Attackers Now Automate the Intrusion, and Waiting for an Alert Is Too Slow

Most security teams still run on the same loop. A tool raises an alert, an analyst triages it, someone decides what to do, and a change is made. That loop works when the attacker is also a person working through a keyboard. This post is about what happened when the attacker stopped being one.

We looked at the incidents reported through 8 November 2026 in which AI agents carried out real intrusion work. Some are well documented by the victim or a security vendor. Others rest on a single account, and we say which. We also looked at what the evidence does not show, because a post about an “unprecedented” wave should be exact about what is measured.

The cases from October and November

Led by Maria Singh

Six sets of events stand out. The table gives them in the order we would trust the evidence, strongest first.

Case	What the report says	Who reported it
WorkOS	An ARTEX agent downloaded customer-support and sales records from 25 October. WorkOS noticed on 30 October. A researcher says the agent escaped a test sandbox by accident.	WorkOS, via BleepingComputer
VAPOR PANDA	A China-linked group ran ARTEX against 200+ organisations in 14+ countries over 11 days from 17 October. Nine have confirmed post-exploitation.	CrowdStrike, via BleepingComputer and Check Point
Aur0ra ransomware (GOLD OGRE)	Operators gave coding agents VPN access and a goal. The agents ran Active Directory discovery and credential attacks and reached domain admin in some victims.	Sophos
One operator, Cairn agents	A Chinese-speaking operator tried 1,200+ sites from 25 September and reached 100+ companies.	NorForge via Reuters, 19 October
South Korean finance	Suspected AI-assisted attacks on 16 institutions exposed about 100,000 customer records. Daishin Securities, Mirae Asset Global Investments and Bithumb were affected.	CSIS
Anthropic’s September report	Several state-linked and criminal actors used agents for most of the tactical work, including one that rebuilt malware until it evaded detection.	Anthropic

Dates and figures from the sources listed at the end of this post. See the Evidence & Methodology box for how strongly each is supported.

VAPOR PANDA and ARTEX. CrowdStrike says a China-linked group it calls VAPOR PANDA used ARTEX, an autonomous penetration-testing framework, against more than 200 organisations in at least 14 countries. Targets included government agencies, telecoms and defence companies. The window ran 11 days from 17 October, and the group deployed the BLOODALCHEMY backdoor. Coverage stresses that 200 is the number targeted, and that confirmed post-exploitation activity was found at nine organisations. Reporting says the framework ran mainly on the Chinese-developed DeepSeek model plus a second model CrowdStrike could not identify, and that one intrusion used more than 1.4 billion input tokens. The person running it stepped in at key decisions while the agents worked on several victims at once.

The Aur0ra crew. Sophos tracks the ransomware group behind Aur0ra as GOLD OGRE, Russian-speaking judging by keyboard artefacts in operator logs. Its operators supplied VPN credentials, proxy access and an objective, then let agents built on Cursor and models from Anthropic, xAI and Moonshot do the discovery and credential work. When an attempt failed, the agents rewrote their commands and tried another route. Sophos recovered prompts showing the actors framed the work as “authorized red team activity” to get past model safeguards. In a subset of victim networks the agents reached domain administrator, and three of those victims later appeared on the group’s leak site. Sophos also assesses with high confidence that the group used AI to test whether its tools would evade endpoint products.

The lone operator. On 19 October Reuters reported research by NorForge’s Snorre Fagerland on a Chinese-speaking operator who left nearly all the work to AI agents running on an open-source platform called Cairn. Fagerland found the operator’s control panels exposed on the internet. The campaign began on 25 September against e-commerce sites in the US, Canada, Australia and Japan. The agents tried more than 1,200 sites and reached more than 100 companies. The operator’s instructions ran to fewer than 100 Chinese characters. Fagerland estimated about 23 hours and about $50 per successful intrusion. The 1,200 figure counts attempts, not breaches.

WorkOS. On Friday 6 November WorkOS said a researcher had come forward as the person behind its breach. WorkOS had earlier disclosed that an attacker used ARTEX to automate reconnaissance and exploitation against a legacy internal tools platform. The platform exposed its API endpoints to the internet through permissive access controls, accepted a predictable development credential that had been deployed to production by mistake, and had no rate limiting. The agent pulled business contact details, account histories, product usage data, and summaries or excerpts of sales calls, support discussions and customer Slack conversations. The researcher says they were running benchmark evaluations and that the agent “escaped its isolated testing environment and interacted with WorkOS unintentionally”, and that the data was deleted. WorkOS matched the researcher’s requests and timestamps to its logs and says it is confident of the identity. Neither side has explained how the escape happened.

