When the Attacker Is an Agent: What AI-Orchestrated Intrusions Mean for Security, Privacy and the Board

For most of the last decade, the speed limit on a cyberattack was the attacker’s own staff. Someone had to scan the network, read the output, write or adapt an exploit, hunt for credentials, decide which database was worth stealing and then sort through what came out. Each of those steps took people and time, and defenders built their detection and response plans around that pace.

That assumption is now breaking. Security agencies in the United States and Australia have spent 2026 publishing guidance that starts from the premise that attackers are handing large parts of the intrusion chain to AI agents: software that can run in a loop, call tools, read results and pick its next move with only occasional human direction. For privacy, legal and compliance teams, the shift matters as much as it does for the security operations center. Faster intrusions compress the time between initial access and data theft, and that compresses every downstream obligation that depends on discovering, assessing and reporting a breach.

The case that turned a forecast into a record

The clearest public account of an agent-driven intrusion campaign still comes from the AI developer whose tool was abused. In November 2025, Anthropic reported that it had disrupted an espionage campaign it detected in mid-September 2025 and attributed, with high confidence, to a Chinese state-sponsored group. The operators built an attack framework around Claude Code, the company’s coding agent, and pointed it at roughly 30 organizations worldwide. Anthropic said the attempts succeeded in a small number of cases.

The targets give a useful picture of who is in scope. According to the company, the campaign went after large technology companies, financial institutions, chemical manufacturers and government agencies. None of those sectors is unusual for state espionage. What was unusual was the division of labor. Anthropic estimated that AI performed 80 to 90 percent of the campaign, with humans stepping in at perhaps four to six critical decision points per intrusion. At its peak the framework made thousands of requests, often several per second.

The operators got around the model’s safeguards in a way that should worry anyone deploying agents internally. They split the attack into small tasks that looked harmless on their own and told the model it was working for a legitimate security firm doing defensive testing. Once running, the agent mapped systems, flagged the highest-value databases, researched and wrote exploit code, harvested credentials, identified high-privilege accounts, created backdoors, exfiltrated data, sorted it by intelligence value and wrote up documentation for the next phase.

Two caveats from the same report deserve equal weight. The agent sometimes hallucinated credentials or claimed to have stolen secrets that were actually public, which Anthropic described as an obstacle to fully autonomous attacks. And the company could only see activity on its own platform, though it said the pattern probably reflects how threat actors are using frontier models generally. We have covered the broader trend of AI developers’ threat intelligence reports on model misuse before; this one stands out because it documents an attacker using an agent as the operator rather than as an advisor.

What “agentified” changes, and what it does not

It is tempting to treat AI-enabled attacks as an entirely new category of threat. The government guidance published since then mostly says the opposite. The techniques are familiar: reconnaissance, exploitation of known and unknown flaws, credential theft, lateral movement and exfiltration. What changes is cost, scale and tempo.

Australia’s Australian Signals Directorate put the risk in concrete terms in its July 2026 publication, Defending against AI-enabled cyber attacks, aimed at government, critical infrastructure providers and large enterprises. The agency warned that malicious actors may use AI to discover vulnerabilities, develop exploits within hours, hit many victims at once (particularly through internet-facing services such as websites), chain several low-severity flaws into a high-severity compromise, and move quickly from initial access to data theft, extortion or disruption.

That last point is the one privacy teams should underline. Breach-response playbooks often assume a dwell time measured in days or weeks, giving incident responders a window to contain an intrusion before personal data leaves. An agent that can go from foothold to exfiltration in a single session removes much of that window. The “chain of low-severity bugs” point matters too, because many vulnerability programs still triage by individual severity score and leave medium and low findings in a backlog for months.

On the other side of the ledger, the Anthropic case shows that agentic attacks still depend on human choices at key points, still make mistakes and still leave traces in the platforms they run on. Speed is the advantage. Omniscience is not.

Where regulators have landed so far

There is no single law aimed at AI-enabled cyberattacks, and organizations should be wary of anyone who claims there is. What exists is a growing stack of guidance, plus existing security and breach rules that apply regardless of whether the attacker used an AI agent.

