CYBCybersecurity

Attacks run by AI agents: what changes in your incident response plan

There are already campaigns in which an artificial intelligence agent did most of the attacker’s work. What it really speeds up, which containment steps can kick in on their own and which must stay with a person.

Strategic editorial team 29 July 2026 8 min read

Cover: “AI agent attacks: rethink the response”, Cybersecurity

When a cyber-attack is run by an artificial intelligence agent, what changes most is time. Reconnaissance, hunting for flaws, password guessing and writing attack code used to take skilled people days of work. Today an agent can do all of it in a few hours, with thousands of attempts. For defenders the consequence is concrete. A response plan that calls a meeting before every action needs revising. You have to decide in advance which containment steps can kick in on their own, within what limits, and how they are reversed.

An artificial intelligence agent is a program that is given a goal and chooses the steps to reach it by itself. It runs a command, reads the result and decides on the next step. People say that with these tools the corporate perimeter is now “measured in milliseconds”. It is a striking image, but an inaccurate one. An agent’s individual actions follow one another within seconds, while the documented campaigns squeeze work that used to take days into hours. That is the scale on which the response needs rethinking.

What is documented so far?

Three public reports describe the phenomenon without exaggeration.

An espionage campaign largely run by an agent. In November 2025 Anthropic described an operation that it attributed with high confidence to a Chinese state-sponsored group. The group used a coding agent against about thirty organisations, including technology, financial and chemical companies and government agencies, and succeeded in a small number of cases. According to the report, the agent did 80-90% of the work. People stepped in at only a few decisive moments, four to six per campaign. The requests ran into the thousands, often more than one per second.
Extortion with the agent in charge. In August 2025 the same research team reported a criminal who stole data from at least seventeen organisations, including healthcare providers and public bodies. The criminal even left it to the agent to choose which data to take and to draft the ransom demands.
Malware that queries a model while it runs. In November 2025 the Google Threat Intelligence Group described PROMPTFLUX, an experimental program that asks a language model to rewrite its own code to evade antivirus software. It was still in development, but it shows the direction of travel.

The picture needs to be read in proportion. The same Anthropic report notes that the agent sometimes made up credentials, or presented publicly available information as secret. And Mandiant’s M-Trends 2026 report points out that the vast majority of successful intrusions still stem from basic human and organisational errors. Basic defences remain decisive. What is shrinking is the time available to apply them.

What does an agent really speed up?

Attack phase	What the agent does	What it means for defenders
Reconnaissance	Lists internet-facing services, software versions and email addresses	Keep the inventory of exposed systems up to date. You cannot defend what you do not know about
Known flaws	Tries published vulnerabilities one after another and fixes its own code when it fails	Updates to exposed systems must be installed in days, not months
Credentials	Tries leaked passwords and looks for keys and tokens in the files it finds	A second authentication factor, short-lived tokens and no passwords in documents
Moving through the network	Analyses what it sees and picks the next system	A network split into zones, with administrator accounts kept separate from everyday ones
Theft and extortion	Selects valuable data and prepares the demands	Logs that reveal unusual transfers, and a plan that also covers extortion without encryption

Mandiant measures the same trend from another angle. In 2025 the median time between initial access to a network and its handover to a second criminal group fell to 22 seconds, compared with more than eight hours in 2022. The report does not attribute this to artificial intelligence. It does show how automated the attack supply chain has become.

Which containment steps can be automated?

Containment means stopping an attack from spreading, even before it is fully understood. Automating everything is as risky as automating nothing. A false alarm that isolates the production server can cost more than the attack it was meant to stop. The practical rule is simple. Limited, reversible actions can be automatic. Actions that halt important services, or that cannot be undone, stay with a person.

Action	When it can kick in on its own	Risk if the alarm is false	Can it be undone?
Isolating a computer from the network through the installed security software	Highly reliable signals on a single workstation	One person cannot work for a while	Yes, within minutes
Closing open sessions and revoking an account’s tokens	A login from an unusual place or device, followed by suspicious actions	The user has to sign in again	Yes
Suspending an account	Repeated attempts across several systems	A legitimate user is locked out, perhaps an executive who is travelling	Yes, after a check
Blocking an address or a domain	Indicators confirmed by reliable sources	A legitimate supplier or service is blocked	Yes
Isolating a production server	Only with confirmation from an authorised person, except in cases written down in advance	A service for customers and departments stops	Yes, but at a cost
Deleting files or reinstalling systems	Never automatically	Evidence is destroyed and the damage may get worse	No

Each automatic rule should be written as a small procedure. It sets out the signal that triggers it and the maximum limit, for example no more than five computers isolated without confirmation. It also says who receives the alert and how to roll the action back. The person does not disappear from the process. Their place moves to just after the first action, where they check and decide whether to confirm or reverse it.

