AI-orchestrated attacks expose the limits of reactive detection

At a glance

What this is: This analysis argues that AI-orchestrated attacks can run most of an intrusion chain autonomously, making reactive detection too slow to catch reconnaissance, credential access, and exfiltration in time.

Why it matters: For IAM, NHI, and security teams, the implication is that detection needs to move closer to identity issuance, privilege use, and asset interaction rather than waiting for post-factum anomalies.

Context

AI-orchestrated attacks are attack chains in which an AI agent executes most of the work across reconnaissance, exploitation, movement, and exfiltration with only limited human prompts and checkpoint approvals. In this article, Acalvio uses Anthropic’s November 2025 report to argue that reactive detection models built for human-paced threats no longer match the tempo of agentic intrusion workflows.

The governance gap is not just speed. Traditional anomaly and rule-based detection assume malicious behaviour arrives in bursts that are slow enough to baseline, label, and correlate. When the attacker can assemble commodity tools into many possible sequences and progress through the chain at machine speed, the control point shifts from post-event detection to earlier intent-based interception around high-value assets and identity paths.

Key questions

Q: What fails when detection assumes attackers move at human speed?

A: Reactive detection fails when the attacker can compress reconnaissance, credential access, and movement into one machine-speed sequence. The control window shrinks so much that alerts often arrive after the identity path has already been abused. That makes delayed anomaly scoring a poor fit for AI-orchestrated intrusion chains.

Q: Why do AI-orchestrated attacks create such a problem for identity and access controls?

A: They compress identity misuse into a short automated sequence, so stale privileges, cached credentials, and broad scope can be harvested and used before review or revocation catches up. The risk is not only more automation. It is the loss of time between access discovery and harmful use.

Q: How do deception controls help when an AI agent is driving the attack chain?

A: Deception helps by turning likely attacker steps into high-confidence detection points. A decoy or honeytoken does not need to predict every attack path. It only needs to look credible enough that the agent interacts with it, which gives defenders early visibility and a chance to contain the intrusion before impact.

Q: What should teams do when reactive detections keep missing automated intrusions?

A: They should move the control point earlier in the path of execution by instrumenting identity stores, high-value assets, and likely attack routes with traps and constrained access. That way, malicious contact is detected at the point of interaction instead of after the attack has already progressed.

Technical breakdown

Why reactive anomaly detection misses AI-orchestrated attack chains

Reactive anomaly detection relies on a baseline of normal activity and a time window long enough for suspicious behaviour to stand out. That assumption breaks when an AI agent can run reconnaissance, scanning, exploitation, and credential harvesting concurrently, not sequentially, and do so much faster than human operators. The alert may still fire, but by then the attack has often moved beyond the stage where it can be contained cleanly. In identity terms, the issue is not just more noise. It is a collapse in the observation window that detection engineering depends on.

Practical implication: move detection closer to the point of identity use and asset interaction instead of relying on delayed anomaly scoring.

How deception changes the detection problem for identity and assets

Deception works by placing honeytokens and decoys where a malicious agent is likely to look first. A honeytoken is a deceptive credential or identity artifact that should never be used in legitimate operation, while a decoy asset imitates something valuable enough to attract attacker interest. The advantage is that deception does not require predicting the exact attack sequence. It only needs to detect contact with an object that should have remained untouched. For agentic attacks, that gives defenders a high-confidence signal early in the chain, often before lateral movement or exfiltration begins.

Practical implication: instrument high-value identity stores and asset paths with tripwires that are designed to be touched only by malicious activity.

Why machine-speed exploitation changes privilege and credential risk

Agentic attacks compress the time between discovery and credential abuse. That matters because many IAM and NHI controls assume there is a meaningful gap between acquisition, use, review, and revocation. If an agent can discover an asset, probe it, harvest credentials, and pivot in a single automated sequence, then stale privileges and cached credentials become far more dangerous than they appear in a human-paced model. The technical issue is not simply automation. It is the ability to chain small actions into one continuous exploit path before defenders can intervene.

Practical implication: treat standing privilege, cached credentials, and broad identity scope as active attack enablers in machine-speed environments.

Threat narrative

Attacker objective: The objective is to complete a full intrusion chain fast enough to reach sensitive data or control paths before defenders can respond.

1. Entry begins when the attacker initiates the AI agent with prompts and occasional approvals, then uses it to explore the target environment at machine speed.
2. Credential access follows when the agent harvests usable credentials during reconnaissance and exploitation, turning discovery into authenticated reach.
3. Escalation and lateral movement occur as the agent combines tools and sequences to expand access across systems and identity boundaries.
4. Impact arrives when the chain reaches data access or exfiltration before reactive controls can intervene.

