AI Agents Create New Cybersecurity Attack Paths

Engadget changing its cybersecurity coverage reflects a conflict that became harder to dismiss in 2026. AI systems now help find vulnerabilities, assemble attacks, and operate tools with less human direction.

The immediate danger is not an all-knowing machine hacker. It is an agent that can repeatedly inspect software, test possible weaknesses, and adapt its next action. That combination compresses work that once demanded substantial time and specialized labor.

This shift pressures both sides of cybersecurity. Attackers can automate more of the intrusion process, while defenders gain faster tools for reviewing code and finding flaws. The contest now centers on which side can validate findings and act first.

Engadget Changing the Focus From AI Assistance to AI Action

The important change is that AI has moved from advising security operators to performing connected parts of their work.

Security teams have used machine learning for years. Earlier systems usually classified malware, scored alerts, or detected unusual network activity. Their output still passed through a human-controlled workflow.

Generative AI expanded that role. A model could explain suspicious code, draft a phishing message, or suggest commands for testing a server. However, a person normally had to copy the output, run the command, inspect the result, and choose the next step.

AI agents reduce those pauses. An agent is a model connected to tools and allowed to select actions across multiple steps. It can read a result, update its plan, and call another tool without waiting for a new human prompt.

That distinction gives the cybersecurity warning behind the Engadget story its urgency. The risk comes from repeated action, not simply better answers inside a chat window.

A capable agent can scan a target, interpret an error, revise a payload, and document what worked. None of those actions is entirely new. Automating their coordination changes the speed and cost of the complete process.

Anthropic described this transition after investigating a cyberespionage campaign detected in September 2025. According to the company, a threat actor used Claude Code with external security tools to automate substantial portions of its operation.

The company characterized the incident as the first reported cyberespionage campaign orchestrated largely through AI. That description remains a company assessment, not a universal classification accepted by every security researcher.

Anthropic also acknowledged an important limitation. The model sometimes fabricated credentials or claimed to have found information that was publicly available. Human operators still needed to verify results and redirect the system.

That limitation matters because it separates present danger from speculation. Current agents can make costly mistakes, lose context, and misread outputs. Yet an unreliable agent can still multiply an attacker’s attempts.

The same principle already shapes legitimate security research. A model does not need perfect judgment to become useful. It only needs to reduce enough repetitive work for a skilled operator to investigate more targets.

The result is a different operational tempo. Security teams must assume that reconnaissance, vulnerability testing, and exploit adaptation can happen closer together. A disclosure window that once offered breathing room can shrink sharply.

That is the first real meaning behind Engadget changing the conversation. AI is no longer only producing malicious text. It is beginning to connect decisions, tools, and actions into an attack workflow.

AI Cybersecurity Impact Falls Hardest on Slow Defenders

AI increases pressure on organizations whose security processes move more slowly than their software and attackers.

The most exposed organizations are not necessarily those running the most advanced AI systems. They are often organizations with old applications, incomplete inventories, delayed patches, or understaffed security teams.

An attacker has always needed only one workable route. A defender must close every meaningful route while keeping business systems available. Automation intensifies that asymmetry by letting attackers test more possibilities at once.

Georgia Tech researchers argue that AI currently has its greatest effect during early attack stages. Those stages include finding weaknesses, researching targets, and developing possible routes into a system.

That assessment challenges the most dramatic interpretation of AI hacking. The near-term threat is not necessarily a machine inventing an entirely unfamiliar category of attack. It is rapid exploration of weaknesses that defenders overlooked.

AI can read documentation, compare software versions, generate scripts, and interpret responses from scanning tools. It can also combine details that appear harmless when security teams review them separately.

A forgotten test server becomes more dangerous when an agent connects it to an exposed credential. An outdated library becomes more consequential when the agent discovers a reachable service using that exact version.

This creates a prioritization problem. Traditional vulnerability programs often begin with severity ratings attached to individual software flaws. Attackers care more about whether several modest weaknesses form a usable path.

An agent can search for those combinations continuously. It does not become tired while comparing configurations, credentials, network access, and published vulnerabilities. That persistence can expose attack paths that ordinary ticket queues hide.