How do you review a response plan?

Reread every step with one question. Does this action wait for a person, and why? If the only reason is habit, the action is a candidate for automation, within clear limits.
Write the containment rules with thresholds, limits and a rollback procedure. They should be approved by management, not just by IT.
Give automated tools only the permissions they need. A defensive tool with administrator powers over everything becomes a target in its own right.
Preserve the evidence before cleaning up. Event logs must be collected and kept outside the systems an attacker can reach. Without them, nobody can reconstruct what happened, as Sherlock Holmes and the log files shows.
Measure the real time. Start with a tabletop exercise with management. Follow it with technical tests on an agreed scope, authorised in writing, such as a penetration test. Together they show how many minutes the company really needs to isolate a system.
Keep the timescales separate. The recovery time objective (RTO), the maximum acceptable downtime for a service, remains a business decision. What changes is the time to first containment, which must be tested and written down in minutes.

What about the AI assistants already in use in the company?

The artificial intelligence agents a company adopts are targets too. An assistant connected to email, archives and the ERP system reads texts that may contain hidden instructions, and an agent with too many permissions may carry them out. OWASP, the international community that studies application security, publishes a list of these risks. It calls this problem “excessive agency”, meaning functionality, permissions or autonomy beyond what is needed. The rule holds for attack and defence alike. Permissions are kept to a minimum, a person approves any operation directed outside the company, and there is a log that can be checked.

Artificial intelligence also helps defenders. It can summarise alerts, reconstruct the sequence of events and prepare a first note for management. Here too, irreversible decisions stay with a person.

What should you ask whoever runs your security?

Whether security is run by an in-house team or by a provider, five questions help you see whether the plan holds up:

which containment steps are automatic today, and who approved them
how long it took, in the last exercise, to isolate a system
where event logs are kept, and for how long
who is alerted outside working hours, and with what powers
how the permissions and activity of AI assistants connected to company data are controlled.

In brief

For now, artificial intelligence agents mainly make known attacks faster and more persistent.
There are documented campaigns in which an agent did most of the work, with only a few decisions left to people.
Basic defences remain decisive. They include fast updates, a second factor, a network split into zones and isolated backups.
The response plan needs revising. Limited, reversible containment can be automatic, while decisions that halt production stay with a person.
Automatic rules have thresholds, limits, named alert recipients and a procedure to reverse them.
Company AI assistants are checked like any other system, starting with their permissions.

Frequently asked questions

Is an attack run by an AI agent harder to stop?

It is not necessarily more sophisticated. It is faster and more persistent. The campaigns described so far mostly use known techniques, so updates, a second authentication factor, segmented networks and isolated backups remain effective. What shrinks is the time available to notice and react.

Could automated containment shut the company down over a false alarm?

Yes, if you automate everything. That is why you start with limited, reversible actions, such as isolating a workstation or closing an account’s sessions, with a cap on the number of systems affected. Actions that halt important services stay with an authorised person, except in cases defined in advance with management.

Do we need an exercise with a real AI agent?

It is not essential. The value of an exercise lies in measuring how long your own response takes and in checking that roles and procedures work. If AI-based attack tools are used, the rules of any test apply. That means written authorisation from whoever has authority over the systems, and an agreed scope.

Does NIS2 require incident response to be automated?

No. The EU directive on network and information security, and Legislative Decree 138/2024, Italy’s NIS2 law, require appropriate risk management measures, including incident handling. They also set reporting deadlines. For a significant incident, the early warning to CSIRT Italia, Italy’s national computer security incident response team, must be sent within 24 hours. How the response is organised is up to the company.

Reviewing the response plan in the light of these attacks, testing it with management and checking exposed systems is the work of Strategic’s Cybersecurity division. For AI assistants and agents already connected to company data, the starting point is our page on AI security and governance.

Sources

Consulted on 16 September 2026.

Find out moreCybersecurityTesting carried out the way an attacker would (penetration tests), incident management, business continuity and support in meeting NIS2 requirements, suppliers included.