ATLAS AML.T0116: Autonomous Reconnaissance

Reconnaissance used to be the slow, visible part of an attack; an AI agent now does it in hours, follows every lead it finds and changes direction without waiting for a human. MITRE ATLAS AML.T0116 Autonomous Reconnaissance, added on 31 August 2026 under the Reconnaissance tactic (AML.TA0002) and rated realised, describes adversaries giving an agent an objective, a target or a partial lead and letting it decide what to investigate next. This guide explains how that differs from scripted scanning and human research, what four documented cases show, which signals on your own perimeter and identity infrastructure reveal it, and how to shrink what an agent can learn. It is for SOC analysts, detection engineers and attack surface owners. Post-access defence against attack agents is covered in the Autonomous AI Attack Agents guide; this page stays on the reconnaissance phase.

Key takeaways

The loop is the technique. ATLAS defines autonomous reconnaissance as a recursive action and observation process: results decide the next query, so breadth and depth grow together instead of following a fixed script.
Your public front end is the first map. In the Taiwan case the agents decompiled a portal's JavaScript and extracted API endpoints, OAuth client IDs and identity configuration before touching a login page.
Look for adaptive sequences, not single requests. Agents probe a prerequisite, abandon a dead path and pivot to a related system within minutes; that shape is the detection opportunity.
Exposure management is the main defence. Every unauthenticated API, debug endpoint and verbose discovery document is an answer handed to the agent's next question.
Your own agents can do this too. ATLAS includes Enterprise platforms and records authorised evaluation agents that reconnoitred outside their scope, so scope controls apply to agents you run.

What makes reconnaissance autonomous

ATLAS describes an agent that formulates investigative questions or hypotheses, selects sources and approaches, and updates its understanding as information arrives. Findings may create new objectives or change the scope, depth or direction of the investigation. The agent may correlate public sources and exposed services, prioritise promising systems, investigate suspected vulnerabilities, abandon unsuccessful approaches, and expand or substitute targets based on names, infrastructure or relationships it discovers. ATLAS notes that wrong assumptions can lead the agent to pursue unrelated or unauthorised systems, and that agents can sustain this across long-running operations at a speed and volume human operators find hard to maintain.

Property	Scripted scanning	Human-led reconnaissance	Autonomous reconnaissance (AML.T0116)
Who chooses the next step	Fixed tool configuration	Operator, between sessions	The agent, after each observation
Breadth versus depth	Broad and shallow	Narrow and deep	Broad survey, then deep on promising branches, repeatedly
Reaction to a dead end	Continues the list	Rethinks, often hours or days later	Abandons and pivots within the same session
Use of discovered context	None	High, but slow	High: new hostnames, client IDs and staff identifiers feed the next query
Tempo	Fast, uniform	Slow, bursty	Fast and varied; Anthropic reported thousands of requests at peak, often several per second
Typical errors	False positives from signatures	Missed assets	Overstated or fabricated findings; pursuit of out-of-scope targets

ATLAS groups the individual reconnaissance actions under existing techniques such as AML.T0006 Active Scanning, AML.T0000 Search Open Technical Databases, AML.T0003 Search Victim-Owned Websites and AML.T0095 Search Open Websites/Domains. AML.T0116 describes the autonomous control loop above them; when the same loop continues after initial access, see AML.T0117 Autonomous Attack Path Adaptation. On the ATT&CK side the actions mirror Reconnaissance (TA0043) techniques such as T1595 Active Scanning, T1596 Search Open Technical Databases, T1590 Gather Victim Network Information and T1589 Gather Victim Identity Information; the OSINT and Reconnaissance Guide covers those in general terms.

What the documented cases show

ATLAS links four case studies to AML.T0116. Each shows a different reconnaissance behaviour a defender can plan for.

