Securing the infrastructure against weapons that think for themselves

How much of your incident response plan assumes the adversary is a person who makes mistakes? For decades, our security posture relied on the fact that an attacker is human. Humans get tired. They lose focus. They have limited bandwidth to manage multiple complex tasks at once. This human limitation was the silent partner in our defense strategies. Agentic AI has removed that constraint. We are now entering an era where the weapon no longer needs a warrior to swing it. This is a shift from tools that assist to tools that act.

I have watched this evolution from the front lines. In 2023, I published a whitepaper at the SANS Technology Institute. It demonstrated how even unskilled users could coax chatbots into generating functional malware. At the time, the AI was a sophisticated pen. It helped draft the code, but a human still had to copy, paste, and execute the attack. By 2025, that dynamic changed with the introduction of autonomous agents. Today, in 2026, the leash is gone. The agent is the operator.

The leash is severed

The fundamental difference between the AI of three years ago and the agentic models of today is the feedback loop. Previous iterations of offensive AI were reactive. You gave a prompt, and it gave a response. Agentic AI is proactive. It receives an objective and then chooses which tools to use to achieve it. It can browse the web, run terminal commands, scan ports, and rewrite its own code when it encounters an error. This is a loop that requires no human intervention.

This change is reshaping offensive operations in two directions. It grants capability to attackers who possess no technical skill, and it lends speed to those who are already deadly. If your trade is offensive work, you must realize that the tooling an adversary turns against you is the same tooling you must use to defend. The ground has moved. We are no longer defending against a series of discrete events. We are defending against a continuous, thinking process that resides in the network.

The quiet death of the phishing tell

One of the most immediate impacts is the total automation of social engineering. In a typical scenario, an attacker deploys an agent to gather publicly available information about a specific target. The agent scrapes LinkedIn profiles, watches conference recordings to mimic speech patterns, and reads recent press releases. It uses this intelligence to build a persona. A second agent then manages the conversation. It sends the message, handles the replies, and steers the target toward a malicious link or a request for credentials.

This is the death of the signals we used to trust. For years, our phishing training focused on obvious tells. We looked for clumsy grammar, generic templates, and sense of urgency. Agentic AI erases these indicators. Each message is fluent and unique. It is grounded in real facts about the recipient. Our detection must now lean entirely on infrastructure signals like sender reputation and authentication. We are watching the linguistic firewall crumble. Phishing is a digital Trojan horse that now looks identical to a legitimate delivery.

The rise of script kiddie as a service

I often refer to this current state as script kiddie as a service. Historically, an unskilled actor was limited by their own lack of expertise. They had to wait for someone else to release an exploit. Now, the limitations are defined by the capability of the AI model. Because many untrained actors use the same frontier models, we see a behavioral monoculture. The attacks are competent, but they follow recognizable patterns.

This is a rare advantage for the defender. When thousands of attackers use the same underlying model to generate an exploit chain, they leave similar footprints. We can build detections for these default behaviors. However, this only works for the majority. Experienced adversaries adapt beyond these defaults. They use agents to execute campaigns in parallel. A task that once required a team of three people for two weeks now takes one person and an agent four hours. The volume of high-quality attacks is the new baseline.

Automation in the exploit chain

The automation has moved deep into the exploitation phase. As models grew better at chaining tool calls, the bar for producing a working exploit dropped. We saw this clearly when the federal government intervened to have Anthropic Fable 5 removed from the market. The fears regarding its capabilities were not unfounded. When you tie a capable model into a database of known vulnerabilities, it performs its own reconnaissance. It judges what a target is likely exposed to and draws the matching exploit from its library.

It acts like a hound that has caught a scent. It reports back to the operator only when it is ready to fire. Malware is also growing agentic. We are seeing strains that rewrite their own signatures to slip past controls that recognized the previous version. This is the natural evolution of the Guided Network Access Weapon (GNAW) concepts I first discussed years ago. The malware is no longer a static file. It is a piece of software that can reason about its environment and change its behavior to remain stealthy.

The confidence of a false oracle

There is a danger in leaning too heavily on these agents. They speak with unbroken authority, but they are not seeking the truth. An agent is seeking a finished task. It wants to provide an answer that looks right. It does not have a privileged view of whether a host is truly vulnerable. It matches indicators to a conclusion. If you marry an agent to a retrieval store of vulnerabilities, it will surface what is related, not what is true. It often ignores version numbers or configuration specifics.

This is the problem of the false oracle. The agent will name a target that is not there and ask for permission to strike. For the professional, this means judgment is now the primary skill. The mechanical parts of the craft are now machine tasks. The ability to know a true finding from a confident lie is where the value lies. Every time an agent suggests a path, a human must still verify the logic. If you follow an agent blindly, it will eventually walk you off a cliff.

Proving the defense through utility

The SANS Secure AI Blueprint, developed by Rob T. Lee, provides a framework for this new reality. It divides the challenge into three tracks: Protect AI, Utilize AI, and Govern AI. Governance is about policy and oversight. Protection is about hardening the systems. Utilization is where we put AI to work for both sides. Offensive operations live in the Utilize track.

Many leaders think AI security is just about policy binders. They are mistaken. Utilization is the only track that yields proof. An organization can write every guideline it wants, but until someone turns an agentic tool against the network, those guidelines are theories. A defense only matters when it makes contact with an attack. The role of the offensive practitioner is to bring that contact to the surface. We are the ones who prove whether the policy and the hardening actually work.

If you want to understand your true risk, you must conduct a risk assessment that includes autonomous attack simulation. Traditional pen testing is no longer a sufficient mirror for the threat landscape. You must see how your SOC handles an adversary that does not sleep and does not follow a human schedule. Audit your third-party vendors for their own use of agentic tools. The weapon has changed. The hand on the weapon has moved back, but the choice to fire remains ours. Our judgment is the only thing the machine cannot replace.

Sources

• SANS Technology Institute: Whitepaper on Generative AI and Malware (2023)
• SANS Secure AI Blueprint: Developed by Rob T. Lee
• MITRE ATT&CK Framework: For AI-specific adversary tactics and techniques
• NIST AI Risk Management Framework (AI RMF 1.0)

Disclaimer: This article is for informational and educational purposes only. The information provided does not replace a professional cybersecurity audit or incident response service. The author does not provide instructions for illegal activities.