Artificial intelligence is increasingly moving away from its role as a hacker\u2019s assistant towards becoming a system capable of independently carrying out individual stages of a cyberattack \u2014 from reconnaissance and vulnerability scanning to data collection following a breach. Patrice Kane, CEO of Thales, stated that defences must evolve just as quickly: \u00abAI must be countered with AI.\u00bb Microsoft and Anthropic are also observing a trend towards more autonomous attacks, although fully automated, sophisticated breaches have not yet become the norm.<\/p>\n
Just a few years ago, artificial intelligence was mainly used in cybercrime to write phishing emails, analyse code or create simple scripts. Now the picture is changing.<\/p>\n
In its Digital Defence Report 2026, Microsoft reports that over the past six months it has observed a shift from AI that assists the operator<\/strong>, to systems that are already capable of to lead part of the attack or carry it out independently<\/strong>. AI is used for reconnaissance, vulnerability scanning, creating phishing campaigns, developing malware and post-compromise activities.<\/p>\n In a controlled Microsoft environment, one of the most advanced AI systems was able to pass 32 sequential stages of a complex attack<\/strong>. At the same time, the company emphasises: fully autonomous real-world cyberattacks<\/a> until they became widespread, and people still play an important role in setting goals and making key decisions.<\/p>\n Another problem is speed.<\/p>\n According to Microsoft, the median time from the discovery of a vulnerability \u00abin the wild\u00bb to its exploitation in attacks has already fallen well under 24 hours<\/strong>. At the same time, it often takes large companies between 30 and 60 days to rectify critical external vulnerabilities.<\/p>\n AI only widens this gap. What previously required several days\u2019 work by an experienced team can now be partially automated: the system analyses the code, tests different operational scenarios and moves on to the next step without the constant involvement of an operator.<\/p>\n Anthropic<\/a> In her September report, she described real-life instances where cybercriminals had used agent swarms \u2014 swarms of AI agents<\/strong>.<\/p>\n In this type of operation, a single lead agent breaks the task down into parts and assigns them to dozens of subordinate agents. Some carry out reconnaissance, others look for vulnerabilities, whilst others analyse security software or collect stolen data.<\/p>\n Anthropic reports that, in certain campaigns, automated systems may have been operating for hours or days with minimal human supervision<\/strong>.<\/p>\n The company also described a group of Chinese-speaking operators who maintained permanent AI agents for the automated collection of open-source intelligence, vulnerability research and other cyber operations. In this context, humans were primarily responsible for identifying targets and reviewing the results.<\/p>\n The biggest change is not just that attacks are becoming faster. AI is reducing the amount of specialist knowledge required to carry out individual stages of a cyberattack. Tasks that previously required the involvement of an experienced programmer or security analyst can increasingly be delegated AI agent<\/a>.<\/p>\n Anthropic notes that automation reduces the cost of cyber operations for an attacker. A single operator can potentially target dozens of targets simultaneously, rather than just one.<\/p>\n This is particularly dangerous for small and medium-sized businesses. Previously, such companies may not have been of interest to sophisticated attackers due to the low potential financial gain. However, if a significant proportion of their operations is automated, it becomes more economically viable to attack thousands of less well-protected organisations.<\/p>\n Against this backdrop, the CEO of Thales Patrice Kane<\/strong> called on companies and governments to invest significantly more in AI protection<\/strong>.<\/p>\n According to him, attackers are already using AI to carry out faster and more complex operations, and sometimes to perform certain tasks autonomously. Consequently, traditional systems that rely on manual analysis of each signal may simply be unable to respond in time.<\/p>\n Thales has unveiled new systems to protect against AI attacks and has expanded its collaboration with Google Cloud in the field of corporate AI security. Kane emphasised that the main advantage of AI for defence lies in its speed: the system can simultaneously analyse millions of events, detect anomalies and automatically block suspicious activities before a human can spot them.<\/p>\nVulnerabilities can be turned into weapons in less than a day<\/h2>\n
Anthropic has discovered \u00abswarms\u00bb of AI agents<\/h2>\n
AI lowers the barrier to entry for hackers<\/h2>\n
Thales: \u00abAI must be tackled with AI\u00bb<\/h2>\n
Real AI agents have already attempted to attack government systems<\/h2>\n