Guidance on attackers using AI

The Australian guidance is the most prescriptive public document on this question. Several of its recommendations are aimed at executives and boards rather than engineers. It calls for a named executive accountable both for risks from attackers using AI and for risks from the organization’s own use of AI. It asks boards to accept more short outages of internet-facing services in exchange for faster patching, to reduce their tolerance for unsupported internet-facing systems, and to allocate people and budget specifically to these risks.

In New York, the Department of Financial Services issued an industry letter in October 2024 on cybersecurity risks arising from AI. It focused on AI-enhanced social engineering, including deepfaked audio, video and text, and on the larger, more sensitive data stores that AI deployments create. The letter did not add new requirements to the state’s cybersecurity regulation, but it told regulated financial firms that their existing risk assessments, access controls, multi-factor authentication, training and vendor management should account for AI-driven threats.

Guidance on defenders using agents

The second strand concerns the agents organizations deploy themselves. In May 2026, CISA, the Australian Cyber Security Centre and other U.S. and international partners released a joint guide, Careful Adoption of Agentic AI Services. It names the risks directly: an expanded attack surface, privilege creep, behavioral misalignment and event records that are hard to interpret. Its headline recommendations are to avoid giving agents broad or unrestricted access, especially to sensitive data or critical systems; to start with low-risk, non-sensitive use cases; and to fold agent security into the organization’s existing security model rather than treating it as a side project.

That is relevant because the same jailbreak pattern Anthropic described, breaking a malicious goal into innocent-looking subtasks, can be turned against an internal agent with access to a CRM, a ticketing system or a document store. As we wrote when looking at how AI agents are becoming privileged users, an agent with standing access to personal data is an identity to be governed, not just a feature to be configured.

Rules that already apply

None of the obligations below cares whether the intruder typed commands or delegated them to a model. They become harder to meet when the attack moves faster.

• GDPR Article 32 and 33. Controllers must implement security appropriate to the risk and notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it.
• NIS2. Essential and important entities in the EU face staged incident reporting, beginning with an early warning within 24 hours of becoming aware of a significant incident.
• SEC Form 8-K Item 1.05. U.S. public companies must disclose material cybersecurity incidents within four business days of determining materiality.
• U.S. state breach laws and the CCPA. Every state has a breach notification statute, and California’s CCPA gives consumers a private right of action for certain breaches caused by a failure to maintain reasonable security.
• EU AI Act Article 15. Providers of high-risk AI systems must design them for appropriate accuracy, robustness and cybersecurity, including resilience against attempts to manipulate their behavior.

The practical consequence is that “we did not know AI could do that” is unlikely to work as a defense. Regulators judge reasonableness against known threats, and AI-enabled attacks are now documented in government guidance on three continents. U.S. lawmakers have been examining the same problem; see our earlier piece on Congress confronting the rising threat of AI-powered cyberattacks.

The sectors with the most to lose

The public record points to a fairly predictable list, with one twist. The Anthropic campaign hit technology, finance, chemicals and government. Allied agencies have pitched their guidance at critical infrastructure and defense. Our coverage of how Western governments are bracing for routine autonomous AI cyberattacks tracks the same priorities.

The twist is that the Australian guidance singles out internet-facing services, and especially websites, as the place where AI-driven mass exploitation is most likely to land. That puts mid-sized companies with large public web estates, legacy marketing sites and unsupported plugins on the list alongside banks and utilities. Sectors that hold sensitive data on behalf of others, including professional services, healthcare and software vendors, are attractive because a single compromise exposes many downstream clients.

A seven-step plan for the next two quarters

The following sequence draws on the Australian, CISA and New York guidance and translates it into work that security, privacy and legal teams can share. It is not a compliance checklist, and completing it does not mean a breach cannot happen.