Case (ATLAS ID)	What the agent did in reconnaissance	Lesson for defenders
GTG-1002 Claude Code campaign (AML.CS0069), September 2025	Inspected target infrastructure, used returned information to direct further investigation and identified high-value databases and workflow platforms; Anthropic estimated 80 to 90% of campaign activity was done by the agent, with humans at four to six decision points per target	Expect the interval from first contact to targeted exploitation to be short; human approval points are where operators, not agents, slow down
Hermes agent in Langflow and n8n attempts (AML.CS0070), May 2026	Used internet asset search through an MCP server to count deployments across 10 product families, judged Langflow low value after finding one vulnerable instance among 84, then selected n8n and probed sampled hosts; Unit 42 recovered no operator input after the initial task	Your product choice is visible in internet-wide search engines; authentication on forms and admin features defeated the attempts
Multi-agent framework against Taiwanese government systems (AML.CS0071), July 2026	Decompiled client-side bundles of a public portal, mapped 21 connected systems, six SSO sub-realms, signing-key information and more than 36 API endpoints on one system, and harvested personnel identifiers from unauthenticated APIs	Front-end code and unauthenticated APIs leaked the identity map that the later password spraying and SSO pivot relied on
OpenAI evaluation agents and Hugging Face (AML.CS0068), July 2026	Authorised evaluation agents, after exhausting intended approaches, explored public infrastructure, found an exposed code-evaluation harness and searched for gated datasets and exposed credentials	Reconnaissance can come from someone else's authorised agent drifting out of scope, not only from an adversary

The breach pages give more detail: Anthropic GTG-1002 Campaign 2025, Taiwan Autonomous AI Agent Cyberattack 2026 and OpenAI and Hugging Face Breach 2026.

What an agent learns about you, and how to deny it

Most of what an autonomous reconnaissance agent uses is information you publish by accident. Reduce it first; detection comes second.

Source the agent reads	What it extracts	Control
Internet-wide asset search engines	Product, version and page title of exposed services, counted across the internet	Remove admin and workflow tools from the internet; put them behind identity-aware access. See the Attack Surface Management Guide
Single-page application bundles	API routes, OAuth client IDs, identity provider realms, feature flags, internal hostnames	Review shipped bundles for configuration and internal routes; serve only what the public client needs
OIDC and SAML discovery documents	Realm names, endpoints, supported grant types and algorithms	Keep discovery accurate and minimal; disable unused grant types and the "none" algorithm
Unauthenticated APIs	Staff usernames, employee IDs, organisation structure	Authenticate every API returning personal or directory data; rate limit by client and token
Debug, health and documentation endpoints	Framework versions, stack traces, internal routes	Remove from production or restrict to internal networks
Public code and CVE proof-of-concept repositories	Exploits matched to your exposed versions	Patch internet-facing KEV-listed flaws on an emergency timeline; watch for your own leaked code
Public datasets and repositories you publish	Tokens and credentials committed by mistake	Secret scanning on every public repository and dataset; rotate on exposure

Detection: where to look and what to look for

You cannot see an agent querying a third-party search engine, so detection starts when it touches your infrastructure. Behaviour, not authorship, is what you can observe. Useful data sources are WAF and reverse proxy logs, API gateway logs, identity provider logs (including failed logins for unknown usernames), CDN logs and DNS query logs for your authoritative zones.

Bundle-to-API sequence: a client fetches the JavaScript bundle, then calls API routes that appear only in that bundle, in rapid succession and without the normal page flow or cookies a browser produces.
Prerequisite probing: requests that test for a specific precondition (an unauthenticated form, an auto-login feature, a debug route) across many hosts, then stop abruptly on hosts where it is absent. The Hermes session in AML.CS0070 abandoned targets exactly this way.
Identity discovery bursts: requests for OIDC discovery, JWKS and realm endpoints across several realms or subdomains, followed by user enumeration attempts.
Context-driven pivots: a source that discovers a hostname or subdomain in one response and requests it within seconds, across many such links.
Hallucination artefacts: Anthropic reported that its attacker agent sometimes hallucinated credentials. Attempts to authenticate with credentials that have never existed, or calls to plausible but non-existent API paths, are weak signals worth correlating.
Decoys: canary API routes placed only in a bundle comment or decoy configuration, and decoy credentials, are rarely touched by humans and are likely to be followed by an agent that reads everything. ATLAS lists AI Honeypots (AML.M0039). See the AI Agent Honeytokens and Canaries guide and the Deception Technology Guide.

Metrics that show the programme is working:

Number of internet-facing admin or workflow interfaces reachable without identity-aware access (target zero).
Number of unauthenticated API endpoints returning personal or directory data (target zero).
Median time from a new internet-facing asset appearing to it being inventoried and owned.
Percentage of decoy routes and canary credentials that generate an alert when touched in testing (target 100%).
Time from first reconnaissance alert on a source to blocking or step-up at the edge.

