Loading story…
Cato Networks reported that an AI-enabled attack stack autonomously compromised a simulated enterprise Active Directory environment from an external foothold to Domain Administrator privileges, with the fastest run completing in about 40 minutes from a single high-level prompt. In six lab scenarios, the system reportedly carried out reconnaissance, exploitation, internal discovery, privilege escalation, lateral movement, and exfiltration while requiring minimal human direction, showing how agentic workflows can execute full attack chains rather than isolated tasks.
Reporting on the research said the decisive factor was not the frontier model alone but the surrounding "harness"—the orchestration layer that constrains the model, connects it to tools, and supplies operational context. Cato paired OpenAI models including GPT-5.5 and GPT-5.5-Cyber with MCP-enabled tooling and found that this stack drove performance more than the base model itself, reinforcing a broader industry view that harness engineering, benchmarking, and human oversight are becoming central to both AI-powered cyber defense and the automation of known offensive techniques.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Cato Networks reported a controlled enterprise lab study in which an agentic attack stack autonomously executed an end-to-end compromise of an Active Directory environment. In its fastest successful run, the system reportedly progressed from external access to Domain Administrator privileges in about 40 minutes from a single high-level prompt.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
reversinglabs.com
Open sourceinfosecurity-magazine.com
Open sourcecatonetworks.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Resecurity warned that autonomous AI offensive security agents are turning penetration testing from scripted automation into adaptive, multi-agent operations that can perform reconnaissance, map attack surfaces, identify vulnerabilities, validate exploits, and generate reports with minimal human input. The report highlighted tools including **T3MP3ST**, **Strix**, **CyberStrike**, **XBOW**, **PentAGI**, **PentestGPT**, **Nebula**, **PentesterFlow**, **Hackian**, and specialized offensive-security LLMs such as `CyberStrike-OffSec-35B`, describing them as increasingly capable dual-use systems. Security researchers said the same capabilities are lowering the barrier for financially motivated criminals and state-backed actors, making AI-assisted offensive operations practical rather than theoretical. The reporting cited examples including **FortiBleed**, **JadePuffer**, **GTG-2002**, **GTG-5004**, and the Claude Desktop “double agent” demonstration, and urged organizations to respond with a hybrid defense model built on human oversight, behavioral detection, network segmentation, continuous exposure validation, governance of AI tooling, and rapid patching of high-value flaws.
Jul 31, 2026
Recent research and evaluations indicate **AI agents are becoming capable of finding and exploiting vulnerabilities with high success rates using standard offensive tooling**, lowering the barrier to semi-autonomous attacks. A study by Irregular in collaboration with **Wiz** reported that leading models (Anthropic *Claude Sonnet 4.5*, OpenAI *GPT-5*, and Google *Gemini 2.5 Pro*) solved **9 of 10** web security CTF challenges modeled on real-world incident patterns, including **authentication bypass**, **exposed secrets**, **stored XSS**, and **SSRF** (including **AWS Instance Metadata Service (IMDS)**-style SSRF). Researchers noted that even when success required multiple stochastic runs, the **low per-run cost (~$2) and limited repeats** could make exploitation practical without necessarily triggering monitoring, with most challenge successes costing **under $1** and multi-run cases totaling roughly **$1–$10**. Separate evaluation results highlighted by Bruce Schneier, citing an Anthropic post, describe *Claude Sonnet 4.5* successfully executing **multistage attacks across simulated networks** using only **standard open-source tools** rather than custom cyber toolkits, including exfiltrating all simulated PII in a high-fidelity **Equifax-breach** simulation by recognizing and exploiting a known **publicized CVE**. In parallel, Dark Reading reported security concerns around the rapid adoption of an open-source autonomous assistant, **OpenClaw** (formerly *MoltBot/ClawdBot*), which can connect to email, files, messaging, and system tools, execute terminal commands and scripts, and maintain memory across sessions—creating **persistent non-human identities and access paths** that may fall outside traditional **IAM** and secrets controls, increasing enterprise risk as “bring-your-own-AI” agents gain privileged access.
Jun 29, 2026
A financially motivated lone attacker used AI-assisted workflows to breach a large **AWS** environment in roughly 72 hours, according to a Sygnia incident-response report, chaining weaknesses across Internet-facing applications, AWS resources, source code repositories, **CI/CD** pipelines, runtime components, and data stores. The intrusion reportedly began with the theft of an AWS access key and expanded through secrets harvesting, cloud enumeration, backdoor creation, data exfiltration, deployment pipeline abuse, runtime modification, database access, and operational disruption. To extort the unnamed global enterprise, the actor carried out mostly reversible actions including denying access to **S3** buckets, scaling **ECS** services to zero, blocking network access with ACL rules, and purging **SQS** queues. The incident reflects a broader shift from isolated malicious use of generative AI to **agentic AI** supporting larger portions of the attack chain. Research cited by OALABS and observations from Anthropic indicate attackers are using tools such as **Claude** and **OpenAI Codex** to automate reconnaissance, analyze stolen data, generate code, and adapt operations during live intrusions, lowering the barrier for less-skilled actors while helping experienced operators scale activity. Security researchers said the trend now spans multiple **MITRE ATT&CK** tactics, including reconnaissance, credential theft, malware development, and social engineering, pushing defenders to prioritize detection of AI-enabled workflows, stronger identity controls, broader visibility, and faster automated containment.
Jul 9, 2026