Breaches seen in the wild

• Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.
• Taiwan autonomous AI agent cyberattack 2026: Up to eight autonomous AI agents cracked 85 Taiwanese government accounts, pivoted through SSO and exfiltrated 2,564+ personnel records.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Reactive detection assumes an attack remains observable long enough for humans to react. That assumption fails when an agent can compress reconnaissance, credential use, and movement into one machine-speed workflow. The practical implication is that detection strategy has to shift from waiting for suspicious patterns to placing controls where the agent must interact with the environment.

Intent-based interception is now more useful than post-factum anomaly hunting. In an AI-orchestrated chain, the attacker can vary the exact path often enough to defeat static rules and still outrun threshold-based alerts. That makes early traps around identity stores and high-value assets a governance control, not just a deception technique.

Identity review cycles are misaligned to agentic execution. Access review and privileged access governance were built around privileges that persist long enough to be inspected and certified. When the attacker can consume, chain, and abandon access inside the same attack session, the programme has to care more about issuance, scope, and interaction points than retrospective certification.

Ephemeral credential trust debt: ephemeral or cached credentials that look low-risk in inventory can become high-risk when an agent can discover and exploit them before revocation catches up. That turns stale access, cached secrets, and broad privilege into latent attack fuel rather than administrative residue. Practitioners should treat every reachable identity artefact as a potential tripwire or pivot point.

Agentic attack detection belongs in the identity layer as much as the network layer. The article shows that the earliest reliable signal may come from a deceptive credential, a decoy asset, or an unexpected touch on an identity store. That broadens the detection surface for identity teams and puts preemptive controls inside the path of execution, not after it.

What this signals

Reactive monitoring is now a lagging control for machine-speed intrusion. Identity teams should assume that any detection model built around human pacing will miss part of an AI-orchestrated chain. The practical shift is toward pre-positioned traps, narrower access scope, and earlier signal collection around the identities and assets that matter most.

Identity programmes need a control plane for interaction, not just for entitlement. The new failure mode is not only overprivilege, but the speed at which an agent can turn a reachable credential or asset into reach across the environment. That makes identity-store instrumentation and decoy placement part of operational monitoring, not an optional add-on.

For practitioners

• Deploy deception around high-value identity paths Place honeytokens, decoy credentials, and synthetic assets near directories, vaults, and systems an attacker would enumerate first so malicious contact produces an immediate signal.
• Reduce the attack surface available to automated abuse Remove stale privileges, delete cached credentials, and segment the most valuable systems so an agent cannot turn discovery into fast lateral movement.
• Move alerting closer to identity interaction Prioritise controls that fire when an identity artefact is touched, used, or enumerated rather than waiting for post-exploitation behavioural anomalies.
• Review whether current detections assume human pace Test anomaly and rule-based detections against concurrent reconnaissance, credential access, and exploitation to find where the monitoring model depends on slow attacker behaviour.

Key takeaways

• AI-orchestrated attacks expose a structural weakness in reactive detection: the attacker can move from reconnaissance to exfiltration before human-paced controls react.
• The article’s central evidence is that more than 80% to 90% of the exploit can be executed by the agent, which compresses the usable response window.
• Defenders need earlier signals near identity stores and high-value assets because delaying the first reliable alert until after anomaly detection is too late.

Key terms

• AI-orchestrated attack chain: An AI-orchestrated attack chain is a sequence of intrusion steps where an AI system performs much of the operational work at runtime. In identity terms, the important issue is not the model itself, but the credentials, tools, and delegated access it uses to move from entry to impact.
• Deception Detection: Deception detection uses decoys, traps, or synthetic assets to identify attacker behaviour that would not occur in normal use. When an intruder touches a decoy, defenders gain a high-confidence signal of malicious activity, often earlier in the attack chain and with fewer false positives than broad anomaly detection.
• Honeytoken: A honeytoken is a deliberately planted secret or credential designed to be detected when used. It helps security teams spot misuse early, especially in environments where machine identities and automation can move faster than manual investigation or containment.
• Machine-Speed Exploitability: The condition where vulnerability discovery, exploit creation, and attack chaining happen faster than human remediation workflows. It matters because disclosure, testing, and patch approval no longer keep pace with the rate at which attackers can weaponise a flaw.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.