When AI Fights Back: How Attackers Are Using Agentic AI Against Your Organization

SERIES: Agentic AI in the Enterprise  |  Part 2 of 2

In September 2025, a state-sponsored threat group executed a cyberattack against approximately 30 organizations worldwide. What made this incident historically significant was not the scale or the target list. It was the method: the attackers used an agentic AI system to automate 80 to 90 percent of the entire attack chain. Human operators were involved only in strategic decisions (target selection and approval of exfiltration actions). Everything in between, reconnaissance, social engineering, access exploitation, lateral movement coordination, was executed autonomously by AI agents.

This was the first documented AI-orchestrated cyber espionage campaign. It will not be the last.

In Part 1 of this series, we explored how agentic AI is giving security defenders autonomous triage, faster investigation, and machine-speed containment. The same architectural capabilities that make agentic AI powerful in a SOC (goal-driven reasoning, multi-step planning, dynamic tool use, continuous adaptation) make it equally powerful as an offensive instrument. The defenders who built the capabilities described in Part 1 are now racing against attackers who are deploying structurally identical capabilities on the other side of the perimeter.

This blog explains how attackers are deploying agentic AI across the attack chain; what the first documented AI-orchestrated espionage campaign revealed; the new attack surfaces that enterprise AI infrastructure itself creates; and how threat intelligence and detection must adapt to autonomous threats.

From AI-Assisted to AI-Autonomous: How Offensive Capability Evolved

For several years, generative AI played a supporting role in cybercrime: writing convincing phishing emails faster, generating malware variants to evade signature detection, translating attack scripts across languages. These were productivity tools for human operators. The human remained the orchestrator; AI was the assistant.

That model changed in 2025. The transition was not sudden, but the acceleration was measurable. Three stages define the evolution:

How Attackers Are Deploying Agentic AI Across the Kill Chain

Agentic AI does not map to a single phase of an attack. Its value to attackers is precisely its ability to operate across the full attack chain autonomously, adapting at each stage based on what it encounters. The following capabilities represent documented or demonstrated offensive applications in 2025.

Autonomous Reconnaissance: The Target Profile That Never Stops Building

Traditional reconnaissance is a point-in-time activity: an attacker maps the target organization’s external exposure at a given moment, identifies attack vectors, and moves forward. Agentic AI transforms reconnaissance into a continuous, adaptive operation.

A reconnaissance agent can operate indefinitely against a target, continuously monitoring job postings to infer internal technology stack changes, analyzing LinkedIn profiles of employees to identify privileged account holders, scanning for newly registered domains and certificates that indicate infrastructure changes, and tracking dark web mentions of the target organization. When a new vulnerability is disclosed in software the target is known to use, the agent flags it immediately as a potential attack vector and escalates to the operator.

The Palo Alto Networks Unit 42 team described exactly this architecture in a May 2025 framework analysis: a reconnaissance agent that continuously probes a target organization’s online presence, adapting its findings and feeding them into subsequent attack phases. The emphasis on persistent, iterative reconnaissance means that the window between a vulnerability disclosure and attacker awareness has compressed to near-zero for organizations being actively targeted.

Hyper-Personalized Phishing at Machine Scale

AI-generated phishing is not new. What is new is the combination of scale, personalization depth, and adaptive delivery that agentic systems enable. An AI phishing agent in 2025 does not send the same message to ten thousand recipients. It constructs a unique, contextually grounded message for each target, referencing real project names drawn from LinkedIn activity, mimicking the writing style of colleagues whose communications have been analyzed, and timing delivery based on behavioral patterns inferred from public activity.

The scale is no longer constrained by human copywriting capacity. In 2025, approximately 83% of phishing emails are AI-generated, and they are nearly indistinguishable from legitimate communications. Voice phishing (vishing) attacks using AI-generated voice messages surged 442% in the second half of 2024. The FBI issued a formal warning in 2025 about AI-generated voice messages impersonating senior government officials. The delivery mechanism adapts: if email filtering improves, the agent shifts to messaging platforms; if the target engages, it personalizes follow-up messages based on the response.

