Attackers now run AI agents. They still come in through the same three doors.

Late in October, six security firms published within a fortnight of each other, and they all described the same thing: attackers handing the hands-on work of an intrusion to AI agents.

CrowdStrike watched one China-linked group target more than 200 organisations in 11 days. Google and Mandiant found three open-source attack frameworks in their incident response cases. Microsoft described North Korean groups using AI to speed up work they already do. Sophos traced a ransomware gang that used AI to test security products before it attacked.

Read them one after another and the obvious headline is that AI has changed attacking. We think that headline is half right, and that the wrong half could lead a security team to spend its next year on the wrong things. Here is the argument, with two animations that play as you scroll to them. At the end we ask where you think we are wrong. The comments are open.

What changed: the clock

The tool in most of these reports is ARTEX. It is not an AI model. It is a harness: software wrapped around a model that gives it a command shell, a shared map of what it has found, and a planner that splits an intrusion into tasks for several agents at once. A Chinese developer published it on GitHub in July 2026 as a penetration-testing tool. By the time the developer closed the code on 8 October, it had more than 12,000 forks.

CrowdStrike's report on a group it calls Vapor Panda puts numbers on what that means. From 17 October the group ran ARTEX, mostly on the DeepSeek model, against more than 200 organisations in at least 14 countries: foreign ministries, US semiconductor and defence firms, and telecommunications providers. One human operator directed many engagements at once. In a single intrusion the planning agents read about 1.4 billion tokens.

The figure that stayed with us came from CrowdStrike's Adam Meyers, speaking to CyberScoop. A skilled attacker at the keyboard sends up to about 40 commands an hour. With ARTEX the group sent more than 1,500.

Expand

The rest of the reports fill in the picture:

• Microsoft tied ARTEX to another group, Storm-0940, which used stolen vendor credentials from a ConnectWise backup service and in several cases went from first contact to privileged cloud access in under three hours.
• Google's threat intelligence team saw ARTEX map the permissions of stolen Azure credentials with sub-second checks, writing and deleting a test file in about a third of a second.
• Cisco Talos took apart an infostealer that hands everything it steals to an AI model, which ranks the victim's accounts by how easy they are to cash in. If one model refuses, it asks the next, up to three.
• Anthropic said an unreleased model of its own built working exploit chains against major browsers and operating systems. As of Chrome 156, Google has patched 62 critical and high-severity flaws.

Underneath all of this is one change: work that took skilled people hours now takes minutes, and one person can point that speed at hundreds of targets at once. Being too small or too dull to be worth an attacker's time used to give some protection. When a target costs the attacker almost nothing, that protection is gone.

What did not change: the doors

Now look at how each of those attackers got in.

The best case study comes from an attacker who made a mistake. SOCRadar found the server of a ransomware operator called n0n left open on the internet, with 1,719 files on it: attack scripts, ransomware source code and an AI coding agent's workspace. By 22 October the operator had spent more than US$7,216 on AI services, and had used AI to write and debug hundreds of scripts. The group went after 23 organisations in 14 countries.

It did not exploit a single software flaw. SOCRadar's Ensar Seker told The Register: "In every documented compromise in this investigation, access relied on weak or stolen credentials." The group scanned for remote desktop services, stuffed stolen passwords into FortiGate VPN login pages, and used cloud keys that had been left exposed. One exposed AWS key let it read 40 storage buckets and then delete data across 12 of them.

The others are the same:

• Vapor Panda leaned on password spraying and credential scanning, against at least 12 organisations beyond the nine where CrowdStrike saw it inside.
• Storm-0940 came in with a vendor's stolen logins.
• GOLD OGRE, the group behind the Aur0ra ransomware, used agentic AI to move from stolen credentials to privileged accounts, Sophos found.
• A suspected China-nexus actor that had Claude Code installed on its attack infrastructure built a custom exploit for a firewall's management interface. That is the most advanced case on the list, and the door was still an unpatched system that faced the internet.
• North Korean groups, Microsoft said, use AI to produce dozens of tailored lures in minutes and to build fake front companies. The target is still a person who opens the message.

Expand

Google's researchers put it plainly: the mechanics of the intrusions remain the same. Attackers still rely on compromised credentials and unpatched systems. Microsoft says AI is a force multiplier for the work these groups already do, and that their operations are still directed by humans. Cisco Talos's incident responders found that in the third quarter phishing opened about a third of their cases, and attacks on public-facing applications another third. They also saw phone calls from fake IT help desks talking staff into installing remote access tools.

