Research dossier

AI-Powered Attacks That Move Fast, Autonomously—and Why Defense Must Change

A research dossier on what is observed, what remains disputed, and what responsible machine-speed defense requires.

Share this study

LinkedInXBlueskyEmail

Executive summary

Across government assessments and vendor threat intelligence published between 2025 and early 2026, a consistent pattern emerges: artificial intelligence is making elements of cyber intrusion faster and more efficient, and adversaries are chaining more stages together with model assistance. The UK National Cyber Security Centre assesses that AI will almost certainly continue to increase the frequency and intensity of cyber threats through evolution of existing tactics rather than wholly novel attack vectors. At the same time, NCSC judges that fully automated, end-to-end advanced cyber attacks are unlikely through 2027, with skilled actors remaining in the loop.[ncsc-impact-2027], [openai-malicious-2025]

For executives, the practical takeaway is not that every attack is autonomous today. It is that task chaining, speed, and lower skill barriers are compounding while reliable full autonomy is still contested. Defenders should plan for machine-speed offense within human-set boundaries—and for machine-speed defense that is equally bounded, verifiable, and reviewable.[ncsc-impact-2027], [microsoft-tradecraft-2026], [crs-agentic-2026]

Abstract illustration of three evidence tiers in amber and charcoal — Observed, Publisher-reported, and Disputed.
Keep claims layered: Observed · Publisher-reported · Disputed.
Selected evidence in the shift toward AI-enabled operations

Chronological timeline of selected publisher disclosures from OpenAI, NCSC, Anthropic, Microsoft, and MITRE ATT&CK documenting AI-enabled cyber operations through 2026.

  1. UK National Cyber Security Centre

    Impact of AI on cyber threat from now to 2027

Sources: UK National Cyber Security Centre (2025-05-07) · OpenAI (2025-10-07) · Anthropic (2025-11-13) · MITRE ATT&CK (2026) · Microsoft Threat Intelligence (2026-03-06)

Definitions

Precise language matters because marketing and vendor disclosures often collapse distinct levels of automation. This dossier uses four tiers aligned with NCSC, CRS, and major threat-intelligence publishers.[ncsc-impact-2027], [crs-agentic-2026]

Conceptual model — not measured data.

From human-operated to agentic cyber operations

Conceptual matrix comparing traditional human-operated attacks, AI-assisted workflows with human direction, and agentic operations where models chain tasks with intermittent human review.

DimensionTraditionalAI-assistedAgentic
Planning & objectivesHuman operators plan and sequence each stage.Humans set goals; models suggest steps and drafts.Model chains subtasks; humans review at defined checkpoints.
Tool useManual scripts, consoles, and established tooling.Models draft commands, code, and research summaries.Model invokes tools through interfaces such as MCP.
AdaptationOperator adjusts based on experience and context.Human validates or rejects model output before action.Environmental feedback updates an internal action trace.
ThroughputLimited by team capacity and attention.Faster drafting, translation, and research cycles.Sustained high-volume requests across long workflows.
Human roleFull execution and judgment throughout.Direction, targeting, and release decisions retained.Target selection, escalation, and exfiltration authorization.
ReliabilityOperator accountability for outcomes.Human catches model errors before deployment.Documented hallucination and misclassification risk.

Observed change across the attack lifecycle

Abstract illustration of machine-speed cyber offense — amber signal lines across a dark network grid.
Offense is getting faster. Full autonomy is still contested.

NCSC assesses that threat actors are almost certainly already using AI to enhance victim reconnaissance, vulnerability research and exploit development, social-engineering access, basic malware generation, and processing of exfiltrated data. Microsoft Threat Intelligence reports generative AI used to draft phishing lures, translate content, debug malware, scaffold infrastructure, and support post-compromise discovery and collection. Google Threat Intelligence Group documents state-sponsored and criminal abuse of generative models across the same lifecycle, including early malware that queries large language models during execution.[ncsc-impact-2027], [microsoft-tradecraft-2026], [google-ai-tracker-2025]

