A Year of Agent-Assisted Attacks: What Changed for Defenders
Last November, Anthropic’s account of the GTG-1002 campaign described an AI agent carrying out most of the tactical work of an espionage operation, with human operators approving a few key decisions. We wrote at the time about what that tempo means for security operations. Since then, model providers, security vendors and government agencies have published a steady flow of reporting on attackers using AI agents.
This piece synthesizes that public reporting. It doesn’t attempt to count incidents. Visibility varies too much between sources for that. Instead, it looks at which patterns recur across independent reports, and which assumptions from last year held up.
Patterns that recur across the reporting
Agents are used most where work is repetitive and verifiable
The clearest use of agents across reports is in reconnaissance, vulnerability scanning, exploit adaptation and credential testing. These tasks share two properties: they’re repetitive, and the agent can check its own success (a port is open, an exploit works, a credential authenticates). Where success is easy to verify, agent mistakes are cheap.
Tasks that require judgment about a specific victim, such as deciding which data matters or how to extort an organization, still show more human involvement.
Exploitation has become faster at scale
Verizon’s 2026 DBIR found that exploitation of vulnerabilities overtook credential abuse as the leading initial access vector, and pointed to AI as an accelerant in finding and exploiting software flaws. Threat intelligence reporting through the year has described the gap between disclosure and mass exploitation continuing to shrink, with attackers using AI tooling to analyze patches and adapt public proof-of-concept code quickly. We covered the implications for exposure management in Exploitation Overtook Stolen Credentials.
One operator, many intrusions
Several reports describe small groups, or individuals, running campaigns against many targets in parallel, with agents handling the per-target work. The effect for defenders is more simultaneous attempts against organizations in the same sector, often with similar techniques. Sharing indicators and detections within sectors has become more valuable as a result.
Agents make characteristic mistakes
Reporting consistently notes that agents overstate results, misread context and repeat failed actions. Those mistakes produce noise: bursts of failed attempts, unusual request rates, and commands that make sense only as automated retries. Defenders who looked for that noise often caught activity early.
AI systems themselves became targets
A parallel thread of reporting covers attacks on AI infrastructure and tooling rather than attacks using AI: compromised AI libraries in March’s supply chain wave, exposed agent deployments, and intrusions into AI development environments. As organizations deploy agents with broad access, those agents are becoming attractive targets in their own right.
Which defensive assumptions held up
Looking back at what we and others recommended last year, most of it has held up. Some of it needs refinement.
| Assumption from late 2025 | How it held up |
|---|---|
| Attacker tempo would increase, shrinking the time between steps | Held up. Queue time and approval latency remain the main defensive bottlenecks |
| Familiar techniques would dominate; orchestration was the novelty | Held up. Most reported activity used known techniques, so existing detection coverage stayed valuable |
| Agent mistakes would create detectable noise | Held up, though better-resourced actors have reduced it over the year |
| Pre-approved automated containment would help | Held up where organizations implemented it. Those that kept every action manual reported the most difficulty keeping pace |
| Defensive AI would help analysts | Mixed. Enrichment and summarization delivered clear value. Autonomous investigation produced uneven results and needed close review |
What to emphasize going into 2027
Exposure reduction, because exploitation is cheaper
When exploitation is faster and cheaper for attackers, the most reliable defense is not being reachable. Continued reduction of internet-facing services, especially management interfaces and remote access, gives the biggest return.
Pre-decided response
Organizations that decided in advance which containment actions could run automatically, and made human approvals fast where they kept them, handled agent-paced activity best. That decision is specific to each workflow and each organization’s tolerance for disruption, but it needs to be made before the incident.
Identity for non-human actors
Both attackers’ agents and defenders’ agents act through identities. Strong controls on service accounts, tokens and agent identities limit what a compromised agent can do, whoever deployed it.
Detection of automation patterns
Detections for machine-paced behavior, such as high request rates from one identity, rapid tool switching and repetitive retries, were among the most useful additions teams made this year. They’re worth extending.
Securing your own AI deployments
Organizations deploying agents internally need to apply the same thinking in reverse: inventory what each agent can access, limit autonomous actions, protect the supply chain for AI libraries and tools, and monitor agent behavior. Governing AI Agents Starts With What They Can Touch sets out a starting point.
A measured view
A year ago, there was a reasonable debate about whether AI-orchestrated attacks were a meaningful shift or a demonstration. The year’s reporting has settled that debate: agents are now a routine part of capable attackers’ toolkits. It has also shown that the shift is mostly one of speed and scale. The techniques themselves are largely familiar.
That’s an encouraging conclusion for defenders. The controls that matter, including exposure reduction, strong identity, good telemetry, fast decisions and practiced response, are well understood. What’s changed is how much delay the defensive process can tolerate. Organizations that spent this year removing that delay are in a much stronger position than they were a year ago.