AI Agents Increasingly Assist Cyberattacks, but Fully Autonomous Operations Remain Limited

An expert-authored International AI Safety report says AI agents are increasingly being used to support multiple stages of cyberattacks, with notable gains over the past year in vulnerability discovery and malicious code generation. The report cites results from DARPA’s AI Cyber Challenge where finalist systems autonomously identified 77% of synthetic vulnerabilities, and notes criminal use of AI tooling (e.g., HexStrike AI) to accelerate exploitation soon after public vulnerability disclosures; it also describes a growing market for “weaponized” models that can generate ransomware and data-stealing code at low monthly cost.

Despite these advances, the report assesses that fully autonomous, end-to-end, multi-stage attacks are not yet commonly observed because current AI systems struggle to reliably execute long, complex sequences without human oversight, including poor error recovery and irrelevant command execution. Separately, CSO Online highlights risk-management concerns that large numbers of deployed AI agents could “go rogue,” underscoring governance and control challenges as organizations operationalize agentic AI at scale.