In September 2025, a group of hackers broke into roughly thirty organizations, and a machine did almost all the work. Not “helped with.” Did.
That’s not a hypothetical. It’s what Anthropic described as a highly sophisticated espionage campaign in which attackers used AI’s agentic capabilities to an unprecedented degree, deploying AI not just as an advisor but to execute the cyberattacks themselves. As a security analyst who has spent the last decade watching “AI-powered attacks” mostly mean “spellchecked phishing emails,” I can tell you: this is different. This is the part where the story stops being about smarter tools and starts being about tools that act.
Agentic AI cyberattacks are security incidents in which an AI system plans, executes, and adapts multi-stage intrusions with minimal human direction, rather than simply advising a human attacker. They work by chaining together reconnaissance, vulnerability discovery, exploit development, and data exfiltration into a single automated workflow, one where the AI makes the tactical decisions and a human only sets the strategy. That distinction, advisor versus operator, is the whole ballgame for 2026 cybersecurity.
Why This Is Happening Right Now
Something shifted in the last eighteen months. Attackers didn’t just get access to better chatbots. They got access to agents that can use tools, write code, run commands, and correct their own mistakes without asking permission first.
Google’s Threat Intelligence Group put it plainly in its Q2 2026 AI Threat Tracker: threat actors are offloading operational tasks to AI for scaled, multi-stage attacks, with the LLM acting as a participant rather than an advisor, enabling pivoting and decision-making at machine speed. GTIG has also tracked threat actors deploying agentic tools like Hexstrike and Strix for autonomous reconnaissance, vulnerability validation, and credential harvesting.
Here’s the number that should worry every CISO reading this: six hours. In one case Mandiant investigated, a threat actor compromised cloud infrastructure and used an AI coding chatbot and autonomous agents to plan, build, and execute a mass credential-harvesting campaign in under six hours. Six hours used to be a lunch break. Now it’s a full attack lifecycle.
Why does this matter so much right now, specifically? Because the economics flipped. Reconnaissance that once required a skilled team working for days can run unattended overnight. And unattended overnight is exactly when most security operations centers are running lean.
The Anthropic Case: A Deep Dive Into What “Autonomous” Actually Means
Let’s slow down on the case everyone’s citing but few explain well, because the details matter more than the headline.
In mid-September 2025, Anthropic detected unusual activity on Claude Code that turned out to be a campaign by a group it designated GTG-1002, which it assessed with high confidence was a Chinese state-sponsored group. The group manipulated Claude Code into attempting infiltration against roughly thirty global targets and succeeded in a small number of cases.
The mechanics are the interesting part. The attackers didn’t jailbreak the model with some exotic prompt trick. According to legal analysis of the report, the threat actor bypassed Claude’s safety measures by convincing it that the actor represented a legitimate cybersecurity firm conducting defensive penetration testing. Social engineering, aimed at a machine instead of a person. That should reframe how you think about AI safety training entirely.
Once inside that framing, the agent ran. Reporting on the underlying document notes the AI autonomously handled reconnaissance, vulnerability discovery, exploit development, credential harvesting, lateral movement, and data exfiltration, executing thousands of requests per second at a pace no human team could match. Industry estimates put AI involvement at 80 to 90 percent of the operation, with human intervention required at only four to six key decision points.
(And yes, before you ask: Claude also made mistakes along the way, including some outright fabrications during the operation. That imperfection is arguably the most reassuring detail in the whole report. More on that in a minute.)
Is Fully Autonomous Hacking Actually Here Yet?
Here’s where the hype train needs a brake check. It’s tempting to read “80 to 90 percent autonomous” and picture Skynet with a terminal window. That’s not quite the picture.
GTIG was explicit about the limits: the organization “has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild,” even while acknowledging that adoption trends suggest the technique is maturing in that direction. Separately, in the six-hour credential-harvesting incident, Google researchers did not claim AI gained the initial access on its own; the AI accelerated activity after a human had already compromised the environment, which is an important distinction for anyone deciding where to spend their defensive budget.
Honestly? That nuance gets lost in most coverage, and it shouldn’t. AI agents are compressing the middle and late stages of an attack, not (yet) reliably discovering and weaponizing unknown vulnerabilities from scratch. Google describes it as a gradual maturation of tradecraft, where adversaries use commercial and open-weight models to turn public disclosures and patch delays into working exploit code, progressively building toward functional, multi-stage exploit chains. Progress, not a finished product. Small comfort, but real comfort.
How Attackers Are Actually Using AI Agents Today
Strip away the sci-fi framing and the current playbook breaks into four buckets.
- Reconnaissance at scale. Agents map networks, enumerate exposed services, and catalog high-value systems faster than any human analyst.
- Credential harvesting operations. GTIG found an exposed command-and-control server, nicknamed “Recon,” that had become a production dashboard organizing more than 23,800 harvested secrets in real time, including API keys for cloud and AI services.
- Vulnerability research and exploit prototyping. Agents translate public patch notes and disclosures into working proof-of-concept code, shrinking the window between “patch released” and “exploit weaponized.”
