Autonomous AI Attack Agents: How SOCs detect and contain machine-speed intrusions

Intrusions are now being run by AI agents that scan, exploit, harvest credentials and move laterally faster than a human analyst can open a ticket. In November 2025 Anthropic reported a state-sponsored espionage campaign in which an agent framework built on Claude Code performed an estimated 80 to 90 percent of the tactical work, with humans stepping in at only four to six decision points per campaign. In July 2026 researchers described an agent that exploited a Langflow flaw and destroyed a production database using harvested and default credentials. This guide is the defender's view: how these operations work at the level a SOC needs, where they show up in telemetry, and how to detect and contain activity that moves at machine speed. It is written for SOC leads, detection engineers, incident responders and security architects. Broader AI-enabled threats such as phishing and deepfakes are covered in the AI-Powered Cyber Attacks Guide.

Key takeaways

• The techniques are familiar, the tempo is not. Agents still scan, exploit public-facing applications and abuse valid accounts; what changes is the rate (Anthropic saw thousands of requests, often several per second) and the parallelism across targets.
• Machine credentials are the fuel. Both public cases relied on harvested API keys, cloud credentials and default passwords; agents find and try secrets far faster than people do.
• Human response times lose. A playbook that waits for an analyst to approve containment gives an agent hours of uncontested access; pre-approve automated containment for high-confidence signals.
• Agents make mistakes defenders can use. Anthropic reported its model hallucinating credentials and overstating findings; failed logins with invented credentials and noisy enumeration are detectable.
• Full autonomy is not yet the norm. The UK NCSC judged fully automated end-to-end advanced attacks unlikely before 2027, so expect hybrid operations with human operators at key decisions.

How the attack works

An autonomous attack agent is an orchestration layer that gives a language model a goal, a set of tools (scanners, exploit frameworks, credential tools, shells) and a loop that feeds tool output back to the model. The model plans the next step; the tools act. In Anthropic's case the tools were connected through the Model Context Protocol, and the operators avoided safety controls by splitting the operation into small tasks that looked innocuous in isolation and by telling the model it worked for a legitimate security firm doing defensive testing (ATLAS AML.T0054 LLM Jailbreak).

MITRE ATLAS now names this behaviour directly. Release 2026.09 includes Autonomous Reconnaissance (AML.T0116), Autonomous Attack-Path Adaptation (AML.T0117), where an agent derives intermediate objectives and revises its route from observations, and Autonomous Attack Orchestration (AML.T0124), where one system directs several agents or sub-agents. ATLAS records the Anthropic campaign as case study AML.CS0069 (GTG-1002) and a May 2026 Unit 42 case, AML.CS0070, in which an agent framework using DeepSeek as its reasoning engine searched for targets, obtained public exploits, ran scans and revised its approach against Langflow and n8n with no further operator input recovered for the session.

A related pattern is malware that calls an LLM at runtime. Google's Threat Intelligence Group reported in November 2025 that PROMPTSTEAL, used by APT28 and reported by CERT-UA as LAMEHUG (ATLAS case study AML.CS0044), queries a hosted model to generate Windows commands for collecting system information and documents (ATLAS AML.T0102 Generate Malicious Commands). GTIG also described QUIETVAULT, a credential stealer that uses on-host AI command line tools to hunt for further secrets.

Where it shows up

• Internet-facing applications and AI tooling: unpatched workflow and low-code AI platforms are attractive because they hold credentials. The JADEPUFFER agent entered through CVE-2025-3248, a missing-authentication flaw in Langflow listed in the CISA KEV catalogue with known ransomware use. See the Flowise and Langflow Security Guide.
• Cloud control planes: harvested access keys used against storage, secrets and IAM APIs at rates no administrator produces.
• Databases and data services: default or root credentials on MinIO, MySQL and configuration services were all used in JADEPUFFER.
• Identity providers: rapid authentication attempts across many accounts and services, including credentials that never existed.
• Developer endpoints: AI coding agents and CLIs already installed on a host can be turned against it, as GTIG described for QUIETVAULT.
• Outbound traffic to AI APIs: malware that calls a hosted model needs an API key and network access to an AI service, which proxy and DNS logs can reveal.

Impact

Speed compresses every defender timeline. The NCSC noted that the time between vulnerability disclosure and exploitation has already shrunk to days and expects AI to shorten it further. For a SOC, that means the window between first scan and impact can fall inside a single shift. The JADEPUFFER case shows the second effect: an agent acting on systems it does not understand can cause irreversible damage. It encrypted 1,342 configuration items with a key it never saved, so the data could not be recovered even by paying. Scale is the third: Anthropic's campaign targeted around thirty organisations at once, with a small number breached. Small and mid-sized organisations that relied on not being worth an attacker's time lose that protection when the marginal cost of an attack falls.