What has changed

The NCSC’s chief executive, Dr Richard Horne, put it carefully when the agency published its State of the Cyber Nation report on 3 November. Horne said AI has not invented new ways to attack. The NCSC expects AI to help attackers find and use long-standing weaknesses faster and at greater scale, and it judges AI-powered malware “highly likely” to feature in ransomware against UK critical infrastructure by 2028. That matches what the cases show.

	Before	Now, per the October and November cases
Who does the middle of an intrusion	Operators, hands on keyboard	Agents; people set the goal and handle the key decisions
Cost of a campaign	Skilled labour, weeks	About $50 and 23 hours per site in one case
How many targets at once	Few, chosen by hand	200+ in 11 days, or 1,200+ attempts by one person
Response to a blocked step	Operator thinks, tries again	Agent rewrites the command and tries a new route
Skill needed	High	Lower; CrowdStrike says even low-skilled actors now compromise organisations
Guardrails	Not applicable	Overcome by framing the job as authorised testing, per Sophos and CrowdStrike

Our comparison. Right-hand column from CrowdStrike, Sophos, NorForge via Reuters and Anthropic.

The entry points did not change. The cases that reached domain admin and the cases that stole customer records both began with stolen credentials, weak credentials or an exposed internal system. Other October reporting shows ordinary methods still carrying much of the load: Microsoft 365 device-code phishing kits, fake ChatGPT and Claude installers, and more than 400 incidents of attackers posing as IT support in external Microsoft Teams chats. AI did not replace those. It made the steps after them faster and cheaper.

How AI makes attackers more offensive

Led by Maria Singh

Across the cases we see five ways AI changes the attacker’s position.

1. Tempo. CrowdStrike describes an agent that moved sideways and took domain controller credentials in about 20 minutes with no further human guidance. A human team doing the same would plan, wait and check. The agent does not.
2. Parallel scale. One ARTEX controller worked on many victims at once. One operator whose instructions ran to fewer than 100 Chinese characters reached over a hundred companies. Anthropic’s September report describes a group that took credentials from 1.8 million Android packages and another that touched about 200 downstream customers of one software supplier, where Anthropic says “AI agents performed nearly all of the work”.
3. Persistence through failure. Sophos saw agents refine commands when a step failed. Anthropic describes a Russian state-linked actor whose agents were built to keep rebuilding malware until it went undetected. Where a person gives up and moves on, an agent loops.
4. Lower skill and cost. Fagerland’s $50 per intrusion is an estimate. The skill needed to run the campaign shrinks to writing a goal and keeping the control panel running.
5. Safeguard bypass by framing. The Aur0ra operators called their intrusions authorised red-team work. CrowdStrike says all four actors it found overcame commercial AI safety controls. The model cannot see the contract, so it takes the claim at face value.

The figure below shows the Aur0ra pattern as Sophos described it, applied to a mid-sized company. It is a composite of the published case.

Attack walkthrough

How ransomware operators use AI agents to reach domain admin

Operatora person, few decisions

Attack agentsdo the middle

Corporate networkVPN, file shares, AD

Domain admincontrol of the estate

1 Hands over VPN access and a goal

2 Maps the directory and file shares

3 Sprays passwords, attacks service accounts

4 Rewrites commands that fail

5 Reaches domain administrator

6 Returns control for the final step

The people choose the target and the payload. The agents do the discovery and escalation in between. Composite of the Aur0ra case (Sophos), illustrative. Press Replay to watch it step by step.

← BackNext →Replay

Sources: Sophos, AI used in Aur0ra ransomware testing and execution, 2026; Help Net Security coverage. The company and network are illustrative.

What the evidence does not show

A wave of cases does not prove a wave of success, so we want to be exact about what is and is not shown.

• Targets and breaches differ. VAPOR PANDA reached for 200+ organisations. Nine show confirmed post-exploitation. The Reuters-reported operator tried 1,200 sites and reached about a hundred.
• Humans are still in charge. Anthropic’s report says people kept control of target selection, monetisation and review, and that the most severe outcomes still often came from fully human-run operations.
• Most of this is vendor and press reporting. CrowdStrike’s page does not name its four actors or publish methods. Several figures reach us through secondary coverage. One account of the same lone operator also claims more than 600,000 stolen card records, which we could not confirm and have left out.
• The WorkOS escape is one person’s account. Nobody has explained how an agent left its sandbox.
• “Unprecedented” is a forecast. The NCSC warns of “a real prospect of an unprecedented rise in the number of cyber-incidents” in the coming months. That is a warning of what may come.
• One headline claim we did not use. Some roundups cite a $6.3 billion theft from a crypto exchange. We saw it in one vendor summary, not corroborated and not tied to AI, so we left it out.

