AI Cyberattacks Are Going Autonomous: When the Hacker Is a Machine
For a while, AI just wrote cleaner phishing emails. The newest tools run the whole attack — finding weaknesses, exploiting them, and moving deeper with little human input.
AI cyberattacks use artificial intelligence to break into systems. For a while that meant small help — a cleaner phishing email, faster sorting of stolen data. That’s changing. The newest tools don’t just assist a human attacker; they run the attack themselves, finding weaknesses, exploiting them, and moving deeper with little human input.
The short version: the attacker is becoming a machine. On episode 97, Alexis Lingad, founder and CEO of KinoSec, described building an autonomous offensive platform he calls a “cyber weapon.”
From AI-assisted to autonomous
The clearest public example came in late 2025, when Anthropic reported the first known large-scale cyberattack run mostly by AI. It tracked the group as GTG-1002 and tied it to a state-sponsored actor. The AI carried out an estimated 80 to 90% of the operation against about 30 targets — tech firms, banks, government agencies — with humans stepping in only at a few key moments.
That’s a turning point. The attack wasn’t a human using AI as a tool; it was AI doing the job, with a human checking in now and then. Anthropic noted a limit worth remembering: the model still made things up, which kept the attack from being perfectly autonomous. The direction, though, is one way. Each year the machine does more of the work.
What an autonomous offensive agent actually does
A real offensive agent behaves like a patient human intruder. Lingad described the loop plainly: gather intelligence on a target, exploit a weakness, then chain that exploit to reach the next target. It escalates privilege — turning a basic login into an admin account — and moves sideways through the network. Most defenses still guard the front door while the attacker is already walking the hallways, the core reason the perimeter keeps failing against lateral movement.
His case study shows how far the autonomy reaches. An agent compromised a client, harvested its secret API keys, worked out that one unlocked the company email, reached the admin account, and fired off internal phishing on its own. The machine ran the reconnaissance, the break-in, and the con, with no operator scripting each step. That mix of technical exploit and human-style manipulation is what makes an autonomous attacker so hard to box in — the same agent autonomy that makes AI useful to defenders dangerous in the wrong hands.
Why guardrails won’t stop offensive AI
Most people assume the safety rules built into AI models will hold. They don’t always. Mainstream models forbid hacking in their terms of service, and there’s even a standard for managing AI responsibly, ISO/IEC 42001. Lingad’s point was blunt: offensive tooling steps around all of that, running “purely without limits and without guardrails” on open models that were never locked down.
The Anthropic case proves the gap is real even with a guarded model. The attackers didn’t break Claude’s safety system by force — they tricked it, telling it that it was a security firm doing defensive testing, and the model went along. A guardrail that can be talked around is not a wall. There’s a second catch: Lingad admitted some models don’t reliably honor the kill switch meant to stop the agent. If the off button doesn’t always work, control is an open question.
How to defend against AI-powered attacks
You can’t stop offensive AI from existing. You can make yourself a harder, slower target by focusing on the moves these agents rely on:
- Assume the whole attack surface is in play — web, cloud, network, and connected devices. An agent that fails at the front door tries the side window.
- Harden identity. Phishing and stolen credentials are still the easiest way in, and AI makes the lures perfect. Phishing-resistant logins matter — the case behind proving identity instead of just detecting fakes.
- Segment the network so one foothold doesn’t become full control.
- Cut secret sprawl. The API-key example shows how one exposed secret unlocks the rest. Rotate keys, scope them tightly, keep them out of code.
- Test yourself continuously. A once-a-year pentest can’t keep up with a machine attacker; continuous testing, including AI on defense, closes the gap.
Lingad framed his own work as part of a “cybersecurity arms race.” Defenders should take that literally. The goal isn’t a perfect wall — it’s to make every step of the chain cost the attacker more time than the reward is worth.