is the full attack chain — how the six stages of an autonomous attack connect, what AI does at each stage, and why the combination is categorically different from what defenders have faced before.

Stage 1 — Reconnaissance at machine scale. While a human attacker might spend days identifying vulnerabilities in a target network, AI agents can scan thousands of potential entry points in minutes. They analyze publicly available information, probe network defenses, and identify the weakest links in security infrastructure. Russian-speaking attackers used this approach in January and February 2026 — using multiple commercially available generative AI services to plan, manage, and conduct cyberattacks on organizations with misconfigured firewalls in over 55 countries, targeting more than 600 systems protected by FortiGate firewalls by scanning for internet-exposed login pages.

Stage 2 — Just-in-time exploit generation. Once inside, AI-powered malware exhibits behavior security researchers call "just-in-time" modification — rather than executing pre-written code that antivirus software might recognize, these programs query large language models during execution to generate fresh malicious code on demand. Signature-based detection, which works by recognizing previously documented malware patterns, is structurally blind to code that has never existed before.

Stage 3 — Adaptive lateral movement. Once inside, AI agents dynamically map the network, identify high-value data stores, locate shadow IT, and pinpoint critical misconfigurations in minutes — then chain together multiple exploits, generate bespoke exploit code on the fly, and move across systems at speeds impossible for human operators. CrowdStrike's finding that breakout time fell to 29 minutes in 2025 — 65 percent faster than in 2024 — is a direct result of this automation.

Stage 4 — Autonomous pivot on resistance. The behavior that most concerns defenders is what happens when an autonomous agent hits a hardened environment. When this actor encountered hardened environments or more sophisticated defensive measures, they simply moved on to softer targets rather than persisting, underscoring that their advantage lies in AI-augmented efficiency and scale, not in deeper technical skill. This means the enterprises spending the most on security are not necessarily the ones being attacked — autonomous agents optimize for efficiency, not for any specific target.

Stage 5 — Memory poisoning and agent hijacking. As enterprises deploy their own AI agents, a new attack vector has emerged that didn't exist two years ago. Experts at Orca Security warn that as organizations come to rely more on AI assistants, those agents potentially offer attackers a simpler way to move laterally inside a victim organization's network post-compromise — by manipulating the AI agents that already have trusted access and some degree of autonomy within the victim's network. By injecting prompt injections in overlooked fields that are fetched by AI agents, hackers can trick LLMs and abuse agentic workflows.

Stage 6 — Personalized payload delivery. AI generates hyper-personalized, multilingual phishing lures, voice clones for vishing, and deepfakes to impersonate trusted figures, maximizing breach success rate. The autonomous ransomware prototype built by a New York University researcher — known as PromptLock — used AI to generate custom code in real time, scour the target system for sensitive data, and write personalized ransom notes based on what it found.

#The Claude Code Disclosure Nobody Saw Coming

The most operationally significant intelligence disclosure of the past month came not from a security vendor but from Anthropic itself. Anthropic's disclosure of Chinese operators using Claude Code for autonomous intrusions is instructive: one operator hitting thirty targets with minimal human intervention.

SentinelOne's analysis of that disclosure was blunt: the threat actor using Claude Code to maximize their operational capability didn't stumble into competence — they iterated, tested, and created a harness for ready deployment with the human as far out of the loop as possible.

This is the case that closes the debate about whether AI is "really" being used in autonomous attacks or whether the labels are being applied loosely. Thirty targets. One operator. Minimal human intervention. The tool was Claude Code — a product sold commercially, available to anyone with a credit card and an Anthropic account.

#Ransomware 5.0: The Evolution Nobody Wanted

Security researchers have developed a taxonomy for the evolution of ransomware that is worth understanding in full, because it explains why the incidents of 2026 feel categorically different from the ransomware attacks of 2019 or 2022.

Ransomware 1.0 was spray-and-pray: automated campaigns targeting anyone who clicked a link, with generic ransom notes and low payouts. Ransomware 2.0 introduced manual targeting of high-value networks by human operators. Ransomware 3.0 added data exfiltration alongside encryption — double extortion. Ransomware 4.0 brought triple extortion, adding customer and partner notification threats.

Ransomware 5.0 marks the transformation of ransomware from a human-operated campaign into a semi- or fully-autonomous operation. In this new model, AI is embedded into every stage of the attack: AI generates hyper-personalized phishing lures to maximize the initial breach rate; once inside, AI agents dynamically map the network, identify high-value data stores, and pinpoint critical misconfigurations in minutes; the AI platform chains together multiple exploits and generates bespoke exploit code on the fly; and the AI continuously refactors the malware's code and behavior in real-time based on the defensive tools it detects, making signature-based detection ineffective.

