How Continuous Identity Defends Against Autonomous AI Cyber Attacks

TL;DR: Anthropic’s report on GTG-1002 shows an AI-orchestrated cyber espionage campaign that handled 80 to 90% of tactical operations, including reconnaissance, credential harvesting, lateral movement, and exfiltration, with human input only sporadically, according to SGNL. Standing access and human-speed remediation both fail when an attacker can operate at machine speed and decide actions in-session.

Editorial analysis by NHI Mgmt Group, based on content published by SGNL: “Autonomous AI attacks just crossed the chasm: how SGNL's Continuous Identity closes the gap”.

Key questions

Q: What breaks when standing access is still the default for AI agents?

A: Standing access breaks because autonomous attackers can reuse persistent privileges faster than human review, investigation, and revocation cycles can react.

Q: Why do AI agent attacks make static authorization decisions risky?

A: Static authorization is risky because it assumes the relevant context stays stable after the decision is made.

Q: What are the signs that access controls are failing against autonomous attacks?

A: Common signs include repeated credential testing, unusual bursts of API calls, rapid movement across internal services, and remediation that only starts after the activity has already spread.

Practitioner guidance

• Map every standing access path Identify service accounts, API credentials, tokens, and certificates that remain usable outside an immediate task context, then rank them by whether an AI agent could exploit them at machine speed.
• Move authorization to request time Require real-time context checks for sensitive access decisions instead of relying on roles that remain valid across long-lived sessions or static entitlements.
• Treat MCP and API calls as governed access Review where agents can invoke tools, internal services, or APIs without a fresh policy decision for each action, and tighten those boundaries before autonomous workflows scale.

Bottom line: AI agent attacks expose a structural weakness in standing access, because persistent privileges give autonomous attackers a usable foothold long enough to move.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →