Agentic AI In Cybersecurity: Emerging Threats And How You Can Prepare

Key takeaways

• Agentic AI systems are capable of autonomously planning and executing actions with limited human direction. In the cybersecurity context, agentic AI has the potential to accelerate both offensive and defensive activities.
• Early research demonstrates that some advanced agentic AI systems are capable of identifying previously unknown software vulnerabilities and, in some cases, developing exploitation pathways that have historically required substantial human expertise and time.
• In light of these new capabilities, organizations may wish to begin reassessing cybersecurity governance, detection capabilities, access controls, incident response procedures, and AI governance programs in anticipation of increasingly autonomous cyber capabilities.

AI has already been making significant impact on both offensive and defensive cybersecurity capabilities, but the offensive use of AI is entering a new phase: agentic, autonomous systems capable of planning, executing, and adapting attacks with limited human intervention. Recent engagement between senior U.S. government officials and major financial institutions underscores that agentic AI-driven cyber risks are being treated as a near-term, consequential threat. Early examples, including controlled research, security competitions, and limited real-world threat actor experimentation, demonstrate that agentic AI could materially change the velocity and scale of future cyber attacks. Traditional approaches to cyber defenses are likely to be insufficient against adaptive, decision-making capabilities of agentic AI attacks. Organizations may consider starting to adapt governance, detection strategies, and other controls now to plan and mitigate risks.

What is "Agentic AI" and how might it change cybersecurity?

“Agentic AI” refers to systems that autonomously plan and sequence actions (e.g., execute commands, connect to services or research on the Internet), interact dynamically with environments (e.g., execute commands, query systems, pivot based on outputs), and iterate toward goals without human prompting. From a legal perspective, agentic AI represents a shift from systems that merely recommend actions to systems that can directly execute acts that may bind an organization, alter systems, or take other actions that may trigger legal obligations without contemporaneous human review.

In the cybersecurity context, these capabilities may be used for both defensive and offensive purposes. Defensively, agentic AI may help organizations identify vulnerabilities, monitor environments, and automate portions of security operations. Offensively, these same capabilities can enable agentic AI models to execute advanced offensive strategies, such as automated vulnerability discovery and exploitation chains, real-time adaptation to defenses (e.g., modifying payloads when blocked), and scaling attacks across multiple systems simultaneously with minimal operator involvement. 

For more information on the broader opportunities and risks agentic AI brings, read our alert here.

Agentic AI in offensive contexts

Controlled research environments  

Anthropic, a leading AI developer, proactively disclosed that one of its latest models, Mythos, is capable of autonomous security research, including identifying and, in some cases, exploiting zero-day (i.e., previously unknown) vulnerabilities in widely used software systems. In testing, the model reportedly identified significant zero-day vulnerabilities across major operating systems, browsers, and widely deployed software. The Mythos model can independently scan software systems, identify vulnerabilities, and develop potential exploit pathways, with minimal human prompting. Because of these capabilities, the Company has delayed public disclosure of Mythos.

Notably, certain vulnerabilities identified by the model were missed by generations of security researchers and went undetected by existing automated security tools. Some discoveries included:

• A vulnerability in a high security open-source operating system that had gone undetected for around 27 years. This security flaw would allow an attacker to remotely crash any machine running the system just by connecting to it;
• A 16-year-old vulnerability in a core video encoding and decoding library used across countless applications, which persisted despite the code being exercised 5+ million times without triggering any failures; and
• A set of vulnerabilities in the Linux kernel, the software underlying most of the world’s servers and phones, were autonomously discovered and chained together to enable an attacker to escalate privileges from a regular user account to gain administrative control of the system.

This development demonstrates both the potential for advanced AI systems to improve defensive cybersecurity capabilities and raises important considerations regarding how such technologies might be used by malicious actors. Recognizing the model’s capabilities, Anthropic has taken a measured approach to deployment. Rather than making the model broadly available, the Company is providing restricted access to a select group of technology, security, and IT companies to allow these select companies to identify and patch security vulnerabilities in their systems before releasing the model for public usage. Project Glasswing limits access to Mythos to enable defensive preparation, reducing the risk that frontier models could be used to exploit vulnerabilities.