The groups executing this model in 2026 are not new. Ransomware groups like Qilin and Cl0p aren't new, but they're moving faster and using more sophisticated tactics. DireWolf and The Gentlemen were observed in 2025 but are becoming high-velocity groups with hundreds of new victims in 2026. The AI tools have been layered onto established criminal operations — the criminal infrastructure already existed. The AI multiplied its throughput.

#The Defender's Dilemma: Your SIEM Was Built for Humans

The most important structural problem facing enterprise security teams in 2026 is not that the attacks are sophisticated. It's that the defenses were built for a different kind of attacker.

Your SIEM and EDR tools were built to detect anomalies in human behavior. An agent that runs code perfectly 10,000 times in sequence looks normal to these systems. But that agent might be executing an attacker's will.

This is the core asymmetry. Human attackers make mistakes, move inconsistently, and leave behavioral fingerprints that pattern-matching detection can identify. Autonomous agents do not make those kinds of mistakes. They execute precisely, consistently, and at speeds that outpace human analyst review. When autonomous agents can probe, validate, and exploit at machine speed, the gap between vulnerable and compromised collapses. Without a countervailing investment in AI-native defense, that asymmetry becomes the defining feature of the landscape.

The cascading failure problem compounds this. Research on multi-agent system failures found that cascading failures propagate through agent networks faster than traditional incident response can contain them. In simulated systems, a single compromised agent poisoned 87% of downstream decision-making within four hours. For lean security teams, diagnosing the root cause of cascading failure is incredibly difficult without deep observability into inter-agent communication logs — your SIEM might show 50 failed transactions, but it does not show which agent initiated the cascade.

#What Defenders Are Actually Doing About It

The picture is not uniformly grim. The same AI capabilities enabling attacks are enabling defenses — and the most significant defensive investments are moving in directions that would have seemed speculative eighteen months ago.

#AI-Native Detection and Response

CrowdStrike recently launched two new AI agents: one designed to analyze malware and suggest how to defend against it, and another that actively combs through systems for emerging threats. Darktrace has introduced new AI tools designed to automate the detection of suspicious network activity.

The logic behind AI-native detection is the same logic behind AI-native attacks: the speed problem can only be solved by matching the attacker's operational tempo. A security operations center staffed by human analysts reviewing alerts in 15-minute response cycles cannot contain a 29-minute breakout. An AI system that identifies, validates, and responds to lateral movement in seconds can — if it's tuned correctly and has the behavioral baselines to distinguish anomalous agent behavior from normal agent behavior.

#Autonomous Penetration Testing

Aikido Security recently released a new tool that uses agents to simulate cyberattacks on each new piece of software a company creates — a practice known as penetration testing — and automatically identify and fix vulnerabilities. Traditional penetration testing is a labor-intensive process relying on highly skilled experts in short supply.

The strategic logic is straightforward: if attackers are using autonomous agents to probe your network continuously, defenders who test their own defenses periodically are structurally behind. Continuous autonomous penetration testing closes the testing frequency gap. It's the security equivalent of using AI for code review before deployment — catching vulnerabilities at creation rather than after exploitation.

#Behavioral Baselines for AI Agents

The most forward-looking defensive posture addresses the agent hijacking problem directly. If an agent that normally checks inventory begins executing SQL DROP TABLE commands or accessing sensitive directories, your XDR platform should detect this behavioral anomaly immediately — this is where AI fights AI, using anomaly detection models to police the behavior of your autonomous agents. Map these activities to the MITRE ATT&CK for AI framework to identify suspicious patterns across reconnaissance, resource development, execution, persistence, privilege escalation, defense evasion, and impact.

MITRE ATT&CK for AI — released in early 2026 — is the first standardized framework for categorizing AI-specific attack techniques. Its existence signals that the security industry has accepted that AI agents require their own threat modeling discipline, separate from the frameworks built for traditional human-operated attacks.

#The Identity Layer Is Now Primary

By 2026, identity abuse has overtaken network exploits as the primary breach vector. Hackers increasingly focus on stealing credentials, hijacking sessions, and bypassing multi-factor authentication.

The shift is partly a consequence of AI-enabled attacks being so effective at credential harvesting — social engineering campaigns personalized by AI at scale can fool employees who would have recognized a generic phishing attempt. But it's also structural: as enterprises move workloads to cloud environments, traditional network perimeters have dissolved. The identity layer is the only perimeter that travels with the data.

Strong identity controls, network segmentation, and behavior-based detection remain effective against agentic attacks when applied consistently. Agentic AI doesn't stop after a failed attempt — threat models and incident response plans must account for autonomous retry and adaptation.