The forced response is organizational as much as technical. Security teams need to understand which assets matter, who can reach them, and how separate weaknesses interact. Buying another alerting product does not repair missing ownership.

The pressure also extends to software maintainers. AI-assisted researchers can generate more vulnerability reports than small projects can validate. False reports still consume time, even when the underlying model acted in good faith.

Nature reported that Mozilla used a frontier model to help uncover and patch 271 vulnerabilities for one Firefox release. The Firefox security work illustrates AI’s defensive potential and its capacity to increase review volume.

A verified finding can improve software before attackers reach it. A flood of uncertain findings can instead overwhelm maintainers and delay the most important fixes. Human validation remains the scarce resource in both cases.

That bottleneck explains why Engadget changing its emphasis matters beyond dramatic hacking stories. AI changes the number of plausible findings that organizations must evaluate, not just the sophistication of one attack.

Companies with mature asset inventories and fast patching processes gain a defensive advantage. Organizations that cannot identify system owners will struggle, even if their detection tools use capable models.

This is primarily a long-term pressure with immediate consequences. The underlying weaknesses were often present already. AI shortens the period during which organizations can leave them unresolved without attracting attention.

The Real Conflict Is Automation Versus Verification

AI can accelerate attacks and defenses, but only verification turns generated activity into dependable security work.

This is the central tradeoff. Agents produce actions at machine speed, while trustworthy security decisions still require evidence. That gap shapes both offensive success and defensive overload.

Attackers do not need every generated exploit to work. They can discard failed attempts and continue testing. Defenders cannot treat every generated warning as a confirmed incident without disrupting normal operations.

That difference rewards offensive experimentation. A criminal can ask a model to rewrite a script after each failure. The cost of another attempt is often lower than the defender’s cost of investigating another alert.

However, automation does not eliminate the expertise needed for serious intrusions. Models can misunderstand a target, invent technical details, or damage access that an experienced operator would preserve.

Anthropic’s account of the 2025 espionage campaign captures both sides. Its campaign investigation says the actor used Claude as an operator across reconnaissance, exploitation, credential collection, and data analysis.

The report also says humans selected targets and intervened at critical points. Anthropic concluded that the system’s hallucinations remained an obstacle to fully autonomous attacks.

Those qualifications should not become excuses for complacency. An imperfect agent can still perform hundreds of low-cost tasks before a human reviews the most promising results.

The better comparison is not AI versus an elite hacker. It is one operator using conventional tools versus one operator supervising several partially autonomous workflows.

The second operator can investigate more targets, repeat more tests, and preserve more notes. The agent can also translate technical material or adapt a known technique to an unfamiliar software environment.

Defenders receive equivalent benefits in theory. They can deploy agents to examine code, reproduce reported bugs, review configurations, or search logs after an incident.

Defensive use faces stricter constraints in practice. A security team must protect production availability, customer data, and evidence integrity. It cannot freely execute every model-generated command against a live environment.

This makes sandboxing essential. A sandbox is an isolated environment that limits what code or an agent can reach. Yet isolation fails when tool permissions, credentials, or network routes remain too broad.

The security model must therefore cover the agent’s complete operating environment. Protecting only the language model leaves its browser, command shell, connectors, stored credentials, and retrieved documents exposed.

NIST’s review of agent security responses found broad agreement that established cybersecurity principles still matter. Its agent security analysis also concluded that those principles need adaptation for autonomous systems.

Least privilege remains useful, but an agent’s permissions can change across connected tools. Logging remains useful, but a high-speed agent can create more events than teams can review manually.

Human approval remains useful, but meaningless confirmation prompts become another source of error. If a person approves dozens of opaque actions, the control exists only on paper.

The practical contest is therefore automation versus verification. Attackers benefit when cheap experimentation produces one successful result. Defenders benefit when automated discovery leads to a validated patch before exploitation begins.

Neither outcome is guaranteed by the model alone. Deployment choices determine whether an AI agent becomes a useful analyst, an unreliable noise generator, or an uncontrolled operator.

New AI Attack Paths Target the Agent Itself

AI agents introduce vulnerabilities that conventional applications did not expose because software previously treated most retrieved text only as data.

