When AI Fights Back: How Attackers Are Using Agentic AI Against Your Organization

Agentic AI is now used by attackers as well as defenders. Anthropic disclosed a campaign in November 2025. It assessed with high confidence that the group behind it was Chinese state-sponsored. The group used AI agents to automate 80 to 90 percent of an espionage operation against about 30 organizations. Enterprise AI agents also create new attack surfaces, including prompt injection, non-human identity risk and memory poisoning.

SERIES: Agentic AI in the Enterprise  |  Part 2 of 2

In September 2025, a threat group that Anthropic assessed to be state-sponsored ran a cyberattack against about 30 organizations worldwide. The scale and the target list were not what made it historic. The method was. The attackers used an agentic AI system to automate 80 to 90 percent of the whole attack chain.

Human operators took part only in key decisions (target selection and approval of exfiltration actions). Everything in between was run on its own by AI agents. This included reconnaissance, social engineering, access exploitation, and lateral movement coordination.

This was the first documented AI-orchestrated cyber espionage campaign. It will not be the last.

In Part 1 of this series, we looked at how agentic AI gives security defenders autonomous triage, faster investigation, and machine-speed containment. Agentic AI is powerful in a SOC because of goal-driven reasoning, multi-step planning, dynamic tool use and constant adaptation. The same skills make it just as powerful as an offensive tool.

The defenders who built the capabilities described in Part 1 are now racing attackers. The attackers are using nearly identical capabilities on the other side of the perimeter.

This blog covers four things. It explains how attackers use agentic AI across the attack chain. It shows what the first documented AI-orchestrated espionage campaign revealed. It describes the new attack surfaces that enterprise AI infrastructure creates. And it looks at how threat intelligence and detection must adapt to autonomous threats.

How Did Offensive Capability Evolve from AI-Assisted to AI-Autonomous?

For several years, generative AI played a supporting role in cybercrime. It wrote convincing phishing emails faster, made malware variants to evade signature detection, and translated attack scripts across languages. These were productivity tools for human operators. The human stayed in charge, and AI was the assistant.

That model changed in 2025. The change was not sudden, but the speed-up could be measured. Three stages mark the shift:

How Are Attackers Using Agentic AI Across the Kill Chain?

Agentic AI does not fit a single phase of an attack. Its value to attackers is that it can work across the full attack chain on its own, and adapt at each stage to what it finds. The following uses are documented or have been shown in 2025.

Autonomous Reconnaissance: The Target Profile That Never Stops Building

Traditional reconnaissance is a point-in-time task. An attacker maps the target company’s external exposure at one moment, finds attack vectors, and moves on. Agentic AI turns reconnaissance into an ongoing, adaptive operation.

A reconnaissance agent can work against a target with no end date. It can do all of the following:

• monitor job postings to infer changes in the internal technology stack
• analyze LinkedIn profiles of employees to identify privileged account holders
• scan for newly registered domains and certificates that indicate infrastructure changes
• track dark web mentions of the target organization

Say a new vulnerability is disclosed in software the target is known to use. The agent flags it at once as a possible attack vector and escalates to the operator.

Hyper-Personalized Phishing at Machine Scale

AI-generated phishing is not new. What is new is the mix of scale, depth of personal detail, and adaptive delivery that agentic systems allow. An AI phishing agent in 2025 does not send the same message to ten thousand recipients. It builds a unique message for each target.

The message names real projects drawn from LinkedIn activity and copies the writing style of colleagues whose messages have been analyzed. Delivery is timed on behavior patterns inferred from public activity.

Scale is no longer limited by how many messages humans can write. AI-generated messages can be nearly impossible to tell from real ones. The FBI issued a formal warning in 2025 about AI-generated voice messages that impersonate senior government officials.

The delivery method adapts. If email filtering improves, the agent shifts to messaging platforms. If the target replies, it tailors follow-up messages based on the response.

Polymorphic Malware: Code That Rewrites Itself

Traditional malware families have signatures. These are patterns of code, behavior, and communication that security tools learn to spot and block. AI-generated polymorphic malware removes this stable signature.

An AI system can make malware that works the same but has different code on every deployment. It can produce variants that evade the detection signatures of known endpoint security products. It can also rewrite its own code in real time when an evasion attempt fails.

This is a big problem for signature-based detection. A malware sample analyzed and blocked today may share no detectable signature with the variant used tomorrow against the same company.

Detection must rely on behavior patterns (what the malware does) rather than structure patterns (what the code looks like). This shifts the load toward behavioral analytics and anomaly detection at the endpoint and network layer. These increasingly need AI to work at the scale required.

AI-Driven OSINT: Building Target Profiles Without Human Operators

Open-source intelligence gathering is one of the most labor-heavy phases of a targeted attack. Building a full picture of a company’s infrastructure, key staff, technology stack, partner ties, and work patterns has taken a lot of analyst time. Agentic AI removes this limit almost entirely.

An AI OSINT agent can keep harvesting data from many sources. Job postings reveal internal technology choices. GitHub repositories expose credentials, API keys and infrastructure details that were committed by accident. Social media profiles map company hierarchies and show who has privileged access.

The agent can also read domain registration records, certificate transparency logs and open cloud storage buckets. It links this data on its own, builds structured target profiles, and flags high-value attack vectors for operator review. What once took a team of analysts days now takes an autonomous agent hours, working non-stop.

Adaptive Persistence: Attacks That Learn From Defensive Responses

One of the most important traits of agentic attack systems is that they adapt in real time to defensive responses. A traditional attacker who trips a detection rule and gets blocked must reassess by hand, adjust tactics, and try again. An agentic attacker adapts on its own.