Detection

Detect behaviour, not authorship. You cannot reliably tell whether code or commands were written by a model, but you can see rates, breadth and error patterns that humans do not produce. Most of these detections are rate and sequence based, so they need logs with accurate timestamps and a SIEM or data platform that can window by seconds.

Honeytokens are especially effective against agents because exhaustive credential searching finds them and tries them. ATLAS added AI Honeypots (AML.M0039) in September 2026: decoy AI services, agents and credentials that no legitimate workflow touches, so any interaction is a high-confidence signal. See the Honeytokens and Canary Credentials Guide.

Metrics: mean time from first high-confidence alert to containment (target minutes, not hours); percentage of high-confidence detections with pre-approved automated containment; time to rotate a compromised machine credential; share of internet-facing KEV-listed vulnerabilities remediated within your emergency window; number of default credentials found by internal scanning (target zero).

Prevention and hardening

1. Shrink the exposed surface. Inventory internet-facing services, especially AI workflow platforms, notebooks and model servers. Put admin interfaces behind identity-aware access. Prioritise KEV-listed flaws with an emergency patching path; see the Emergency Out-of-Band Patching Playbook.
2. Remove ambient secrets. Take credentials out of environment variables and files on internet-facing hosts; use workload identity and short-lived tokens so that a harvested credential expires quickly. See the Secrets Management Guide.
3. Eliminate defaults. Scan for vendor default passwords and signing keys on databases, object stores and configuration services, and fail builds that ship them.
4. Segment by identity and network. Database admin accounts should not be reachable from application hosts or the internet; scope each machine identity to the services it needs.
5. Pre-approve automated containment. Agree in advance which signals (honeytoken use, credential spraying across services, mass secret reads) trigger automatic isolation, token revocation or account disablement. Test in a pilot with a short list of systems and an override path, then widen.
6. Govern your own AI tools. Restrict which hosts may call AI APIs, protect AI provider keys, and control coding agents on developer machines so they cannot be repurposed. ATLAS notes that agents given a legitimate objective can also drift into attack-path behaviour; its AI Agent Authority Expansion Controls (AML.M0037) and AI Agent Scope Drift Detection (AML.M0038) apply to your own authorised agents, including AI penetration testing tools. The LLMjacking Guide covers key abuse.
7. Rehearse at machine speed. Run tabletop and purple team exercises where the simulated attacker moves from initial access to impact in under an hour, and measure where the response stalls.

Small versus large organisations: smaller teams get most value from a managed detection service with authority to contain, patching KEV items quickly and removing defaults. Larger SOCs should invest in rate-based detections, SOAR playbooks with automated containment and their own AI-assisted triage; see the Agentic AI in the SOC Guide.

Lessons from incidents

• Anthropic, AI-orchestrated espionage (reported November 2025): detected in mid-September 2025, the campaign was mapped over about ten days, with accounts banned, affected organisations notified and authorities informed. Its lesson for defenders is the tempo: thousands of requests at peak, often several per second, with humans approving only a handful of decisions.
• JADEPUFFER (reported July 2026): the JADEPUFFER agentic ransomware attack chained a known Langflow flaw, harvested AI and cloud credentials, MinIO defaults, root MySQL credentials and a default Nacos JWT signing key. Every link in the chain was a machine credential or default that standard hygiene would have removed.
• PROMPTSTEAL and LAMEHUG (2025): the first malware GTIG observed querying an LLM in live operations. Egress controls and monitoring of AI API traffic from unexpected processes would have exposed it.

Framework mapping

Practitioner checklist

• Inventory internet-facing AI platforms and admin interfaces; put them behind identity-aware access.
• Remediate KEV-listed vulnerabilities on exposed systems within an emergency window.
• Remove secrets from environment variables and files on exposed hosts; move to short-lived workload credentials.
• Scan for and remove default passwords and signing keys across databases and services.
• Deploy honeytokens in configuration files, secret stores and code repositories.
• Build rate and breadth detections for exploitation bursts, secret reads, cross-service spraying and API enumeration.
• Pre-approve automated containment for high-confidence signals, with an override path.
• Monitor and restrict outbound traffic to AI provider APIs from servers and endpoints.
• Exercise a sub-one-hour intrusion scenario and fix the slowest step.

Standards and references

• NCSC: Impact of AI on cyber threat from now to 2027
• CISA: Known Exploited Vulnerabilities Catalog
• MITRE ATT&CK: Exploit Public-Facing Application
• MITRE ATT&CK: Credentials In Files
• MITRE ATLAS: Autonomous Attack Orchestration
• Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign
• Google Threat Intelligence Group: AI Threat Tracker, advances in threat actor usage of AI tools

Related NHI Mgmt Group resources: AI-Powered Cyber Attacks Guide · LLM-Powered Malware Guide · Honeytokens and Canary Credentials Guide · AI SOC Guide