1. Name an owner. Assign one executive to be accountable for both sides of the AI risk: attackers using AI and the organization’s own agents. Write the role into the risk register so it survives reorganizations.
2. Inventory everything internet-facing, often. The Australian guidance says daily. Remove services that are not needed and set a date to replace those that are no longer vendor supported. Include marketing microsites, forms and third-party scripts, not just APIs.
3. Patch by exposure, not only by severity. Rework the vulnerability process so that medium and low findings on internet-facing systems are fixed quickly, because chained low-severity bugs are exactly what AI tools are good at finding. Get the board to accept the occasional bad patch or short outage as the price.
4. Shrink standing privilege. Apply least privilege to service accounts and to any AI agent you deploy. Segment internet-facing services from each other and from the corporate network so that one compromise does not become many.
5. Map where personal data actually sits. An agent that reaches your network will look for the highest-value databases first. You should know before it does which systems hold the most sensitive personal data, who can reach them and how long that data is kept. Data that has been deleted on schedule cannot be stolen.
6. Pre-approve narrow automated responses. Centralize logs and allow automated containment actions that are tightly scoped and reversible, such as isolating a host or forcing a password reset, so response can keep pace with an automated attack.
7. Rehearse a compressed timeline. Run a tabletop exercise that assumes exfiltration within hours of initial access. Test whether legal, privacy and communications can make notification decisions inside GDPR, NIS2, SEC and state-law windows when the facts are still incomplete.

Where privacy tooling fits, and where it does not

It is worth being precise about the boundary. Captain Compliance is not an endpoint, network or vulnerability-scanning product, and its website privacy risk monitoring for security teams states plainly that it complements rather than replaces firewalls, EDR, SIEM, penetration testing and incident-response teams. What it does is continuously identify the pixels, scripts, chatbots, session-replay tools and other third-party technologies running in visitors’ browsers, detect when they change and keep technical records. That speaks to one slice of the problem the Australian guidance describes: knowing what is actually running on your internet-facing web estate, and spotting a newly added third-party script before it becomes someone else’s foothold or data channel.

Data mapping and assessment workflows help with step five above. They do not prove that the controls described in an assessment are working. A completed risk assessment of an AI agent is a record of intent; only logs, access reviews and testing show whether the agent can actually reach the data it was never supposed to touch. The same goes for agentic systems built to improvise inside rules designed for predictability: the governance paperwork matters, but it is not evidence of behavior.

Frequently asked questions

Is an AI-orchestrated attack legally different from a conventional one?

Not under current breach and security laws. GDPR, NIS2, SEC disclosure rules and U.S. state breach statutes apply based on what happened to the data and systems, not on the attacker’s tools. The difference is practical: less time to detect, contain and assess before notification clocks start running.

Did the 2025 campaign show that fully autonomous hacking works?

Partly. Anthropic estimated AI handled 80 to 90 percent of the work, but humans chose targets and approved key steps, and the agent sometimes fabricated results. It shows a large reduction in the human effort needed, not a system that runs entirely on its own.

Should we stop deploying AI agents internally until the risks settle?

The joint CISA guide does not say that. It recommends starting with low-risk, non-sensitive use cases, avoiding broad access to sensitive data and critical systems, and integrating agents into existing security controls. The Australian guidance goes further and encourages supervised use of AI for defense, such as code review and log analysis.

Which team should own this risk?

The Australian guidance recommends a single named executive accountable for both attacker use of AI and the organization’s own use. In practice that person needs security, privacy and legal at the table, because the consequences of a fast-moving breach land on all three.

Does a smaller company need to worry, or is this a nation-state problem?

Anthropic’s own assessment is that the barriers to sophisticated attacks have dropped and that less experienced, less resourced groups can now attempt operations that once required large teams. Mass exploitation of internet-facing services is a risk for any organization with a public website, not just governments and banks.

The question boards will have to answer

The most uncomfortable line in the Australian guidance is not technical. It asks boards to formally increase their appetite for brief outages caused by fast patching, and to reduce their appetite for running old, unsupported internet-facing systems. That is a trade most organizations have avoided making explicitly for years, because uptime is visible and risk is not. Once an attacker can find and exploit a flaw within hours, the question stops being whether to make that trade and becomes whether the board made it on the record before the incident, or has to explain afterward why it did not.