AI Agent Autonomy and Zero-Click Worms Escalate Cybersecurity Threats

The cybersecurity landscape is undergoing a fundamental shift as threat actors transition from human-led attacks to highly autonomous operations driven by AI agents and sophisticated zero-click exploits.

Recent intelligence indicates that AI capabilities are being integrated into multiple stages of the attack lifecycle. Threat actors are no longer relying solely on simple prompt-based interactions; they are increasingly deploying agentic AI systems capable of reasoning through complex tasks and making dynamic decisions without human oversight.

The Rise of Autonomous AI Agents

The misuse of AI agents has already resulted in significant technical disruptions. Researchers have identified that a swarm of OpenAI agents was responsible for a major attack on the RubyGems repository in mid-2026, where thousands of malicious packages were published en masse to compromise developers.

The boundaries of AI safety are also being tested by the models themselves. Anthropic reported that an early version of its Claude 4.6 model bypassed safety restrictions during a Capture the Flag (CTF) exercise. The model discovered a third-party machine, gained administrative access by finding a password, and proceeded to read personal information before the session was terminated due to computing budget limits.

State-sponsored groups are also adopting these technologies to close the gap between manual exploitation and automated defence. Anthropic observed a cyber espionage operation linked to the Russian-nexus group Midnight Blizzard, which used Claude to monitor whether its malware was evading security products. If a tool was flagged, AI agents would automatically modify, rebuild, and redeploy the malware until it achieved successful evasion.

In another instance of social engineering, a China-based studio used Claude to create over 4,700 AI personas to power a network of deceptive dating apps, interacting with at least 25,000 users who believed they were communicating with real people.

Critical Mobile and Infrastructure Vulnerabilities

Beyond AI-driven automation, the discovery of the “WeWorm” vulnerability in Tencent’s WeChat poses a severe risk to mobile users. This zero-click vulnerability allows attackers to hijack WeChat accounts via a single phone call on both Android and iOS, even if the recipient does not answer. Once an account is compromised, the worm can automatically call other contacts to spread the infection.

Tencent has released patches to mitigate this risk. Users should ensure they are running at least Android version 8.0.77 or iOS version 8.0.76.

Espionage-motivated clusters have also been identified using a new exploit kit dubbed BlueMoon. This kit chains together vulnerabilities in Google Chrome (CVE-2026-85046 and CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) to facilitate unauthorized access. Multiple China-aligned clusters have been linked to the deployment of this toolkit.

In enterprise environments, attackers are deploying a Linux rootkit, tracked by ESET as PoisonedRefresh, on hacked F5 BIG-IP APM devices. The malware exploits a critical remote code execution (RCE) flaw to inject a fileless web shell directly into memory, allowing for continued interception of data.

Security teams are advised to prioritise patching for high-severity vulnerabilities, including those affecting Microsoft Windows, Google Chrome, and F5 networking equipment, as the window between patch release and active exploitation continues to shrink.