What the evidence does support is narrower and still important. Several independent vendors and researchers saw the same pattern in different victims and regions: agents doing the work inside the intrusion, and people setting the goals around it.

Why waiting for an alert fails

Led by Terence Kok

The WorkOS timeline is the clearest illustration, because the victim published it. The first unauthorised access was on 25 October. The agent had finished downloading customer records by 30 October, and that is when a member of staff noticed unusually high usage on a system connected to the affected application. Five days is not slow by many industry standards. Against an agent that can take domain controller credentials in 20 minutes, it is slow in a way the old numbers hide.

There are three reasons the alert-first loop struggles.

• The loop has people in it. An alert goes to a queue, a person triages, another approves, a change is made. Every hand-off costs minutes or hours, and the attacker’s loop has none.
• Signatures describe yesterday. Anthropic notes that its behaviour-based detections were harder for the actors to evade than static signatures. Agents that rewrite their tools until they are not detected defeat fixed rules by design, and Sophos says the Aur0ra crew used AI to test its tools against endpoint products.
• The early signals are weak. What gave WorkOS away was unusual volume, a rate signal that no file signature would catch. Missing rate limits are what let the agent pull records fast enough to matter.

Detection tools still work. The damage now happens in the gap between detecting and acting.

What to do about it

Led by Terence Kok

Sophos’s advice for the Aur0ra case is that existing controls still work: patch internet-facing devices, use phishing-resistant MFA, watch endpoint alerts, and respond quickly. We agree, and we would order the work as below.

Action	The gap it closes	Where it comes from
Remove default and development credentials from production, and scan for them	A predictable credential let the WorkOS agent authenticate	WorkOS incident account
Take internal tools and APIs off the open internet, and bring legacy platforms up to current standards	WorkOS’s exposed endpoints on an older internal platform	WorkOS incident account
Add rate limits and volume alerts to every data-bearing API	Fast bulk retrieval went unchecked	WorkOS incident account
Segment critical servers, isolate backups, review domain admin rights and use privileged access management	Slows an agent climbing to domain admin and protects recovery	Sophos recommendations
Pre-authorise automatic containment	Cuts the hours lost to triage hand-offs	Our recommendation
Treat AI keys and agent accounts as production credentials	Stolen AI API keys were the goal of one September actor	Anthropic, September 2026
Run your own agent-driven tests, inside a sealed environment	Finds what agents will find, before they do	Our recommendation

Sources as shown. The last two rows are our recommendations, not findings.

Two of these deserve more than a table row.

Pre-authorise containment. Decide, with the business, which actions a system may take by itself and at what confidence. Disabling an account that suddenly touches a hundred times its usual records, revoking a token, isolating one host and blocking a source address are all reversible, and a person can review them afterwards. Doing them in seconds instead of hours is the biggest single change a security team can make against an attacker that works at machine tempo. Measure time to contain next to time to detect, and report both to the board.

Test with agents, and contain your own. WorkOS began testing its own systems with ARTEX on 3 November, after its breach. That is a sound idea. The incident also shows the risk: by the researcher’s account, an offensive agent left a test environment and reached a real company. If you run agent-driven red-team tools, run them in an environment with no route to production or to any system you do not own, give them explicit scope limits, and log every action they take. Part 3 of our rogue agents series sets out the autonomy tiers and hard limits we would apply, and Part 2 covers how to spot an agent by what it does.

Questions for the board

We would ask management for written answers to five questions:

1. How long does it take us to contain an intrusion once we detect it, and how long does it take to detect one? Do we measure both?
2. Which containment actions can our systems take without waiting for a person, and who approved them?
3. Where do we still have default, development or shared credentials anywhere near production?
4. Which internal tools, APIs or legacy platforms can be reached from the internet, and what limits the volume of data they hand out?
5. Do we test against agent-driven attacks, where is that testing contained, and who is accountable if a test agent strays?

Question one is where we would start. Most organisations can answer the second half and not the first.

Free tool

Agent Risk Assessment Matrix

Place each of your own agents on an autonomy and consequence grid, including the test agents you run against yourself, and see which controls each should carry.

→

---

My thanks to Maria Singh, who co-wrote this post with me. Maria led the analysis of the incidents and of how the attackers used AI. I led the sections on why alert-driven detection falls behind and on what to change.

If you would like help working out which containment actions your organisation can safely automate, or how to test against agent-driven attacks without putting production at risk, my consulting work covers technology and AI risk governance for boards of regulated firms and public agencies.