AI agents are now attackers, defenders and targets

It is an intrusion where AI agents carry out multi-step hacking tasks with limited human direction, such as scanning networks, testing stolen passwords and escalating privileges. In late 2026, CrowdStrike tied a China-linked campaign against more than 200 organizations to the ARTEX agent framework, and Sophos showed a ransomware crew using a coding agent inside victim networks. People still pick targets and handle the payoff, but agents now do much of the repetitive work at far greater speed and scale.

Mostly to make payment fraud more convincing. A typical scheme starts with an email that appears to come from the CEO, then moves to a phone or video call where AI imitates the executive's voice or face, sometimes followed by a fake outside attorney. Federal prosecutors in New York charged three people in November 2026 over a scheme that allegedly took about $129 million this way. Out-of-band callbacks and dual approval for transfers remain the strongest defenses.

Treat each agent as an identity with its own credentials, permissions and logs. That means storing keys in a managed vault, granting least privilege, setting spending limits on model APIs, and watching for unusual usage that could signal LLMjacking. It also means governing the tools agents use: approving maintained MCP servers, blocking deprecated packages that may carry unpatched flaws, filtering for prompt injection, and running agents in sandboxes so a mistake or hijack cannot reach production systems.

In the US, the Cybersecurity Information Sharing Act of 2015, which gives companies liability protection for sharing threat data, runs on a short-term extension that lapses December 11, 2026. Business groups want a 10-year renewal in the defense bill, and the House version would add AI as a sharing topic. NIST is also developing its Cyber AI Profile, a voluntary guide for securing AI systems and defending against AI-enabled attacks that many firms will use as a benchmark.