When AI becomes the attacker: cybercrime enters the Agentic era

Artificial intelligence has been part of the cyber threat landscape for several years. Until recently, however, attackers mainly used it as a supporting tool: to translate phishing messages, generate malicious code, collect information about targets or improve social-engineering campaigns.

That boundary is beginning to disappear.

Recent incidents show AI systems taking a much more active role. Instead of merely advising an attacker, AI agents can now execute commands, troubleshoot failed attempts, rebuild infrastructure and move from one stage of an attack to the next. In some cases, the human operator provides little more than the objective while the AI performs most of the technical work.

The result is not necessarily an entirely new form of cyberattack. The vulnerabilities, stolen credentials and malware techniques are often familiar. What has changed is the speed, accessibility and scalability with which attackers can combine them.

From AI-assisted to AI-operated attacks

There is an important difference between an attack supported by AI and one operated by an AI agent.

In an AI-assisted attack, a human remains responsible for most operational decisions. The AI might:

• write or modify malware;
• generate phishing emails in several languages;
• research vulnerabilities;
• analyze stolen information;
• create fake identities;
• produce voice, image or video deepfakes.

An AI-operated attack goes further. An agent can interact with systems, execute commands, interpret results and adjust its actions. Instead of providing a code example, it can deploy the code, identify why it failed, modify it and try again.

Several recent cases demonstrate how quickly this transition is taking place.

Six minutes to rebuild a botnet

In 2026, Trend Micro researchers analyzed more than 200 Gemini CLI sessions linked to a Russian-speaking threat actor known as “bandcampro”. The attacker used Google’s terminal-based AI agent to manage infrastructure controlling eight compromised machines in a dental clinic.

The human operator provided instructions in Russian, while the AI handled the technical execution: writing server code, deploying it to a virtual private server, configuring Cloudflare tunnels and resolving connectivity issues.

When the command-and-control infrastructure became unstable, the attacker asked the AI to follow a short migration guide. Gemini prepared the files, deployed a new server and restored the C2 setup in about six minutes.

Researchers found that the human contributed only 11% of the session text. The AI performed nearly all coding, system commands and most troubleshooting.

The botnet itself was simple, with its logic contained in just a few small files. This simplicity highlights the key risk: reusable instruction sets can package criminal know-how. If infrastructure is disrupted, attackers can quickly recreate it elsewhere using AI, making operations more portable, disposable and easier to replicate.

Ransomware that corrects its own mistakes

Another major step was documented by Sysdig in July 2026. Researchers described JADEPUFFER as one of the first end-to-end agentic ransomware operations.

The attack exploited a known vulnerability in an internet-facing Langflow server, then searched for API keys, cloud credentials and other sensitive data. It moved laterally to a production system running MySQL and Nacos, created an administrator account and encrypted over 1,300 configuration records before leaving a ransom note.

A key insight was how the system handled failure. When a login attempt failed, the agent analyzed the issue and corrected its approach within 31 seconds, continuing the attack without human intervention.

The operation did not rely on new exploits, but combined:

• known vulnerabilities;
• internet-exposed services;
• default credentials;
• insufficiently protected administrative interfaces;
• publicly documented attack methods.

The AI’s role was to connect these weaknesses into a coherent attack chain and execute it at machine speed.

“Vibe hacking” and AI-driven extortion

Anthropic has documented similar misuse of its Claude models. In one case, a cybercriminal used Claude Code to support a data-theft and extortion campaign targeting at least 17 organizations, including healthcare providers and government bodies.

The AI was used to automate reconnaissance, harvest credentials, penetrate networks and identify valuable data. It also helped determine ransom amounts based on victims’ financial profiles and generated tailored extortion messages, with some demands exceeding USD 500,000.

Anthropic refers to this approach as “vibe hacking”: the attacker defines the objective while the AI carries out much of the technical work. The same report also noted that low-skilled actors are using AI to create and sell ransomware variants, lowering the barrier to entry.

These cases highlight a key shift: attackers no longer need deep expertise across every stage of an operation, as AI can provide much of the required technical capability.

What actually changes for defenders?

The most important development is not that AI has invented completely new attack techniques. In many documented cases, attackers still rely on unpatched systems, excessive privileges, weak credentials and exposed services.

AI changes the operational economics of exploiting those weaknesses.

1. Attack cycles become dramatically shorter

An AI agent does not need to pause, consult another specialist or manually rewrite a failed script. It can interpret an error and generate a new attempt within seconds.

The time between initial compromise and material damage may therefore shrink from days or hours to minutes.

2. The technical entry barrier falls

Skills that once required malware developers, infrastructure specialists and experienced operators can increasingly be delivered through AI agents and reusable instruction files.

This does not turn every beginner into an advanced threat actor. It does, however, allow less capable attackers to attempt operations that would previously have been beyond their reach.

3. Attacks become easier to scale

AI can generate thousands of variations of messages, scripts, domains and payloads. Static indicators such as a known filename, hash or URL may become less useful when an attacker can regenerate an artefact on demand.

Behavioral patterns become more important than individual indicators.

4. Attackers can adapt during the intrusion

Agentic systems can observe defensive responses and modify their approach. Blocking one script or server may no longer end the operation if the AI can automatically create an alternative.

5. SOC teams face an even greater speed imbalance

Security teams already struggle with high alert volumes, fragmented information and time-consuming manual investigations. When attackers operate at machine speed, human-only triage and analysis become increasingly difficult to sustain.

Defending against AI requires more than another AI feature

Organizations should not respond by simply adding an isolated AI tool to their existing security stack.

The fundamentals remain essential:

• patch internet-facing systems quickly;
• remove default credentials;
• apply phishing-resistant multifactor authentication;
• restrict administrative interfaces;
• segment networks and limit lateral movement;
• protect cloud credentials and API keys;
• verify sensitive financial instructions through a separate channel;
• detect behavior rather than relying exclusively on static indicators.

But organizations must also reduce the time between detection, investigation and decision-making.

When malicious infrastructure can be rebuilt in minutes and attack steps can be retried in seconds, security teams need a faster way to connect alerts with asset information, threat intelligence, user activity and historical context.

Fighting AI-accelerated attacks with PULZARIS Analyst AI

PULZARIS Analyst AI was developed to help SOC teams manage precisely this challenge.

It adds an AI-supported investigation layer to security operations. When an alert is received, the solution can analyze the available evidence, correlate related entities, enrich the incident with threat-intelligence information and assess its potential impact.

The analyst receives a structured investigation brief containing:

• the likely verdict and confidence level;
• relevant users, systems and entities;
• contextual and threat-intelligence findings;
• the possible scope of the incident;
• prioritization based on risk and asset criticality;
• recommended investigation and response actions.

The objective is not to remove the human analyst from the process. PULZARIS follows a human-in-the-loop approach: the AI accelerates evidence collection and analysis, while the analyst remains responsible for validation and final decisions.

In our own SOC environment, PULZARIS Analyst AI has already supported the analysis of nearly 3,000 incidents, with an average analysis time of approximately 2.5 minutes per incident.

AI-enabled attackers are beginning to compress complete attack cycles into minutes. Defenders therefore need to use AI not merely as an additional interface, but as an operational capability that helps them investigate, prioritize and respond at comparable speed.

The question is no longer whether cybercriminals will use artificial intelligence. They already do.

The more important question is whether security teams will be able to act quickly enough when the next AI-supported attack reaches their environment.