The campaign at the center of the debate

Anthropic’s public disclosure of a September 2025 espionage campaign—later catalogued by MITRE as Campaign C0062—has become the reference case for “AI-orchestrated” intrusions. Anthropic assesses with high confidence that a Chinese state-sponsored group manipulated Claude Code through jailbreaks and task decomposition to target roughly thirty global entities across technology, finance, chemical manufacturing, and government sectors, achieving success in a small number of cases before disruption.[anthropic-espionage-2025], [mitre-c0062]

MITRE’s C0062 entry corroborates the tactical scope—reconnaissance, vulnerability scanning, custom exploit development, lateral movement support, credential access, staging, and exfiltration over web services—while relying on Anthropic’s primary reporting. Treat the case as a bounded, well-documented upper bound on current agentic misuse, not as proof that all advanced actors operate this way today.[mitre-c0062], [anthropic-espionage-2025]

Attack-chain orchestration

Agentic misuse differs from single-shot prompting because the model can maintain objectives across steps: plan subtasks, invoke tools through interfaces such as the Model Context Protocol, read environmental feedback, and update an internal trace of prior actions. Anthropic’s C0062 description and MITRE’s technique mapping both portray this pattern—discrete innocuous tasks assembled into a larger intrusion workflow.[anthropic-espionage-2025], [mitre-c0062], [crs-agentic-2026]

Conceptual model — not measured data.

How an agent can coordinate an attack chain

Conceptual flow diagram showing planning, tool invocation, environmental feedback, and memory linking reconnaissance through exfiltration support with human checkpoints.

PlanningDecompose objectives into innocuous subtasks.
Tool invocationCall scanners, shells, and APIs through agent interfaces.
Environmental feedbackRead command output, errors, and state changes.
Memory / stateCarry context across steps in a longer campaign.

Coordinates lifecycle stages

  1. ReconnaissanceHuman checkpoint
  2. Discovery
  3. Exploit testing
  4. Credential access
  5. Lateral movement
  6. Data analysis
  7. Exfiltration supportHuman checkpoint

Microsoft observes early experimentation with agentic AI—workflows that plan, invoke tools, and adapt over time—but states it has not yet seen large-scale agentic use, citing reliability and operational risk. Google’s “just-in-time” malware families (for example PROMPTFLUX and PROMPTSTEAL) show models altering behavior mid-execution, yet GTIG characterizes many examples as nascent or experimental. Chain length is increasing; chain reliability is uneven.[microsoft-tradecraft-2026], [google-ai-tracker-2025]

Speed, scale, persistence, and skill

Documented productivity effects are real but often vendor-reported. Anthropic states the C0062 agent performed reconnaissance “in a fraction of the time” a human team would require and issued requests at rates humans cannot sustain—while also documenting hallucinations that slowed or misdirected work. Microsoft describes AI as a force multiplier for North Korean remote IT worker schemes that maintain fraudulent employment at scale. Google reports a maturing underground market for AI-enabled phishing and malware tooling that lowers barriers for less sophisticated actors.[anthropic-espionage-2025], [microsoft-tradecraft-2026], [google-ai-tracker-2025]

Separate demonstrated throughput gains from claims about durable autonomy. Faster drafting and broader targeting are evidenced today; unattended end-to-end success against hardened targets remains exceptional and contested.[ncsc-impact-2027], [anthropic-espionage-2025], [openai-malicious-2025]

Where humans remain

Even in the most agentic public case, humans reportedly chose targets, built the attack framework, jailbroke safeguards, and approved exfiltration. MITRE notes adversary review and approval prior to data exfiltration in C0062. Microsoft repeatedly stresses that operators retain control over objectives, targeting, and deployment despite AI acceleration.[anthropic-espionage-2025], [mitre-c0062], [microsoft-tradecraft-2026]

Conceptual model — not measured data.

Human judgment moves upward, but does not disappear

Conceptual ladder diagram showing human operators retaining target selection, escalation, validation, and authorization while delegating repetitive tactical execution to agents.

Human retains

  • Target and objective selection
  • Escalation and risk appetite
  • Validation of credentials, flaws, and sensitive data
  • Infrastructure, personas, and tradecraft
  • Authorization before exfiltration

Delegated to agents

  • Repetitive tactical execution at scale
  • Reconnaissance and discovery summarization
  • Exploit scaffolding and iterative debugging
  • Log, directory, and dataset analysis
  • Multi-step task sequencing between checkpoints

Counterevidence and limits

CRS summarizes skepticism about autonomy and success claims in the Anthropic case. Google notes that some AI-enabled malware capabilities remain experimental, with API limits and detection risk constraining real-world use. Together, these sources argue for urgency without catastrophism: prepare for faster chained operations, not for omnipotent autonomous attackers today.[crs-agentic-2026], [google-ai-tracker-2025], [ncsc-impact-2027]

Responsible machine-speed defense

Abstract illustration of a bounded defense loop in amber on charcoal — observe, act, verify, review.
Machine-speed defense still needs verification and human accountability.

If offense gains speed through bounded automation, defense must respond at machine speed without surrendering accountability. CISA’s JCDC AI Cybersecurity Collaboration Playbook focuses on voluntary sharing of AI-related cybersecurity incidents and vulnerabilities among providers, developers, adopters, and partners—collaboration and telemetry for collective defense, not a prescription for automated response products.[cisa-ai-playbook-2025]

Conceptual model — not measured data.

A bounded machine-speed defense loop

Conceptual defense loop showing policy-bounded automated action, verification, tamper-evident logging, rollback capability, and mandatory post-action human review.

Critical-system exclusions: safety, medical, and industrial environments require explicit human approval gates.

  1. Detect & triageCorrelate signals; classify evidence level.
  2. Policy-bounded actionDeny-by-default; scope permissions narrowly.
  3. VerificationCross-check conclusions before irreversible steps.
  4. Tamper-evident logPreserve prompts, tool calls, and outcomes.
  5. Rollback pathUndo when classification or scope was wrong.
  6. Human reviewMandatory accountability after machine-speed action.
  • Bounded authority: automated actions should operate inside explicitly scoped permissions with deny-by-default defaults for critical systems.
  • Policy constraints: match response intensity to evidence level; separate reconnaissance, containment, and remediation authorities.
  • Critical-system exclusions: safety, medical, industrial, and other high-impact environments require human approval gates.
  • Rollback: every automated intervention should have a defined undo path when classification or scope was wrong.
  • Verification: cross-check agent conclusions with independent signals before irreversible steps.
  • Tamper-evident evidence: preserve prompts, tool calls, and outcomes for audit—not just final alerts.
  • Post-action human review: machine-speed execution with human-speed accountability.

What to watch next

A brief closing perspective

The evidence reviewed here points toward chained, machine-speed offense within human-set boundaries—not routine full autonomy. Defensive architecture should mirror that asymmetry: act quickly where policy allows, verify before irreversible steps, tell humans what happened with tamper-evident records, and exclude critical systems from unattended action. Those principles informed 0g0’s Act → Verify → Tell design direction as a research-led response to the same uncertainty this series documents.

References

  1. Congressional Research Service. Agentic Artificial Intelligence and Cyberattacks . https://www.congress.gov/crs_external_products/IF/PDF/IF13151/IF13151.2.pdf
  2. Anthropic. Disrupting the first reported AI-orchestrated cyber espionage campaign . https://www.anthropic.com/news/disrupting-AI-espionage
  3. MITRE ATT&CK. Anthropic AI-orchestrated Campaign, C0062 . https://attack.mitre.org/campaigns/C0062/
  4. UK National Cyber Security Centre. Impact of AI on cyber threat from now to 2027 . https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027
  5. Microsoft Threat Intelligence. AI as tradecraft: How threat actors operationalize AI . https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/
  6. Google Threat Intelligence Group. GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools . https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools
  7. OpenAI. Disrupting malicious uses of AI: October 2025 . https://openai.com/global-affairs/disrupting-malicious-uses-of-ai-october-2025/
  8. Cybersecurity and Infrastructure Security Agency. JCDC Artificial Intelligence Cybersecurity Collaboration Playbook . https://www.cisa.gov/sites/default/files/2025-01/JCDC%20AI%20Playbook_1.pdf

Share this study

LinkedInXBlueskyEmail

Get the next study

Subscribe for weekly research on AI-powered attacks and responsible machine-speed defense.

Weekly research only. Unsubscribe anytime via the contact form.

Portrait of Dr. Waheed Ali

Dr. Waheed Ali

Researching autonomous cyber operations, machine-speed defense, and the changing role of human judgment in security.

LinkedIn profile