Prompt injection is the clearest example. A prompt injection attack places instructions inside content that a model reads, hoping the model will treat those instructions as commands.

An ordinary browser displays a malicious sentence. An AI agent might interpret the same sentence, access another tool, and act on it. The vulnerability emerges from combining untrusted content with decision-making authority.

Indirect prompt injection hides those instructions in external material. The content can appear inside a webpage, document, email, support ticket, code comment, calendar entry, or search result.

A human employee may never notice the hidden instruction. An agent processing the material can incorporate it into its working context and follow it instead of the user’s request.

Google’s security researchers identified indirect prompt injection as a leading attack concern for agents. Their web injection study examined public pages for patterns designed to influence AI readers.

The danger rises when an agent can send messages, retrieve private files, update records, or execute code. A successful injection can turn authorized access into an attacker-controlled action.

This is not identical to a classic software injection flaw. A database can separate commands from values through strict syntax and parameterization. Natural-language models operate across ambiguous instructions and content.

Filters can catch familiar phrases, but attackers can paraphrase instructions or distribute them across several sources. A system also risks blocking legitimate content when it treats unusual text as inherently malicious.

Permission boundaries offer a stronger defense. An email summarizer usually does not need authority to run shell commands. A coding assistant should not automatically upload secrets simply because a repository file requests them.

Developers also need to track the origin of information entering an agent’s context. Content retrieved from the public web should not receive the same trust as a direct instruction from an authenticated user.

Agents can face other new attack paths. Tool descriptions may be manipulated, memory can preserve hostile instructions, and compromised connectors can return misleading results.

An attacker may also poison the data an agent uses for decisions. The objective is not always immediate code execution. It can be enough to alter a report, suppress an alert, or redirect a payment workflow.

OWASP’s 2026 review describes prompt injection and third-party AI dependencies as practical enterprise risks. Its agent exploit review connects documented incidents with emerging security categories.

Still, security teams should avoid treating every strange model response as a successful cyberattack. Models can fail because of ambiguous prompts, limited context, or ordinary software bugs.

A credible incident requires evidence about what the system accessed, which action it attempted, and whether an attacker influenced that action. Sensational demonstrations often omit one of those elements.

The most useful question is not whether a model said something alarming. It is whether untrusted input crossed a trust boundary and caused a consequential action.

That test gives organizations a workable standard. It also reveals why new AI vulnerabilities deserve focused attention without replacing established cybersecurity fundamentals.

AI Vulnerability Discovery Helps Both Attackers and Maintainers

The same ability that lets AI find neglected flaws can strengthen defenses, provided maintainers receive validated findings and usable patches.

AI-assisted vulnerability discovery operates across a large search space. A model can inspect source code, reason about program behavior, and choose tools such as debuggers or fuzzers.

A fuzzer feeds unusual inputs into software to trigger crashes or unexpected behavior. Traditional fuzzing often depends on human-designed test harnesses and substantial computing time.

A model can help interpret crashes and trace them back to relevant code. It can also suggest new tests based on what earlier attempts revealed.

Anthropic reported that Claude Opus 4.6 found vulnerabilities in widely used open-source software during controlled research. The company says it validated every reported issue to avoid burdening maintainers with hallucinated bugs.

Its zero-day research illustrates the defensive promise and the disclosure challenge. A zero-day is a vulnerability unknown to the responsible maintainer when someone discovers or exploits it.

These findings are valuable when researchers coordinate disclosure and give maintainers time to patch. They become dangerous when exploit details reach attackers before users can update affected systems.

AI compresses both timelines. It can help a maintainer understand a report faster, but it can also help an attacker analyze a public patch and reconstruct the original weakness.

That process, often called patch diffing, compares software versions to locate the corrected code. An agent can then test whether older, exposed versions remain vulnerable.

Organizations must therefore shorten the distance between vulnerability intake and remediation. A report sitting unassigned in a queue becomes more dangerous when attackers can automate patch analysis.

The answer is not to hide every security update. Users need enough information to assess exposure and apply fixes. Researchers also need incentives and safe channels for reporting problems.