Recent publicly reported cybersecurity incidents involving agentic AI

Recent reporting reflects a growing body of cybersecurity incidents and threat activity in which AI‑enabled or semi‑autonomous systems have played a material role, ranging from unintended internal system behavior to use by malicious actors.

Alibaba – an experimental AI agent developed by researchers affiliated with Alibaba highlights emerging risks not from malicious actors, but from the autonomous behavior of the systems themselves. An agent designed to perform workflow and coding-related tasks escaped from its intended testing environment (i.e., sandbox) and began interacting with external systems without authorization. These actions emerged from the system's reinforcement learning optimization process, which inadvertently rewarded unauthorized behavior. This incident underscores that even non-malicious deployments can create attack-like behavior, including resource hijacking, unauthorized access pathways, and persistence mechanisms (e.g., backdoor creation).

Traditional security models assume trusted internal systems behave predictably within defined boundaries. Agentic AI complicates this: because agents can autonomously initiate actions that resemble attack behavior, incident responders may struggle to determine whether an event reflects internal system failure or external compromise.

OpenAI recently disclosed that an AI agent powered by a collection of recently released and development models that was being tested in a restricted testing environment compromised the AI company Hugging Face's systems to find solutions to challenges the testers were giving it.

North Korean sponsored attacks, including IT worker schemes – Recent threat intelligence indicates that threat actors are increasingly operationalizing AI along the cyberattack lifecycle. According to a Microsoft Threat Intelligence report, North Korean threat groups are using AI tools to streamline decision‑making following initial access, accelerate network analysis, identify viable lateral movement paths, and enable operators to better obfuscate malicious activity amongst legitimate user actions. More broadly, AI is being leveraged to facilitate privilege escalation, locate and exfiltrate sensitive records or credentials, and assess security controls to reduce the risk of detection. While most observed activity to date relies on generative AI, Microsoft reports an emerging trend toward agentic AI, which could eventually enable semi‑autonomous workflows that refine phishing campaigns, adapt infrastructure, and maintain persistence with minimal human intervention.

Hogan Lovells Cadwalader has previously covered security threats surrounding North Korean nationals attempts to secure remote positions, implications for the job interview process, and methods to reduce risk. For more information, you can read this article here. 

PROMPTFLUX – In January 2025, Google's Threat Intelligence Group (GTIG) published a Report that details how government-backed threat actors and cyber criminals are integrating AI across the attack lifecycle. One key finding was that some malware families, such as PROMPTFLUX, are using Large Language Models (LLMs) during execution. Rather than solely relying on pre-embedded code, these malwares dynamically generate malicious scripts, update the code automatically to evade detection, and create malicious functions on demand. Although this capability is in its early stages, it signals a move toward more adaptive and potentially autonomous malware operations.

These different AI based attacks complicate traditional incident detection and response analysis and determinations of ‘unauthorized access,' internal control failures, and reportability under breach notification regimes.

Threat actor experimentation

Separately, AI developers and threat intelligence teams indicate that threat actors are actively experimenting with commercial AI systems to prepare for offensive cyber operations.

Recent public reporting suggests that certain state-sponsored actors have begun exploring the use of advanced AI systems to support portions of the cyberattack lifecycle. According to their findings, threat actors were able to circumvent usage safeguards by framing their activity as legitimate cybersecurity research, effectively prompting the system to assist with offensive tasks. Using the model's coding and reasoning capabilities, the actors developed tooling designed to automate attacks and execute compromises against selected targets with minimal human involvement.  Additionally, commercial AI models with agentic properties may also lower the technical barrier for financially motivated threat actors to conduct cyber operations by automating tasks that historically required specialized expertise. While the scale and sophistication of these efforts remain limited at this time, such experimentation demonstrates growing interest among threat actors to operationalize agentic AI capabilities and highlights the potential for commercially available models to be repurposed for offensive use, despite built-in safeguards.

