Offensive AI is the use of AI models and agents to run parts of a cyberattack, from reconnaissance and exploit development through exfiltration, with humans reduced to picking targets and approving key steps. Until late 2025 that sentence would have been a forecast. It is now a case file. Anthropic’s September 2026 threat intelligence report documents five separate campaigns, state and criminal, in which agents did the operational work, and it follows the November 13, 2025 disclosure of GTG-1002, the first reported AI-orchestrated espionage campaign. If your threat model still assumes a human attacker’s pace and cost structure, both assumptions are stale.
On September 25 we wrote about attacks on AI agents. This is the other direction, attacks by them, and the two problems are converging faster than most security programs are.
AI-powered cyber attacks: what is actually documented
Start with GTG-1002, because it set the template. A Chinese state-sponsored group pointed an agentic harness built on Claude Code at roughly 30 targets across tech, finance, chemical manufacturing and government. Anthropic assesses the AI executed 80 to 90 percent of the campaign, with humans stepping in at only four to six decision points per operation, and at peak the system fired thousands of requests, often several per second. The operators got past the model’s safeguards the old-fashioned way, by lying to it, posing as a security firm running defensive tests and slicing the intrusion into tasks that each looked innocent.
The September 2026 report shows what happened in the year since, and the range of actors matters more than any single number. A state-nexus group whose tradecraft is consistent with Midnight Blizzard ran multi-agent frameworks that noticed when a security product flagged their malware, then autonomously rebuilt and redeployed it. The same operation stole over 300,000 national identity records and hundreds of gigabytes from government and defense targets. A ShinyHunters-affiliated crew let agents do nearly all of the exfiltration work, harvested 1.8 million Android APKs for embedded credentials, and in one intrusion went from a single stolen token to full administrative control in roughly three hours. A Chinese exploit-research operation ran agent swarms that produced more than a dozen possible zero-day findings in a single month and kept thirteen standing collection agents on scheduled jobs. And a lone French hacktivist had an agent develop a working exploit for a previously undocumented WordPress race condition inside a single session, then breached at least 14 of 42 tracked targets, solo.
That last case is the one we keep quoting to clients. The state campaigns prove ceiling. The hacktivist proves floor, one person with an agent harness now operates at a tempo that used to require a team.
The research saw it coming
None of this should have surprised anyone tracking the academic side, which is why we hold that vendor astonishment is mostly marketing. In April 2024, Kang and colleagues showed a GPT-4 agent could exploit 87 percent of a 15-vulnerability one-day CVE set when given the CVE description, while GPT-3.5, open-source models, ZAP and Metasploit all scored zero. The same paper carries the detail defenders should remember, because it locates the fuel. Without the CVE description, success fell to 7 percent. Two months later the same group introduced HPTSA, a planning agent that launches specialist subagents and exploits real zero-day vulnerabilities, up to 4.3 times more effectively than single-agent frameworks on a 14-vulnerability benchmark.
Read those two results against the campaign reporting and the mechanism is obvious. Multi-agent decomposition, one planner dispatching parallel subagents with persistent memory, is exactly the architecture Anthropic describes in the exploit-foundry and espionage cases. The lab result became the field manual in about eighteen months.
What an agentic AI attack changes for defenders
Three things, and none of them is “the attacks are smarter”. First, speed. Recon-to-exploit intervals of minutes, token-to-admin in three hours, breach-to-bulk-theft in hours. Incident response plans calibrated in days now start behind. Second, economics. When the marginal cost of an intrusion collapses, targets that were never worth a human operator’s week become worth an agent’s afternoon, which pulls mid-market companies into campaigns that used to stop at the Fortune 500. Third, your AI credentials became a target class. Across the criminal cases, stolen AI API keys served three purposes at once, loot to resell, compute to run attack workloads at the victim’s expense, and cover, since the activity attributes to the legitimate key owner. We made the structural argument about ungoverned machine credentials in our non-human identity post, and offensive AI just raised the price of ignoring it.
There is also a detection consequence worth stating plainly, without pretending a query solves it. Machine-speed telemetry is the tell. Sustained multiple-requests-per-second session cadence, scanning that resumes on a scheduler’s rhythm rather than a human’s workday, escalation chains that complete before a ticket would even be triaged. Velocity itself is becoming a signal, and behavioral baselines are the honest way to see it, which is the ground our UEBA and detection engineering post covers.
Mitigation: how to defend against offensive AI
The controls are unglamorous, which is good news, because it means they are proven. Treat AI API keys and agent integrations with the same seriousness as production credentials, vaulted, scoped, rotated and monitored, which is Anthropic’s own recommendation verbatim, and buy AI access only through authorized channels. Kill standing privilege where you can, because a three-hour token-to-admin escalation is a case study in what standing privilege costs, and put phishing-resistant MFA in front of everything that matters. Patch internet-facing services on a cadence measured in days, since the 87 percent versus 7 percent gap means a published CVE description is operational fuel the moment it goes live. Assume compressed timelines in your incident response planning and rehearse against them. And match tempo with tempo, because a human-speed SOC reviewing machine-speed intrusions loses on arithmetic alone. That pairing of agentic attack awareness with agentic defense is the core of our LLM and agent security work, and it is also where the market is moving, with attack-surface and detection products adding agentic-threat features across the board. Evaluate them as options, not answers.
One caution in the other direction. The documented cases still show humans choosing targets, approving pivots and handling the judgment calls, and the agents still hallucinate, stall and need supervision. Offensive AI in 2026 is a force multiplier, not an autonomous adversary, and defenders who panic toward exotic countermeasures while leaving credentials unrotated have read the story backwards.
Frequently asked questions
Can an AI carry out a cyberattack on its own? Not end to end. The best documented case, GTG-1002, reached 80 to 90 percent autonomy with humans at four to six decision points. That is a profound shift in labor and speed, but targeting, strategy and judgment remained human throughout every campaign reported so far.
What are real examples of AI-powered cyber attacks? GTG-1002’s espionage campaign against roughly 30 organizations in November 2025, and the five campaigns in Anthropic’s September 2026 report, including autonomous malware rebuilding and agent-run exfiltration. In the lab, agents exploited 87 percent of a one-day CVE benchmark. All are linked above with primary sources.
Do these attacks only involve one AI vendor? No. Reporting to date is dominated by Anthropic because it publishes disruption reports on its own platform’s misuse. The technique itself, an orchestration harness wrapped around a capable model, is vendor-neutral, and the academic results were demonstrated on other vendors’ models.
What should a security team do first? Inventory and lock down AI API keys and agent integrations as production credentials, then pressure-test how fast your detection and response actually runs against an attacker operating in hours. Those two moves address the credential-theft pattern and the speed problem, which are the two documented changes.
Bottom line
Offensive AI is documented, not hypothetical, and its two real effects are speed and cheaper intrusions, not magic. Harden the boring things, credentials, privilege, patching, response tempo, and treat your AI keys as the production secrets they now are. The attacker’s harness does not care whether you believed the hype. It cares whether your token still works.