AI-Driven Agents Accelerate the Speed and Scale of Cyberattacks

AI is increasing the volume and velocity of cyberattacks, allowing threat actors to execute operations at a pace that challenges traditional human-led defences. While the fundamental objectives of attackers—reconnaissance, establishing a foothold, and lateral movement—remain consistent, the integration of artificial intelligence is fundamentally altering the speed and scale of these campaigns.

Security researchers have observed a shift toward “agentic” threats, where Large Language Model (LLM) agents automate entire stages of an intrusion. In the JadePuffer ransomware campaign disclosed in July 2026, an LLM-driven agent was used to automate most of the intrusion chain. The attack initially exploited CVE-2025-3248, a missing-authentication flaw in the Langflow open-source framework, to loot cloud credentials and API keys before proceeding to database encryption.

Even in high-profile espionage cases, such as the GTG-1002 campaign in September 2025, AI has acted as an enabler for reconnaissance and data exfiltration, even when conventional techniques provided the foundation.

The Emergence of Agentic APT

This evolution has led to the concept of the “agentic APT,” a threat where a single individual can leverage AI to perform the roles of a multi-disciplinary specialist team. Nazar Tymoshyk, CEO of UnderDefense, suggests that an agent can combine the skills of a database administrator, a developer, and a DevOps specialist into a single role. This capability means that complex, coordinated attacks are no longer the exclusive domain of nation-state actors.

Attackers are increasingly favouring models with fewer content restrictions, such as the Chinese GLM and Kimi 3 models, to assist in reconnaissance and code generation. This trend aligns with broader concerns regarding new Chinese AI models and their security implications. However, experts at Checkmarx note that attributing specific attacks to particular models remains difficult due to a lack of direct evidence from threat actor infrastructure.

Compressed Detection Windows

The use of AI is also significantly reducing “dwell time”—the period an attacker remains undetected within a network. Traditionally, defenders used this window to identify and neutralise threats. Crystal Morin, a senior cybersecurity strategist at Sysdig, notes that AI-assisted attackers are showing signs of shortening these windows, making detection much harder.

The economics of cybercrime are also shifting. Rather than building bespoke playbooks for every campaign, agentic actors can compose plans live against new targets, with the primary cost being the inference budget. This reduction in operational costs is expected to drive an increase in the number of attack attempts globally. The increasing complexity of these automated methods follows the rise of polymorphic supply chain poisoning attacks.

Automated Defence Requirements

Defenders can no longer rely on traditional, human-speed patch cadences. Nathan Smolenski, CISO at Qualys, warns that frontier AI tools are shrinking the window between vulnerability disclosure and exploitation to near zero. This acceleration means that the standard 30-day patch cycle is becoming obsolete.

To counter these threats, organisations must move toward automated defences and implement agentic workflows with human-in-the-loop guardrails. This approach allows security teams to automate lower-level triage while reserving human expertise for high-level risk decisions and the governance of their own security agents.