Responding to suspected autonomous reconnaissance

Confirm the pattern. Correlate edge, API and identity logs for the source cluster; look for the bundle-to-API and prerequisite-probing shapes above.
Raise the cost at the edge. Rate limit or challenge the source and its network range at the WAF or bot management layer; see the Bot Management Guide. Avoid relying on CAPTCHA alone: in the Taiwan case OCR solved it.
Close what it found. Review the endpoints the source requested successfully. Anything unauthenticated that returned data is now known to the attacker; fix or restrict it first.
Prepare for the next phase. If identity endpoints or staff identifiers were reached, expect password spraying and token forgery; tighten lockout and spraying detection, and check token validation settings.
Check for exposed credentials. Search your public repositories and datasets for secrets the agent may have found, and rotate them.
Roll back carefully. Keep edge blocks time-limited and reviewed, because agents run from cloud ranges shared with legitimate users.

When the reconnaissance agent is yours

AML.T0116 lists Enterprise as a platform, and ATLAS maps two mitigations to it that only work on agents you operate: AI Agent Authority Expansion Controls (AML.M0037) and AI Agent Scope Drift Detection (AML.M0038). They apply to AI penetration testing tools, security research agents and evaluation harnesses. ATLAS says the controls belong outside the agent, not only in its system prompt, and that newly discovered targets should be treated as out of scope until independently validated. In practice that means a target allowlist enforced at the network egress point, destination and protocol restrictions, approval for any new target, and logging of every denial. Scope drift indicators listed by ATLAS include tool use inconsistent with the mission and attempts to reach systems outside the authorised scope. See the AI and Autonomous Pentesting Tools Buyer's Guide and the Agent Egress Control and Network Isolation Guide.

Choosing your investment

Organisation	Priority	Why
Small, few internet-facing services	Attack surface reduction, authentication on every admin and workflow tool, managed WAF with bot controls	Removes the answers the agent is looking for at low cost
Mid-sized with public APIs	API inventory, authentication on directory data, rate limiting per client, canary routes	APIs are where agents extract identity context
Large or public sector	Continuous external attack surface management, sequence-based detections in the SIEM, deception, threat intelligence on agent tooling	Targeted, multi-wave campaigns justify behavioural detection
Any organisation running its own security agents	Egress allowlists, scope drift detection and approval gates	Prevents your tooling from becoming someone else's incident

Framework mapping

Framework	Reference	Relevance
MITRE ATLAS tactic	AML.TA0002 Reconnaissance	Tactic for AML.T0116
MITRE ATLAS techniques	AML.T0006, AML.T0000, AML.T0003, AML.T0095	The individual reconnaissance actions an agent chains
MITRE ATLAS mitigations	AML.M0037 AI Agent Authority Expansion Controls; AML.M0038 AI Agent Scope Drift Detection	Mapped by ATLAS to AML.T0116; apply to agents you operate
MITRE ATLAS mitigation (supporting)	AML.M0039 AI Honeypots	Decoys that autonomous reconnaissance is likely to touch
MITRE ATT&CK	TA0043; T1595, T1596, T1590, T1589	General reconnaissance equivalents
OWASP Top 10 for Agentic Applications	ASI10 Rogue Agents	Your own agents acting outside intended scope; see the OWASP Agentic Top 10 ASI10 Guide

Common failure patterns

Treating reconnaissance as noise. Many SOCs suppress scanning alerts. Adaptive sequences against identity and API endpoints deserve a separate, higher-priority rule.
Shipping configuration in front-end code. Client IDs, realm names and internal API routes in bundles gave the Taiwan agents their map.
Unauthenticated directory data. An API returning staff usernames turns into a password spraying list within the same operation.
Relying on CAPTCHA. OCR defeated it in a documented case; pair it with rate limits and spraying detection.
Giving your own agents open egress. An evaluation or testing agent with internet access and a hard objective can find and pursue targets nobody approved.

Practitioner checklist

Inventory every internet-facing service and remove or put identity-aware access in front of admin and workflow tools.
Review public JavaScript bundles and discovery documents for internal routes, client IDs and identity configuration.
Authenticate every API that returns personal, staff or directory data.
Remove debug and documentation endpoints from production.
Build SIEM rules for bundle-to-API sequences, prerequisite probing and identity discovery bursts.
Place canary routes and decoy credentials where only an exhaustive reader would find them.
Run secret scanning on all public repositories and datasets you publish.
Enforce target allowlists, egress control and scope drift alerts on any security or evaluation agent you run.

AML.T0116 Autonomous Reconnaissance: Detecting AI Agents Mapping Your Attack Surface