TECH

AI agents accelerate cyberattacks and shrink the time companies have to react
The use of artificial intelligence by criminals is accelerating digital attacks and increasing the pressure on teams tasked with protecting companies and online services.
According to a report by The Wall Street Journal, tools capable of automating stages of an intrusion are being used both by sophisticated groups and by attackers with little technical experience.
This shift involves so-called "AI agents"—programs that can execute sequences of tasks and determine subsequent steps based on the results they encounter. During an attack, these agents can help map out systems, identify vulnerabilities, and attempt to gain access to information.
A report from CrowdStrike, published this week, details four operations in which attackers employed AI agents to select actions and carry out stages of an attack, with varying degrees of human oversight.
Continuous security operations for faster defense...To address this new threat landscape, organizations are transitioning to continuous security operations models.
In these environments, detection, correlation, and response no longer function as separate activities but instead become part of an ongoing workflow.
The goal is not simply to automate more tasks, but to expand the operational capacity of security teams so they can keep pace with fast-moving threats.
In this model, AI acts as an extension of the security team. Context is built continuously, investigations progress in the background, and much of the initial analysis is already available before a security analyst gets involved.
This approach is especially valuable for MSPs, whose ability to scale operations depends on simultaneously managing a growing number of clients without a proportional increase in staffing.
Organizations are pivoting toward AI-driven continuous security operations models. Context building, activity correlation, and elements of the investigative process no longer depend solely on sporadic human intervention, but instead operate continuously.
The goal is not simply to automate more tasks, but to expand the operational capacity of security teams so they can respond more quickly and consistently in a fast-paced threat landscape. Reducing the time spent on repetitive investigation and contextualization tasks means security teams can focus their expertise on decision-making, oversight, and strategic response.
Time has become the new perimeter...AI is redefining the balance between attack and defense. As attackers leverage autonomous capabilities to accelerate intrusions, defenders need new ways to expand their operational capacity and respond at the same speed.
Consequently, security operations must evolve toward continuous operating models where AI is not merely an efficiency tool, but an active component of an organization's defensive capability.
Because in the era of autonomous AI, time is no longer just an operational metric. It has become the most critical asset in modern cybersecurity.
If you'd like to explore this transformation further, read our article "Security Operations Enter the Age of Native AI", where we examine how artificial intelligence is reshaping cybersecurity’s operational capacity and why time is now the deciding factor in modern cyber defense.
In our next article, we will also explore why operational capacity is emerging as one of the biggest challenges in modern cybersecurity, and how it is changing the way organizations scale their security operations.
Attacks on the healthcare sector in Argentina: An operator compromised at least 15 organizations. In one instance, credentials and medical information were stolen. The system utilized one "supervisor" agent to select tasks, while another agent executed them.
Targets in Brazil and other countries: An operator compromised government entities in two countries and targeted companies in Brazil and the United States. Their systems allowed the AI to operate autonomously or distribute tasks among specialized agents. The report does not state whether the attempts against Brazilian companies were successful.
An attacker with limited technical experience: An operator used a set of instructions to guide "Claude Code" during intrusions. Although the operator had to intervene to bypass the model’s built-in security barriers and persist with the attempts, they ultimately succeeded in compromising government domains and private companies.
Theft of corporate data: A Russian-speaking group stole customer data from a U.S.-based provider of customer relationship management (CRM) software and compromised several other organizations. The agents were provided with a seven-step roadmap, yet they retained significant autonomy in choosing their methods for carrying out the intrusion. In another study, Microsoft identified attacks involving ARTEX, an open-source tool designed for security testing and vulnerability discovery. According to the company, the group known as Storm-0940 used this tool to automate attacks against hundreds of organizations across various sectors. In some instances, the attackers gained access to restricted functions within the victims' cloud systems in less than three hours.
This does not mean every attempt was successful. Microsoft states that most of the observed actions failed, though the group did manage to maintain unauthorized access to several organizations. The challenge, the company notes, is that the speed of automation leaves security teams with very little time to analyze alerts and block the intruders.
The pressure intensified this week with the disclosure of critical flaws in PHP—a technology that powers many websites. These vulnerabilities could allow an attacker to execute commands remotely on affected servers without needing to log in. Emergency patches were released on October 21.
Amazon reported that its monitoring systems detected an attempt to exploit these flaws on October 17, four days before they were publicly disclosed. Following the release of the patches, new exploit code appeared within hours and was almost immediately deployed against the company’s sensors. Amazon points out that it remains unclear whether all these attempts would have been effective against actual, live systems.
While AI can assist in identifying security issues, it can also facilitate the work of those seeking to exploit them. According to Amazon, using such technology to analyze security updates makes it faster and cheaper to figure out how to attack systems that have not yet been patched. This shrinks the window of time companies have to respond, requiring that critical vulnerabilities in internet-facing services be addressed within hours.
AI agents accelerate cyberattacks by automating vulnerability discovery in real time, shrinking the time companies have to react by executing exploits at machine speed—effectively removing the human factor from the process.
While traditional attacks rely on human operators to analyze networks manually and in stages, AI agents operate autonomously and continuously. This transforms the window for defense—previously measured in days or weeks—into a matter of minutes or seconds.
Below are the primary reasons why AI agents have revolutionized the speed and scale of cyber threats:
How AI agents accelerate attacks:
• Autonomous Scanning and Reconnaissance: AI agents scour the internet and corporate networks around the clock. They identify security gaps and misconfigurations instantly, without requiring human input at every step.
• Tailored Exploit Development: Using advanced language models (LLMs), these agents can analyze the code of a target system and generate malicious code specifically designed to exploit a particular vulnerability in real time.
• Hyper-personalized Phishing at Scale: AI eliminates common grammatical errors and creates highly convincing emails, messages, and voice clones (deepfakes). A single agent can interact with thousands of employees simultaneously, dynamically adapting the tone of the conversation.
• Adaptive Evasion: If an AI agent encounters antivirus software or an endpoint detection and response (EDR) system, it does not give up. Instead, it modifies its own code or behavior in real time to bypass the security barrier and continue the intrusion.
Why the time available for corporate response has shrunk:
• Machine Speed vs. Human Speed: Human defenders must analyze alerts, validate whether a threat is genuine, escalate the issue, and make a decision. AI agents make decisions and spread malware across a network in milliseconds.
• Immediate Exploitation of Vulnerabilities (Zero-Day): As soon as a new vulnerability becomes public, AI agents can create and launch attacks globally—even before a company’s IT team has the chance to apply a security patch.
• Coordinated Mass Attacks (Orchestration): A single cybercriminal can deploy multiple AI agents to attack different parts of an organization simultaneously. Security teams become overwhelmed by hundreds of concurrent alerts, which paralyzes their ability to perform human-led triage.
A paradigm shift in defense... Given this landscape, traditional approaches—relying on signatures and human reaction—have become obsolete. To survive attacks driven by AI agents, companies are being forced to adopt defense systems that also utilize AI agents, capable of isolating networks, blocking traffic, and mitigating threats in a fully automated and autonomous manner.
mundophone









