Notifications
Clear all
Topic starter
18/08/2026 2:11 pm
TL;DR: Code execution was achieved on 97.8% of autonomous offensive-security agents in tests, often reaching credentials, persistence, and host control, according to CRACKEN. The core problem is assumption collapse: current review and sandbox models assume agent behaviour is predictable enough to contain after the fact, but autonomous attackers act and escalate inside the same session.
NHIMG editorial — based on content published by CRACKEN: Project BlackSea and the detection of AI-driven attacks before they reach real assets
By the numbers:
- Security teams got code execution on 97.8% of the autonomous offensive-security agents they audited, according to CRACKEN.
Questions worth separating out
Q: What breaks when AI agents are given broad standing access?
A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check.
Q: Why do NHIs complicate zero trust and least privilege efforts?
A: NHIs complicate zero trust because they are numerous, persistent, and often tightly integrated into applications and pipelines.
Q: How do security teams know if an AI agent sandbox is actually working?
A: A working sandbox should stop execution, block privilege expansion, and prevent the agent from touching sensitive context even when the model is manipulated.
Practitioner guidance
- Map autonomous agent authority to a live blast-radius model Inventory every agent that can select tools, run code, or touch credentials without a human approval gate.
- Separate execution containment from decision containment Test whether your sandbox only limits where code runs or also blocks tool selection, file access, and self-directed escalation.
- Deploy deceptive assets where agents naturally inspect Place decoy vaults, fake unpacking tools, and similar bait in directories the agent will search during recon.
What's in the full article
CRACKEN's full article covers the operational detail this post intentionally leaves for the source:
- The lure-engine design, including how deceptive assets trigger execution on the attacker's machine.
- The full kill-chain walk-through from worker RCE to sandbox escape, persistence, and host compromise.
- The agent test matrix and comparative results across production offensive-security tools.
- The active-intervention mechanics that let the defender disrupt the campaign at its source.
👉 Read CRACKEN's analysis of Project BlackSea and autonomous AI attackers →
Autonomous AI attacker tools: are your controls keeping up?
Explore further
18/08/2026 3:03 pm
Autonomous attacker agents invalidate the assumption that identity can be reviewed after execution. Access review, sandbox review, and post-run audit all presuppose that action persists long enough to be observed and certified. BlackSea's findings show that an autonomous agent can complete recon, execution, and escalation inside the same window. The implication is that governance for autonomous actors must be designed around pre-execution constraints and runtime invariants, not retrospective certification.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, according to AI Agents: The New Attack Surface report.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including unauthorised access, inappropriately sharing sensitive data, and revealing credentials.
A question worth separating out:
Q: Who is accountable when an autonomous agent misuses access or exposes data?
A: Accountability should sit with the team that owns the agent lifecycle, policy, and runtime enforcement, not with the agent itself or with the model provider alone. If multiple groups share the control plane, they still need one named governance owner for recertification, monitoring, and incident escalation. Otherwise, the gap becomes a governance failure, not a technical one.
👉 Read our full editorial: Autonomous AI attacker tools expose a 97.8% control gap