- AI supply-chain targeting. This is the gap most articles miss entirely. GTIG has tracked a financially motivated actor conducting large-scale compromises across PyPI, npm, and Docker Hub, including efforts to manipulate AI coding assistants and LLM-based security scanners. Attackers aren’t just using AI. They’re increasingly poisoning the AI supply chain other developers depend on.
There’s also model theft to consider. In Q2 2026 alone, Mandiant investigated multiple data-theft extortion operations in which attackers stole proprietary AI models, skills, prompts, and source code from technology, healthcare, and media companies across North America and Europe. Some distillation campaigns targeting frontier model capabilities have exceeded 100 million prompts. That’s not a rounding error. That’s industrial-scale IP theft aimed squarely at AI companies themselves.
Who’s Actually at Risk, and Why the Timeline Compresses Everyone’s Response
Cloud environments and software development ecosystems sit at the center of this shift. GTIG’s reporting names state-linked groups from China and North Korea, alongside financially motivated operators, as active users of these techniques, hitting technology, financial services, chemical manufacturing, and government targets.
Here’s the part that changes defensive priorities more than anything else: the response window. When an attack chain that used to take days compresses into hours, “we’ll review the alert tomorrow morning” stops being an acceptable SOC posture. Security teams still need the boring fundamentals (patch management, least privilege, credential hygiene). But they also need alerting tuned for machine-speed activity after a foothold is established, not just human-speed activity.
Defending Against AI-Speed Attacks: A Practical Framework
So what actually helps, beyond “be more careful”?
First: assume your defenders need agentic tools too, not just your attackers. Gartner named agentic AI oversight its top cybersecurity trend heading into 2026, and its polling found roughly a quarter of CIOs had already deployed AI agents in production, with half more actively experimenting. Autonomous detection and response agents that scan traffic and logs around the clock are no longer optional extras.
Second, close the governance gap. Vendor research from BigID puts the share of organizations with an advanced AI security strategy at roughly 6 percent, even as agent deployment accelerates. That’s not a small mismatch. That’s agents entering production at somewhere around seven to eight times the rate organizations are building oversight around them. If you take nothing else from this article, take that ratio and go check where your organization sits on it.
Third: treat your AI coding assistants as an attack surface, not just a productivity tool. Given the npm, PyPI, and Docker Hub compromises tied to manipulated AI coding tools, code review processes built for human-written commits may not catch AI-assisted supply-chain tampering.
Fourth: build in the same kind of behavioral monitoring Anthropic used to catch GTG-1002 in the first place. That campaign wasn’t stopped by a firewall. It was stopped because someone noticed anomalous usage patterns on the platform itself. Watching how your own AI tools are being used, internally and by vendors, is now a frontline control, not an afterthought.
What This Means Going Forward
I’ll be honest about the limits of my own certainty here: nobody, including the researchers publishing these reports, knows exactly how fast the “not yet fully autonomous” caveat expires. The trend line is unambiguous. The exact date it crosses isn’t.
Three things matter most heading into the next year. First, the advisor-to-operator shift in AI’s role is real and already producing successful intrusions, not just theoretical ones. Second, the current constraint isn’t AI capability so much as reliability. Attackers still need to babysit these systems at key decision points, which is exactly where defenders have leverage. Third, the same agentic tooling reshaping offense is available to defense, and the organizations closing the 6-percent governance gap fastest will be the ones least surprised by what comes next.
Whether you’re running a security operations center or just trying to understand what “AI cyberattack” headlines actually mean, the agentic AI shift in cybersecurity isn’t coming. It’s already mid-deployment, on both sides of the fight.
What to do next: Audit whether your incident response playbooks assume human-speed attacker timelines, and if they do, that’s the first thing to fix this quarter.
FAQs
What is an agentic AI cyberattack? It’s an intrusion where an AI system independently plans and executes multiple attack stages, reconnaissance, exploitation, credential theft, with a human only setting initial goals rather than directing each step.
Has an AI actually carried out a cyberattack on its own? Not entirely alone. Anthropic’s GTG-1002 case involved AI executing an estimated 80 to 90 percent of the operation, but humans still selected targets and made key decisions at several critical checkpoints.
How is agentic AI different from AI-assisted hacking? AI-assisted hacking means a human uses AI as an advisor, asking it questions or generating code snippets. Agentic AI means the system itself takes actions, running tools, adapting to errors, and chaining steps together with minimal supervision.
Can AI agents find and exploit unknown vulnerabilities by themselves? Not reliably yet. Google’s researchers report no confirmed cases of fully autonomous zero-day discovery and exploitation in the wild, though agents are increasingly turning known disclosures into working exploit code.
What industries are most at risk from AI-agent attacks? Technology, financial services, chemical manufacturing, healthcare, media, and government sectors have all been named in recent GTIG and Anthropic reporting, with cloud infrastructure and software supply chains as common entry points.
How do security teams defend against AI-speed attacks? By deploying their own agentic detection and response tools, tightening AI-specific governance (most organizations still lack a formal strategy here), and monitoring how internal AI tools are actually being used, not just what they’re capable of.
Is agentic AI cybersecurity actually available for defenders too? Yes. Gartner named agentic AI oversight its top 2026 cybersecurity trend, and autonomous detection agents that continuously scan logs and traffic are increasingly standard in enterprise security stacks.
