One operator, the output of a team
In early October, the threat intelligence firm SOCRadar published research on CyberXero, a Russian-speaking, financially motivated initial access broker. Its main workstation held definitions for up to 51 specialised AI coding agents, each with a narrow job: scanning, chaining exploits, reconnaissance, lateral movement, post-exploitation (SOCRadar).
In one automated run, the operation scanned 4,708 targets, obtained 429 website administrator panels and planted 32 web shells in 61 seconds (Cloud Security Alliance research note). In parallel, a hand-picked campaign went after seven Ukrainian energy and utility organisations, including the national electricity transmission operator. Researchers confirmed data theft at four of them and records on more than 628,000 Ukrainians (Security Affairs).
One automated run, 61 seconds
One person. The throughput of a team.
The trend behind the headline
CyberXero is a vivid case, not an outlier. In June, Anthropic published an analysis of 832 accounts it banned for malicious cyber activity between March 2025 and March 2026, mapping 13,873 observed actions onto the MITRE ATT&CK framework (Anthropic).
33%
of AI-enabled actors rated medium risk or higher, first half of the year
56%
the same share six months later
80%
of actors in the dataset used an agentic coding tool
Three findings matter for anyone running security.
- Risk is rising fast. The share of actors rated medium risk or higher went from 33% to 56% between the first and second half of the year. The growth was concentrated in the most harmful activities: lateral movement, credential dumping, web shells.
- Skill no longer predicts danger. Assessed technical skill, choice of interface and number of techniques used were all weak predictors of how much an actor gained from AI. What set the most dangerous actors apart was orchestration: the scaffolding that lets an AI agent chain attack stages together with little human input.
- Our shared vocabulary has a gap. The state-linked espionage campaign Anthropic disrupted in November 2025 scored the maximum on its risk scale while using a number of techniques comparable to medium-risk actors. Autonomous kill-chain orchestration has no identifier in ATT&CK yet.
Where attackers use AI, and where it is moving
- 01Build tooling and malware
- 02Initial access
- 03Discovery inside the network
- 04Credential access
- 05Lateral movement
- 06Exfiltration
Agents are no longer the exotic option. They are the default.
Keep it in proportion
Not everyone accepts the most dramatic reading. Independent researchers questioned how autonomous, and how successful, the 2025 espionage campaign really was (The Batch, DeepLearning.AI). The UK's National Cyber Security Centre says it has not yet seen fully autonomous attacks across the complete intrusion lifecycle, though it expects them (CSO Online).
The fair reading: AI is not yet a push-button cyber weapon. What it has already done is collapse the labour cost of offence. Work that used to need a skilled team now needs one operator and a well-built agent harness.
Four things that change for defenders
- Reconnaissance is free, so visibility is risk. If an agent can scan thousands of targets in a minute, every internet-facing service is probed continuously, not occasionally. Exposure management stops being an annual audit and becomes a permanent posture. See our previous article, Off the map.
- Speed beats schedules. Exploiting vulnerabilities is now the most common way breaches start, according to the 2026 Verizon DBIR (watchTowr). Defensive processes measured in weeks lose to offence measured in minutes.
- Adversary sophistication is no longer a useful filter. Threat models that ask "who could realistically do this?" and answer by skill level need revisiting. The barrier is now intent plus a harness.
- Your own agents are new attack surface. Investigators could reconstruct CyberXero's campaign because the operator's own agent logs were exposed. The same is true in reverse: your agents' session logs, tokens and tool permissions hold your operational detail. The NCSC published interim guidance in August on managing the cyber risk of agentic AI (Cloudswitched summary). In the Middle East, Deloitte found only 21% of organisations have mature governance frameworks for autonomous AI (Communicate).
What to do this quarter
- Shrink what can be found. Inventory your external exposure, remove what does not need to be reachable, and hide what must stay connected.
- Detect behaviour, not artefacts. AI-generated tooling changes from one run to the next, so signatures age quickly. Hunt for what follows initial access: account discovery, credential access, lateral movement.
- Bring AI to defence at matching speed. Use it for triage, correlation and response playbooks. The UK is planning a national "Cyber Shield" of defensive AI agents for exactly this reason (CSO Online).
- Govern your agents like privileged users. Least privilege, short-lived credentials, protected and monitored logs, and a human sign-off on any consequential action.
- Rehearse a compressed bad day. Run your incident exercise on the assumption that discovery, compromise and lateral movement happen in hours, not weeks.
How Beyond approaches it
Adopt AI and defend against it, at the same time
Beyond helps governments and enterprises do both: AI deployments designed with governance built in from day one, and architectures where the most critical systems are not discoverable from the internet in the first place.
In an age of automated reconnaissance, the system an agent cannot see is the one it cannot attack.