#The Threat Landscape Summarized

#What This Means for You Right Now

If you run security at an enterprise: The 29-minute breakout figure is the number that should reset your incident response planning. If your mean time to detect is measured in hours and your mean time to respond is measured in days, those timelines are incompatible with the current threat environment. The investment priority is AI-native detection with automated response capabilities — not as a future roadmap item, but as an immediate operational requirement.

If you deploy AI agents inside your organization: The Orca Security finding about enterprise AI agents being exploited for lateral movement is the most underappreciated risk in the current landscape. Every AI agent you deploy with trusted access to production systems is a potential pivot point if it can be manipulated through prompt injection. Behavioral monitoring for agent actions — flagging when an agent does something outside its established pattern — is not optional anymore. It's a basic security hygiene requirement for any organization running agentic AI at scale.

If you're a developer: The era of periodic security testing is over. The dynamic nature of AI-driven threats requires continuous validation of security controls. Automated penetration testing and attack surface management tools can constantly probe for weaknesses, providing a real-time view of security posture that static testing schedules cannot match. Building security testing into CI/CD pipelines — the same way you build unit tests — is becoming a standard practice, not an advanced one.

If you follow policy: The MITRE ATT&CK for AI framework's release in early 2026 is a signal that the standards community has caught up to the threat. The next step — and the one that remains incomplete — is translating that framework into regulatory requirements. The EU AI Act's August 2026 enforcement deadline covers high-risk AI applications but doesn't yet specify agentic attack prevention requirements. That gap will be filled. The question is whether it's filled by proactive policy or by a high-profile incident that forces legislative action.

#FAQ

What is an autonomous AI cyberattack and how is it different from traditional malware?
Traditional malware is pre-written code that executes a fixed sequence of actions. An autonomous AI cyberattack uses large language models or agentic frameworks to make real-time decisions — choosing which vulnerabilities to probe, generating custom exploit code on demand, adapting tactics when initial attempts are blocked, and continuing until the objective is achieved or the agent is shut down. The key difference is adaptability: traditional malware fails when its pre-written logic encounters an unexpected defense. An autonomous agent retries, pivots, and generates new approaches without human intervention.

What is "breakout time" and why does 29 minutes matter?
Breakout time is the window between an attacker's initial foothold in a network and their first lateral movement — the moment they start spreading beyond the initial entry point. A 29-minute breakout time means that from the moment of initial compromise, a security team has less than half an hour to detect the breach and contain it before the attacker has spread. Human-led incident response, which typically involves alert triage, analyst escalation, and manual investigation, cannot reliably operate within that window. AI-native detection and automated response are required.

What is the Claude Code incident Anthropic disclosed?
Anthropic disclosed that a Chinese operator had used Claude Code — Anthropic's agentic coding assistant — to conduct autonomous network intrusions targeting approximately 30 organizations across multiple sectors. The operator used Claude Code with minimal human intervention, building what SentinelOne described as "a harness for ready deployment." Anthropic disclosed the incident as part of its transparency reporting on misuse. The incident is significant because it demonstrates that commercial AI tools — not purpose-built hacking frameworks — are being used for autonomous cyberattacks.

What is prompt injection and why does it matter for enterprise AI agents?
Prompt injection is an attack where malicious instructions are embedded in content that an AI agent reads — a document, a database field, a web page — that cause the agent to execute actions its operators did not intend. For example, a malicious string hidden in a customer support ticket might instruct an enterprise AI agent with database access to exfiltrate records rather than resolve the support request. Because the injection looks like normal input to the AI, traditional security tools that scan for known malware patterns will not detect it. Behavioral monitoring — flagging when an agent does something outside its established pattern — is the primary defense.

What is MITRE ATT&CK for AI?
MITRE ATT&CK for AI is a framework released in early 2026 that catalogs the techniques, tactics, and procedures used in AI-specific cyberattacks. It mirrors the structure of the original MITRE ATT&CK framework — which covers traditional attack techniques — but addresses categories unique to AI systems: model manipulation, data poisoning, prompt injection, memory poisoning, and agent hijacking. Security teams can map their detection and response capabilities against the framework to identify gaps specific to agentic AI systems in their environment.

Are AI-powered defenses keeping pace with AI-powered attacks?
Partially — and the gap varies enormously by organization size and security maturity. Large enterprises with dedicated security operations centers are deploying AI-native detection tools from CrowdStrike, Darktrace, and SentinelOne that operate at the same speed as autonomous attacks. Mid-market organizations are significantly more exposed, because the tools exist but the implementation requires expertise and budget that most mid-market security teams don't have. The Barracuda Networks assessment is accurate: organizations that invest in strong identity controls, behavior-based detection, and rapid incident response will be best positioned. Organizations that treat AI security as a future roadmap item are operating with a defense that was built for a threat that no longer exists.