So there are three doors: weak or stolen passwords and keys, unpatched systems that face the internet, and people. Every attacker in October's reports came through one of them.

Why "just do the basics" is only half the answer

The comfortable conclusion is that nothing has changed and security teams should keep doing the basics. We think that is wrong, in a way that matters.

The basics have not changed. Their deadline has. A patch cycle that closes an internet-facing flaw in 30 days was designed for an attacker who needed weeks to find it, build an exploit and work through targets by hand. An attacker who can build that exploit in a lab and try it on 200 organisations in 11 days gets nearly the whole month. A password reset that waits for the next quarterly review gives a credential-stuffing tool a quarter's worth of attempts.

Australia's own agencies have said this, in unusually direct language.

ASD's Annual Cyber Threat Report 2025-26 says the ACSC responded to more than 1,500 incidents, up more than 20%, and that extensive compromises rose from 26 to 40. It recorded the successful exploitation of a vulnerability identified in 2008. And it warns that AI is reducing the expertise and effort needed to find and exploit vulnerabilities, likely shortening the time to exploit.

The ACSC's July guidance, Defending against AI-enabled cyber attacks, goes further than most government advice. Its immediate actions include:

• Name one executive who is accountable for the risk from attackers using AI.
• Ask the board to raise its risk appetite for internet-facing services being briefly unavailable, so that patches can go in faster and more often, accepting that a bad patch will sometimes break something.
• Patch every severity, not just critical, on internet-facing services, automatically where a bad patch can be rolled back.
• List every internet-facing service daily and remove the ones nobody needs.
• Practise resetting every user's password and blocking network traffic quickly, as part of business continuity.

Google's Mandiant team adds the credential side: replace long-lived keys with short-lived ones, and treat service accounts, API keys and deployment tokens with the same care as an administrator's login. The exposed AWS key n0n used could list, read and delete across storage buckets from anywhere: exactly the kind Mandiant means.

None of this is new advice. Most of it is in the Essential Eight. What is new is that ASD now tells boards to accept some downtime in exchange for speed. That is a business decision, not a technical one, and we suspect few boards have made it yet.

The defender's opening: these attacks are loud

There is good news in the reports, and it matters as much as the bad.

Today's AI-run attacks are noisy. Wiz says the agents try several approaches in parallel and leave a broad trail. Google found ARTEX far noisier than a competent human operator, working by rapid trial and error, and expects groups that care about staying hidden to avoid the public frameworks. A burst of 1,500 commands in an hour, a stolen key that suddenly tests every permission it has, a test file written and deleted in a third of a second: all of that is visible in the logs.

The catch is that it has to be seen in time, by someone who can tell it apart from your own automation. Many businesses log their cloud management activity and never alert on it. Google's point is that much of this activity uses valid credentials and normal management interfaces, so it looks like work.

Where we think it lands

Our view, in three parts:

• AI is a speed problem, not a new-door problem. Spending on defences against exotic AI attacks while passwords, keys and patching run at human pace is spending in the wrong place.
• The basics need a clock. How fast an internet-facing flaw gets patched, how fast a leaked key gets revoked, how fast everyone's password can be reset: these are now the security measures that count. If you cannot say those times for your own business, that is the first gap.
• The noise is a window, and it will close. Attackers will make these tools quieter. The time to learn what an AI-driven intrusion looks like in your own logs is while it is still loud.

We could be wrong. One of these attackers built a custom exploit, and Anthropic's work shows what models can now find. If AI finds new flaws faster than vendors can fix them, the unpatched-systems door gets so wide that it stops being a basic at all. That is the part of this argument we are least sure of.

Over to you

We would like to hear from people who run security teams, test them, or sit on the boards that decide.

• Would your board accept ASD's trade? Short planned outages on internet-facing services in exchange for patching within days. Has anyone put the question to them?
• What is your real time to patch an internet-facing system, and your time to revoke a leaked cloud key? Not the policy, the last real one.
• Is "AI does not change the doors" too comfortable? If a model can build an exploit chain for a major browser, how long before "unpatched" covers flaws nobody has disclosed yet?
• Can your team tell an ARTEX-style burst from your own automation? If you have caught one, what gave it away?
• Where should the next dollar go: faster patching and short-lived keys, or AI-driven detection to match the attackers' speed?

Sign in below and leave a comment. We read every one, and the best counter-arguments will shape what we write next.