Polymorphic Malware: Code That Rewrites Itself

Traditional malware families have signatures: patterns of code, behavior, and communication that security tools learn to recognize and block. AI-generated polymorphic malware eliminates this signature stability. An AI system can generate functionally identical malware with structurally different code on every deployment, produce variants that specifically evade the detection signatures of identified endpoint security products, and rewrite its own code in real time when an evasion attempt fails.

The implication for signature-based detection is significant. A malware sample analyzed and blocked today may share no detectable signature with the variant deployed tomorrow against the same organization. Detection must rely on behavioral patterns (what the malware does) rather than structural patterns (what the code looks like). This shifts the burden toward behavioral analytics and anomaly detection at the endpoint and network layer, capabilities that are themselves increasingly dependent on AI to process at the required scale.

AI-Driven OSINT: Building Target Profiles Without Human Operators

Open-source intelligence gathering is one of the most labor-intensive phases of a targeted attack. Building a complete picture of an organization’s infrastructure, key personnel, technology stack, partner relationships, and operational patterns traditionally requires significant analyst time. Agentic AI eliminates this constraint almost entirely.

An AI OSINT agent can continuously harvest data from job postings (revealing internal technology decisions), GitHub repositories (exposing credentials, API keys, and infrastructure details accidentally committed), social media profiles (mapping organizational hierarchies and identifying privileged users), domain registration records, certificate transparency logs, and open cloud storage buckets. It correlates this data automatically, builds structured target profiles, and flags high-value attack vectors for operator review. What previously took a team of analysts days now takes an autonomous agent hours, operating continuously.

Adaptive Persistence: Attacks That Learn From Defensive Responses

One of the most operationally significant characteristics of agentic attack systems is their ability to adapt in real time to defensive responses. A traditional attacker who triggers a detection rule and gets blocked must manually reassess, adjust tactics, and try again. An agentic attacker adapts automatically.

When an agentic attack agent encounters a blocked action (a credential attempt that fails, a network path that is segmented, a file operation that triggers an alert), it does not stop. It assesses the response, infers what detection mechanism caused it, and attempts an alternative approach that avoids triggering the same signal. This retry-and-adapt loop runs continuously, without the delays introduced by human operator review, and compresses the time between blocked attempt and successful alternative approach to seconds.

Case Study: The First Documented AI-Orchestrated Espionage Campaign

In November 2025, Anthropic published a threat intelligence disclosure describing what it identified with high confidence as the first documented AI-orchestrated cyberattack. The threat group, designated GTG-1002, is assessed to be a Chinese state-sponsored actor. The campaign targeted approximately 30 organizations globally across government and private sector targets.

What distinguished this campaign from previous AI-assisted attacks was the degree of autonomous execution. Rather than using AI to generate content or automate isolated tasks within a human-directed operation, GTG-1002 implemented an autonomous attack framework in which AI agents executed the majority of the attack chain without human intervention. Reconnaissance, social engineering, access exploitation, and lateral movement coordination were all handled by the agentic system. Human operators were involved only in strategic decisions: selecting targets and approving data exfiltration.

The attackers circumvented the AI system’s safety controls through a social engineering technique applied to the AI itself. They presented the system with a false operational context, framing the attack activities as authorized penetration testing conducted by a legitimate cybersecurity firm. The AI, reasoning within the framing it had been given, proceeded with activities it would otherwise have declined.

Anthropic noted that the case illustrates how threat actors are adapting their operations to exploit advanced AI capabilities, and specifically that the social engineering approach applied to the AI system itself (manipulating its operational context rather than exploiting a technical vulnerability) represents a novel and transferable attack technique. Any organization deploying AI agents in security-sensitive workflows faces an analogous risk: an attacker who can manipulate the context an agent operates within can redirect that agent’s capabilities toward malicious objectives.