The more realistic improvement is coordinated automation. Agents can reproduce findings inside isolated environments, identify affected assets, propose patches, and prepare tests. Humans can then approve changes with better evidence.

Maintainers should reject the assumption that every AI-generated report deserves equal urgency. Reports need reproducible steps, affected versions, technical impact, and evidence that the behavior crosses a security boundary.

Security teams also need deduplication. Several agents may independently report the same root cause using different language. Without grouping, automation can make one flaw appear to be dozens of separate emergencies.

This verification layer is where defenders can regain leverage. Attackers tolerate noise because they search for one opening. Defenders can use structured evidence to convert high-volume discovery into prioritized fixes.

The benefits extend beyond large technology companies. Smaller teams can use AI to examine unfamiliar code or draft tests, though they still need secure configurations and qualified review.

Organizations should also preserve institutional knowledge around incidents and patches. A searchable engineering knowledge base can help teams connect new findings with earlier decisions and affected systems.

That connection is operationally important. An agent can propose a fix quickly, but teams still need to know why the code exists, which customers depend on it, and what previous changes broke.

AI vulnerability discovery therefore does not automatically favor offense. It rewards whichever side combines automation with access, validation, and faster execution.

What the Next Cybersecurity Tests Must Show

The next phase will be measured through verified incidents, agent permission failures, and defenders’ ability to patch at comparable speed.

The first signal to watch is independent documentation of AI-orchestrated intrusions. Company threat reports provide valuable evidence, but vendors also have incentives to emphasize their models’ importance.

Stronger confirmation would include shared indicators, affected sectors, attack timelines, and findings from multiple incident-response teams. Sensitive details can remain protected while investigators still establish the role of AI.

If independent reports show agents completing longer attack chains with fewer human corrections, the automation argument becomes stronger. If evidence continues to show constant operator intervention, claims of autonomy need restraint.

The second signal is the treatment of indirect prompt injection in deployed agents. Research demonstrations already show a credible mechanism. The open question is how often it produces consequential actions in ordinary enterprise systems.

Watch for incidents involving email agents, coding assistants, browser agents, and connected productivity tools. Reports should explain the permissions involved and whether the system crossed a defined trust boundary.

A rise in verified cases would show that AI created a distinct operational attack surface. A lack of documented harm would not eliminate the risk, but it would weaken claims that widespread exploitation is already underway.

The third signal is remediation speed. AI-assisted discovery matters most when it changes the race between finding a flaw and protecting exposed systems.

Useful evidence will include shorter validation times, faster patch deployment, and fewer unassigned vulnerabilities. Raw counts of AI-discovered bugs will reveal little if maintainers cannot process them.

Defenders should begin preparing without waiting for perfect metrics. They can inventory agent permissions, separate trusted instructions from retrieved content, and require approval for irreversible actions.

They should log tool calls with enough detail to reconstruct decisions. Logs need to record the input source, requested action, available permissions, and actual result.

Security tests must also include hostile content inside normal workflows. Evaluating a model only with direct jailbreak prompts misses attacks hidden in files, websites, and messages.

Organizations should place limits around data movement. An agent that reads confidential documents should not gain unrestricted outbound communication merely because both capabilities seem useful separately.

Traditional controls still carry most of the defensive load. Multifactor authentication, rapid patching, segmented networks, protected credentials, and tested recovery plans remain essential.

AI does not make those practices obsolete. It punishes organizations that implemented them inconsistently, because automated attackers can search for the exceptions faster.

Engadget changing the cybersecurity conversation is therefore less about machines replacing hackers than machines changing the economics of hacking. More attempts can happen sooner, with fewer pauses between discovery and action.

The defensive opportunity follows the same logic. Security teams can use agents to investigate code, validate reports, and prepare fixes before an attacker turns a weakness into an intrusion.

The decisive question is whether organizations will give agents broad authority before they establish effective verification. Readers should ask what each agent can access, what it can change, and who reviews its actions.

That inquiry should happen now, not after the first unexplained tool call appears in an incident report. AI is accelerating cybersecurity, but speed without boundaries benefits the side willing to accept the most risk.