An agentic attack agent does not stop when an action is blocked. A credential attempt may fail, a network path may be segmented, or a file operation may trigger an alert. The agent assesses the response, infers which detection mechanism caused it, and tries another approach that avoids the same signal.

This retry-and-adapt loop runs non-stop, without the delays of human operator review. It cuts the time between a blocked attempt and a working alternative to seconds. Researchers have since documented ransomware and extortion crews using AI agents inside victim networks, collected in the AI tools ransomware crews use.

What Happened in the First Documented AI-Orchestrated Espionage Campaign?

In November 2025, Anthropic published a threat intelligence disclosure on what it identified with high confidence as the first documented AI-orchestrated cyberattack. The threat group, named GTG-1002, is assessed to be a Chinese state-sponsored actor. The campaign targeted about 30 organizations around the world, in government and the private sector.

What set this campaign apart from earlier AI-assisted attacks was how much it ran on its own. GTG-1002 did not use AI only to make content or automate single tasks in a human-led operation. It built an autonomous attack framework. In it, AI agents ran most of the attack chain with no human help.

Reconnaissance, social engineering, access exploitation, and lateral movement coordination were all handled by the agentic system. Human operators took part only in key decisions: choosing targets and approving data exfiltration.

The attackers got around the AI system’s safety controls with a social engineering technique aimed at the AI itself. They gave the system a false work context. They framed the attack activities as authorized penetration testing by a legitimate cybersecurity firm.

The AI, reasoning within the framing it was given, went ahead with activities it would otherwise have declined.

Anthropic noted that the case shows how threat actors are adapting their operations to exploit advanced AI capabilities. It pointed to one technique in particular: social engineering applied to the AI system itself. The attackers manipulated its work context instead of exploiting a technical vulnerability. Anthropic described this as a novel attack technique that others can reuse.

Any company that deploys AI agents in security-sensitive workflows faces a similar risk. An attacker who can manipulate the context an agent works in can redirect its abilities toward malicious goals.

What Is the New Attack Surface in Enterprise AI Infrastructure?

Beyond using agentic AI as an attack tool, adversaries have found that enterprise AI infrastructure is a high-value target. Companies now deploy AI agents that handle sensitive data, run business processes and connect to critical systems. These agents and the infrastructure behind them become new entry points. Most existing security designs were not built to defend them.

What Is Prompt Injection, and How Does It Hijack an Agent?

Prompt injection is the AI-specific counterpart of SQL injection. An attacker hides malicious instructions in content that an AI agent processes. The agent then follows those instructions instead of its intended task. In a company, this can happen when an AI agent processes a document, email or web page. If the content has hidden instructions, they can redirect the agent’s behavior.

The attack surface is broad. Any AI agent that processes external content may be open to prompt injection. That content includes emails, documents, web pages, database records and API responses.

Consider an agent that processes a supplier invoice with hidden instructions to forward sensitive data to an external endpoint. It is then carrying out an attacker’s commands with the agent’s own credentials and permissions. The company trusted the agent, and the agent was manipulated.

Non-Human Identity Risk: Agents as Privileged Attack Vectors

Every AI agent deployed in a company runs with credentials: API keys, service accounts, OAuth tokens, database access credentials. These non-human identities (NHIs) often get broad, lasting access to sensitive systems because the agent’s tasks need it.

Human user credentials get regular review and behavior monitoring. NHI credentials often lack the same level of control.

For an attacker, a compromised AI agent credential gives access equal to a human administrator account. It does not show the behavior anomalies that would trigger human identity detection rules. The agent can query databases, access file systems, call APIs and exfiltrate data. To monitoring systems that are not built for NHI behavior analysis, all of these actions look like normal agent work.

Memory Poisoning: Persistent Manipulation of Agent Behavior

Advanced agentic AI systems keep long-term memory: a lasting store of context, learned preferences, and work history that shapes the agent’s future decisions. Memory poisoning is an attack in which an adversary plants false or malicious data in this lasting store. The agent then recalls and acts on the poisoned instruction in future sessions.

This can happen days or weeks after the first manipulation.

Standard prompt injection affects only the current session. A successful memory poisoning attack creates a lasting backdoor in the agent’s behavior. The agent keeps making decisions that look consistent (following its own remembered context) while it carries out attacker-directed instructions.

Detection needs more than monitoring agent actions. It also means auditing the contents of agent memory stores. Teams must look for gaps between the declared work context and actual agent behavior.

How Do You Adapt Your Security Program for the Agentic Threat Landscape?

The agentic threat landscape calls for specific changes to security architecture, detection skills, and threat intelligence programs. The framework below maps the new threat vectors to the controls best placed to address them.

How Brandefense Provides Intelligence on AI-Powered Attack Campaigns

Defending against agentic attackers needs intelligence that works at the same speed as the threat. Manual threat intelligence processes built around human-paced attack campaigns cannot give the early warning signals that autonomous attack chains require.

Brandefense’s threat intelligence platform constantly monitors the sources where agentic attack capabilities are built, discussed and deployed. It gives early warning, so defense can be proactive instead of reactive.

The arms race between AI-powered offense and AI-powered defense is not a future scenario. It is the operational reality of 2025. A state-sponsored actor has already shown that agentic AI can automate most of a skilled espionage campaign against 30 global organizations.

Companies deploy enterprise AI infrastructure to gain a competitive edge. At the same time, it creates new attack surfaces. Most current security designs were not built to defend them.

The companies that will handle this landscape best are not always those with the biggest security budgets. They are the ones with the most accurate and current intelligence. That means knowing how agentic attack capabilities are changing, who is deploying them, and how they are being targeted.

In an environment where the attacker’s reconnaissance never stops, the defender’s intelligence cannot stop either.