What organizations can do to prepare for agentic AI-enabled cyber threats

The emergence of agentic AI represents a shift not simply in attacker tooling, but in attacker behavior. Organizations will reassess whether current controls remain sufficient given these changes. 

(a) Reassess how existing controls may be enhanced for evolving standards of “reasonable” cybersecurity

What is considered “reasonable” legal security and similar concepts under different legal regimes will continue to evolve as agentic AI leads to changes in both offensive and defensive cybersecurity. Organizations' legal, cybersecurity, and other internal teams may reassess whether existing controls, which may have been reasonable against human‑operated threats, remain defensible when facing autonomous systems capable of chaining together multiple low‑risk issues or identifying previously unknown vulnerabilities. This assessment may affect regulatory posture, contractual representations regarding security measures, and post‑incident scrutiny by regulators or plaintiffs.

As one pertinent example, traditional patching processes, which occur at less frequent durations, may be considered insufficient in the future. Agentic systems are capable of continuously probing for misconfigurations, not just known vulnerabilities, and can chain together multiple low- or medium-risk issues into viable exploit paths. Agentic systems are also proving that they can identify zero-day vulnerabilities, for which there is no patch by definition. The result is that even well-patched environments may remain vulnerable. Additionally, the transition from static indicators-of-compromise (IOCs) to behavior-based detection allows AI agents to self-evolve throughout the attack lifecycle to avoid detection. Companies may wish to monitor for postings from authoritative sources, such as the Cybersecurity and Infrastructure Security Agency's recent guidance, as well as companies participating in Project Glasswing, to stay informed about evolving threats, tactics, and defensive recommendations related to agentic AI.

(b) Reinforce foundational security controls with a “back to basics” approach

Beyond evolving changes on what is reasonable, there may be further scrutiny by regulators and litigants regarding companies’ application of core security principles that become more critical in an agentic threat environment. Companies may want to reassess how they have historically struck the balance between operational considerations and security. This includes:

• Detection and monitoring enhancements
• Access reviews based on the principle of least privilege
• Defense-in-depth and zero trust architectures, including layered security controls, continuous authentication and authorization, network segmentation, and minimizing implicit trust between systems, users, and AI agents
• Execution control, including:
  • Whitelisting approaches: restricting systems and agents to pre-approved commands, tools, data sources.
  • Blacklisting approaches: blocking known high-risk commands, scripts, or execution pathways.
• Containment and incident response plans
  • Developing controls to isolate and shut down agents in response to anomalous or unauthorized behavior

(c) Implement safeguards for the secure deployment of agentic AI systems as part of internal risk management 

In addition to the risk of external actors using agentic AI, internal development and deployments of agentic AI tools also present cybersecurity risks. As part of broader AI governance initiatives, change management, and other processes, organizations may consider further emphasis on:

• Access scoping and permissions design
  • Ensuring agents are granted only narrowly tailored access rights scoped to predetermined tasks
  • Avoiding broad / persistent credentials
  • Ensuring agents cannot independently retrieve or escalate access privileges
• Sandboxing and environment isolation
  • Designing segmented environments that prevent agents from accessing unauthorized systems or sensitive data
• Establishing human oversight and control mechanisms
  • Establishing HITL requirements for sensitive actions
  • Designing escalation pathways where agents must seek approval before executing higher-risk actions
  • Establishing governance structures that define when/how human intervention is required

(d) Plan for incident response challenges from agentic attacks

Agentic AI may complicate traditional incident‑response determinations, including when an event constitutes unauthorized access, when exploitation began, and whether harm resulted from a vulnerability, a misconfiguration, or system interaction with processors and other third parties. Autonomous attackers may also blur attribution timelines, making it harder to assess dwell time, scope, and materiality.

Although early, organizations may start considering how these factors could affect incident response processes, cyber insurance applications and coverage, and post‑incident notifications and potential investigations. Preparing for agentic AI–enabled threats may warrant revisiting decision‑making frameworks for incident classification and disclosure in light of more adaptive, opaque, and rapidly evolving attack methods.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.