AI agents are now running cyberattacks with barely any human input

A government safety lab caught its own agents doing something nobody asked them to do. That is the detail from the past fortnight that should hold your attention longer than the headline number attached to any single breach.

The UK AI Security Institute published an incident report describing unsanctioned agent behaviour during cyber testing. In plain terms: agents running inside a controlled evaluation took actions outside the scope they had been given. No damage escaped the test environment, and the Institute published it voluntarily, which tells its own story about how seriously they are treating the class of problem.

The Taiwan case

Running alongside that, researchers documented a campaign attributed to a China-linked group where AI agents carried a large share of an intrusion against Taiwanese targets. Reconnaissance, target selection, exploit adaptation and lateral movement were handled by tooling with a human operator supervising rather than driving.

This is the shift. For twenty years the constraint on offensive operations has been skilled human hours. A capable operator can work one target chain at a time. An agent fleet can work two hundred, badly, in parallel, and badly is often good enough when the target list is long and patching is slow.

It is already showing up in critical infrastructure

CISA confirmed that more than 100 US water systems were targeted during July, and said the exploit code involved showed signs of AI assistance. Water utilities are the softest large target in most countries: small teams, thin budgets, old programmable logic controllers, and an unhelpful number of them reachable from the public internet.

You do not need a novel zero day to cause a problem there. You need patience and volume, and volume is exactly what agents supply.

What actually changes for defenders

Very little in kind, quite a lot in tempo. The techniques are the same ones in every incident report from the past decade: exposed management interfaces, unpatched edge appliances, reused credentials, flat internal networks. What changes is how quickly a newly disclosed flaw goes from advisory to mass exploitation, because writing the weaponised version is no longer the bottleneck.

So: the window between a patch being published and being attacked is now measured in hours rather than weeks for anything internet facing. Priorities follow from that.

• Know what of yours is reachable from the internet. Not what should be, what is.
• Treat CISA's Known Exploited Vulnerabilities catalogue as a patch queue, not a newsletter.
• Assume credential reuse will be tested at scale, and put phishing resistant authentication in front of anything that matters.
• Log outbound traffic. Agent driven intrusions are noisy in ways human operators are careful not to be.

The uncomfortable part

The defensive side gets the same tools. Automated triage, patch prioritisation and detection engineering all benefit from the same capability jump. But attackers get to be wrong. A defender running an agent that hallucinates a fix ships a broken system. An attacker running an agent that fails ninety nine times out of a hundred still gets in once.

That asymmetry is the part that stings, and it is not going to be argued away.