AI agents are reshaping cyber offense and defense: what leaders need to know
Agent-driven breaches, a $129 million deepfake fraud case and AI models that exploit flaws at scale. Here is what changed this fall and what security leaders should do now.
AI has stopped being a future risk in cybersecurity. In the past 60 days, investigators tied real intrusions to autonomous agents, prosecutors charged a deepfake fraud ring, and AI labs shipped models that find and exploit software flaws faster than human teams. For enterprise and public sector leaders, the question is no longer whether AI changes the threat picture but how quickly security programs, budgets and policy can keep up.
Attackers are handing the keyboard to agents
The clearest signal came from CrowdStrike, which reported that a China-linked group it calls Vapor Panda used ARTEX, a multi-agent penetration testing framework, against more than 200 organizations in 14 countries starting October 17. At least nine were compromised, including telecom providers and government bodies, and researchers estimated one intrusion alone burned through more than 1.4 billion input tokens. The shift is from one AI-assisted break-in at a time to many running at once.
Criminal crews are following. Sophos documented how the Aur0ra ransomware operators used a coding agent to move from stolen credentials toward domain administrator access, with people supplying the targets and the agents doing discovery and credential attacks. The operators reportedly got around guardrails by describing the work as authorized red teaming. Blockchain analytics firm Chainalysis also disclosed a breach it attributed to offensive agentic techniques, exposing names, emails and role labels for platform users.
Fraud gets a familiar face
Social engineering is where AI hits finance teams first. Federal prosecutors in New York charged three people in a scheme that allegedly used AI to imitate executives' voices and sometimes faces on calls, then posed as outside attorneys, to steal about $129 million from companies including hospital systems and a bank. The pattern is old business email compromise with a far more convincing second step, which means callback verification and payment controls matter more than ever.
Your AI stack is now attack surface
Every model, API key and agent integration a company adds is something an attacker can steal or abuse. Google's threat intelligence team and Mandiant described LLMjacking, where criminals use stolen cloud credentials or exposed endpoints to run AI workloads on a victim's bill; some organizations lost more than $100,000 in a day and about $1 million in total.
The agent toolchain has its own supply chain problem. Researchers at Glow Security found coding agents installing deprecated MCP servers from memory, including one with a remote code execution flaw reachable by prompt injection that will never be patched because the project was archived. And a DNSFilter survey of 400 IT and security workers found 46% were confident unapproved AI apps were connected to company systems, while about one in five tied such a connection to a security incident. Shadow AI is now an identity and access problem, not just a policy memo.
Defenders get their own agents, with guardrails
The same capabilities are arriving on defense. OpenAI's GPT-6 Cyber, released to vetted security customers on November 5, found 81 previously unknown high-severity Firefox flaws and built working exploits for 948 Linux kernel bugs in testing. OpenAI rated the model Critical for cybersecurity risk under its own framework, a reminder that defensive and offensive power now ship together.
Fixing, not finding, is becoming the bottleneck. Wiz and Google DeepMind's Scan for Good effort used AI scanning plus human validation to find exposed systems at a rail operator and hospitals and get them fixed. Google Cloud, meanwhile, added sandboxing, human approval gates and agent identity tokens to its AI security tooling, so autonomous agents that triage alerts or propose fixes still need a person to sign off. Expect that model, agents that investigate and humans that approve, to define the AI-enabled SOC for the next few years.
Policy: a December deadline and a standards push
In Washington, about three dozen business groups asked Congress to renew the Cybersecurity Information Sharing Act of 2015 for ten years through the defense authorization bill, citing AI-driven attacks; the current short-term extension lapses December 11, and the House draft would add AI to the topics companies can share. The law has run on stopgap extensions since its original term ended. If it lapses again, legal teams may slow the threat sharing that defenders depend on.
On standards, NIST's Cyber AI Profile maps its Cybersecurity Framework to three jobs: securing AI systems, using AI for defense, and resisting AI-enabled attacks such as voice-clone wire fraud. NIST's latest workshop report shows the next draft is still taking shape, along with control overlays for securing AI systems.
Abroad, the head of the UK's National Cyber Security Centre warned that the country will likely face AI-enabled attacks on critical infrastructure by 2028, and the UK AI minister called a breach of national defenses "likely, if not inevitable" in an October speech. Allies are converging on the same view: AI mostly scales known weaknesses, so basic hygiene is now a national security issue.
What leaders should do now
- Inventory every AI identity. List the API keys, service accounts and agents that touch your systems, rotate secrets, set spending caps and alert on unusual model usage.
- Harden payment and approval workflows against deepfakes. Require out-of-band callbacks to known numbers for wire transfers and vendor changes, no matter how convincing the voice or video.
- Govern agent tooling like software supply chain. Approve one maintained MCP server per service, block deprecated packages and keep agents sandboxed with least privilege.
- Pilot AI in the SOC with human approval gates. Start with triage and enrichment, measure accuracy and keep people in the loop for containment and remediation.
- Track the policy calendar. Watch the December 11 information sharing deadline and NIST's Cyber AI Profile, and map your controls to it before customers or regulators ask.
Follow it with ETA
ETA tracks AI-driven attacks, defensive tools, agent security and policy on the AI and Cybersecurity hub, updated as stories break. For the bigger picture on how agents are reshaping operations, see AI agents at work, and join security and policy leaders at the US AI Congress, March 24 to 25, 2027, at the National Press Club in Washington, D.C.
Get the next one in your inbox.
Events, program news and the monthly roundups from ETA.