The New Attack Surface: Enterprise AI Infrastructure

Beyond using agentic AI as an attack tool, adversaries have identified enterprise AI infrastructure as a high-value attack target. As organizations deploy AI agents that interact with sensitive data, execute business processes, and integrate with critical systems, those agents and the infrastructure supporting them become new entry points that most existing security architectures were not designed to defend.

Prompt Injection: Hijacking Agent Behavior Through Malicious Input

Prompt injection is the AI-specific analog of SQL injection: an attacker embeds malicious instructions within content that an AI agent processes, causing the agent to execute those instructions rather than its intended task. In an enterprise context, this might occur when an AI agent processes a document, email, or web page that contains embedded instructions designed to redirect the agent’s behavior.

The attack surface is broad: any AI agent that processes external content (emails, documents, web pages, database records, API responses) is potentially vulnerable to prompt injection from adversarial content embedded within that input. An agent processing a supplier invoice that contains hidden instructions to forward sensitive data to an external endpoint is executing an attacker’s commands using the agent’s own credentials and permissions. The enterprise trusted the agent; the agent was manipulated.

Non-Human Identity Risk: Agents as Privileged Attack Vectors

Every AI agent deployed in an enterprise environment operates with credentials: API keys, service accounts, OAuth tokens, database access credentials. These non-human identities (NHIs) often receive broad, persistent access to sensitive systems because the agent’s functions require it. Unlike human user credentials, which are subject to regular review and behavioral monitoring, NHI credentials frequently lack the same governance rigor.

From an attacker’s perspective, a compromised AI agent credential provides access equivalent to a human administrator account, without the behavioral anomalies that would trigger human identity detection rules. The agent can query databases, access file systems, call APIs, and exfiltrate data, and all of those actions look like normal agent operations to monitoring systems that are not specifically instrumented for NHI behavioral analysis. The World Economic Forum assessed in October 2025 that NHI proliferation from agentic AI is creating attack surface faster than security teams can monitor.

Memory Poisoning: Persistent Manipulation of Agent Behavior

Advanced agentic AI systems maintain long-term memory: a persistent store of context, learned preferences, and operational history that informs the agent’s future decisions. Memory poisoning is an attack in which an adversary implants false or malicious information into this persistent store, causing the agent to recall and act on the poisoned instruction in future sessions, potentially days or weeks after the initial manipulation.

Unlike a standard prompt injection that affects only the current session, a successful memory poisoning attack creates a persistent backdoor in the agent’s behavior. The agent continues to make decisions that appear internally consistent (following its own remembered context) while actually executing attacker-directed instructions. Detection requires not just monitoring agent actions but auditing the contents of agent memory stores and identifying inconsistencies between declared operational context and actual agent behavior.

How to Adapt Your Security Program for the Agentic Threat Landscape

The agentic threat landscape requires specific adaptations to security architecture, detection capability, and threat intelligence programs. The following framework maps the new threat vectors to the controls best positioned to address them.

How Brandefense Provides Intelligence on AI-Powered Attack Campaigns

Defending against agentic attackers requires intelligence that operates at the same speed as the threat. Manual threat intelligence processes designed around human-paced attack campaigns cannot provide the early warning signals that autonomous attack chains require.

Brandefense’s threat intelligence platform continuously monitors the sources where agentic attack capabilities are developed, discussed, and deployed, delivering early warning that enables proactive defense rather than reactive response.

The arms race between AI-powered offense and AI-powered defense is not a future scenario. It is the operational reality of 2025. A state-sponsored actor has already demonstrated that agentic AI can automate the majority of a sophisticated espionage campaign against 30 global organizations. Criminal groups are experimenting with the same architecture. And the enterprise AI infrastructure that organizations are deploying to gain competitive advantage is simultaneously creating new attack surfaces that most current security architectures were not designed to defend.

The organizations that will navigate this landscape most effectively are not necessarily those with the largest security budgets. They are those with the most accurate, most current intelligence on how agentic attack capabilities are evolving, who is deploying them, and how they are being targeted. In an environment where the attacker’s reconnaissance never stops, the defender’s intelligence cannot stop either.