Agentic AI widens cyber risk as attackers speed up

Security researchers and industry executives are warning that agentic artificial intelligence is reshaping cyber risk on both sides of the attack-defence divide. Recent incidents and legal disputes are exposing governance gaps across software development pipelines and cloud environments.

A string of disclosures in recent weeks has shown how attackers already use AI systems to compress attack timelines, automate reconnaissance, and exploit new classes of vulnerability, while defenders struggle to oversee autonomous tooling and AI-generated threat intelligence.

In one case, a newly documented technique showed how adversaries can misuse coding assistants such as Claude Code and seemingly legitimate repositories to compromise developer machines without breaching conventional perimeter controls. The method relies on persuading an AI agent to trust and execute content from a malicious source within a development workflow.

Justin Beals, Chief Executive Officer and Founder of Strike Graph, said the incident exposed a structural oversight in how many organisations deploy AI inside software pipelines.

"This attack is clever because it doesn't need to break anything. It just needs your AI agent to trust the wrong repository. That's the real lesson here. We've handed autonomous agents access to our development pipelines and supply chains without asking how we govern what they're allowed to pull in and execute. Trust is not a security control. Verification is. Until organizations start treating their AI toolchain as a compliance surface, with actual controls and evidence, attackers will keep finding new ways to ride the tools we already trust," Beals said.

The governance challenge is not limited to development environments. Legal action involving streaming service MeetingTV has drawn attention to how threat labels can spread across commercial security tools and block legitimate businesses.

The case has also raised concerns that AI enrichment of threat intelligence could magnify the impact of classification errors. Security products often share indicators, allowing a single designation to spread rapidly and become difficult to reverse.

Gidi Cohen, Chief Executive Officer and Co-Founder of Bonfy.AI, said the dispute underscored the need for accountability and human oversight when AI influences threat assessments.

"The MeetingTV lawsuit should be a wake-up call: when threat intelligence is generated or enriched by AI, the stakes are no longer just technical accuracy. They include business continuity and reputational harm for real companies caught in the blast radius. This case highlights three responsibilities that security leaders and researchers can't ignore.

First, AI-assisted analysis does not remove the obligation to validate findings with human judgment, especially when those findings can lead to long-term blocking of a legitimate service. 'Protected speech' in research doesn't absolve us from doing the hard work of verification.

Second, the industry needs a clearer accountability model for distributed threat intelligence. Once a label is published, it is replicated across hundreds of feeds and controls, yet there is still no standard process, or SLA, for correcting mistakes and propagating those fixes downstream.

Third, we have to treat false positives in AI-era threat intelligence as real incidents, not minor collateral damage. For a SaaS business, being silently tagged as malicious can have the same practical impact as a sustained DDoS attack or a major outage, and our governance models should reflect that.

Regardless of the legal outcome, the lesson is straightforward: if we use AI in security research, we must pair it with rigorous review, transparent methodology, and fast, industry-wide remediation when we get it wrong. Without that, AI doesn't just help us find threats-it risks becoming one," Cohen said.

Researchers are also tracking how attackers are experimenting with AI to automate entire operations. A proof-of-concept framework dubbed "JadePuffer" demonstrates that AI agents can stitch together tasks such as target selection, database interaction, encryption, and ransom handling.

The project does not appear to underpin an active ransomware campaign. Analysts say it nevertheless shows how much manual effort AI could remove from criminal workflows.

John Watters, Chairman and Chief Executive Officer of iCOUNTER Cybersecurity Intelligence, said the emerging tooling points to a shift in operational tempo rather than exotic new malware.

"The most important takeaway from stories like this is not whether a specific AI-powered ransomware framework achieves widespread adoption, but what it signals about the direction of cybercrime operations. Threat actors have spent years automating individual stages of the attack lifecycle. AI has the potential to connect those stages, accelerating reconnaissance, target selection, and execution in ways that significantly compress attacker timelines.

As cybercriminal operations become more automated, defenders face a growing mismatch between machine-speed attacks and human-speed decision-making. Security teams can no longer rely solely on detecting malicious activity once it reaches their environment. They need operational intelligence that provides visibility into emerging adversary behaviors, infrastructure, and campaign activity before attacks reach execution.

This is ultimately an intelligence challenge as much as a security challenge. Organisations that can identify shifts in attacker tradecraft early and adapt their defensive priorities accordingly will be far better positioned than those waiting to respond after automation has already increased the scale and speed of an adversary's operations," Watters said.

Field reports indicate that similar automation is already at work in live intrusions. Sygnia researchers recently documented a single threat actor using an agentic AI system to compress what would normally be a multi-week cloud breach into about 72 hours.

The intruder did not rely on zero-day exploits. Instead, the AI agent orchestrated reconnaissance, credential abuse, and lateral movement with established tools and public techniques, executing them in parallel at machine speed.

Roman Sannikov, Vice President of Threat Intelligence at iCOUNTER, said this dynamic changes assumptions about how long defenders have to respond.

"This is the strategic inflection point we've been tracking: AI isn't giving attackers new capabilities, it's eliminating the human bottlenecks that used to slow them down. Reconnaissance, credential abuse, and lateral movement running in parallel rather than sequentially means the operational tempo of an intrusion is no longer bound by how fast a human operator can work.

That changes the defender's decision timeline at the board level, not just the SOC level. When a cloud compromise that used to take weeks can now happen in 72 hours, the assumption that there's time to detect, investigate, and respond before meaningful damage occurs no longer holds. Organisations need external visibility into adversary infrastructure and campaign activity before an intrusion reaches this speed, not after.

The technique here wasn't novel, which is what makes it significant. Threat actors don't need new tools when AI lets them run the tools they already have faster than any defender can react manually. Operational resilience now depends on intelligence-led defence that can match that tempo, not just harden the perimeter and wait," Sannikov said.

The GitHub ecosystem has provided another warning about how AI agents can expand the attack surface. Security researchers recently disclosed a critical prompt-injection flaw in GitHub Agentic Workflows that allowed an unauthenticated user to leak private repository data by submitting a crafted issue.

The affected workflow held broad read access across repositories and treated user-submitted text as executable instructions rather than untrusted input. The attack required no credentials and resulted in sensitive content being posted in public channels.

Cohen said the incident illustrates a broader risk across production systems that embed AI agents and grant them extensive permissions.

"This disclosure shows that AI-powered automation is now a real exfiltration risk, not a theoretical one, and leaders need to treat it with the same seriousness as SQL injection. A single crafted GitHub issue was enough to trick an AI workflow into pulling content from private repositories and posting the results publicly because the agent had broad read access and treated user text as executable instructions rather than untrusted input.

The deeper lesson is structural: an AI agent's context window is effectively its attack surface, and anything it reads, such as issues, pull requests, comments, files, or tickets, can be weaponized if the system does not enforce clear boundaries between data and commands.

This is bigger than GitHub. Any agentic AI wired into production systems, given powerful credentials, and controlled through natural language creates a new, systemic vulnerability class. Executives should assume prompt injection is inevitable and focus on governance: enforce least-privilege access for agents, strictly constrain what they can post or expose publicly, and require sanitization or filtering of all user-controlled content before it reaches AI workflows.

The questions leaders should now be asking their teams are simple and pointed: where are AI agents plugged into our workflows, what can they read and write, and what stops a single malicious ticket, issue, or chat message from triggering a large-scale leak? Framed well, this becomes a responsible automation stance: we will move fast with AI, but not by blindly expanding our attack surface in ways we do not understand," Cohen said.