Agentic AI Enables Machine-Speed Abuse of Credentials and Attack Infrastructure Automation

Security leaders are warning that agentic AI is shifting the threat model by turning authenticated, permissioned access into a primary attack path. Symantec argues that controls designed around human behavior and pace (e.g., static credentials, overprivileged access, and human-scale monitoring) are poorly suited to autonomous agents that can operate at machine speed, rapidly probing APIs and systems and using existing permissions to move laterally. The post highlights proof-of-concept and prior incidents where agent behavior can be manipulated to expose secrets (e.g., coercing a voice agent to reveal an API key), framing an agent’s own decision logic as an exploitable attack surface that drives the need for redesigned authorization and tighter identity/access models.

Microsoft threat intelligence reporting, echoed in an interview with The Register, describes threat actors using AI agents to automate “janitorial” tasks that materially increase operational tempo—especially reconnaissance and attack infrastructure setup/management. Sherrod DeGrippo (Microsoft) said autonomous agents can be tasked to scan target netblocks, inventory compromised environments, and accelerate standing up infrastructure, and Microsoft has observed North Korea-linked Coral Sleet leveraging development platforms to quickly create and manage infrastructure supporting campaigns (including activity associated with the fake IT worker scam). Together, the reporting indicates agentic AI is already being applied to make attacks better, bigger, and faster, with defenders needing to account for automated, high-velocity activity that may originate from valid credentials and legitimate tooling.