Agent attack is not yet end-to-end <\/h3>\n\n\n\n
The good news is that, for now, the agent-based approach doesn't seem to work end-to-end. Recent examples show that threat actors use autonomous agents for some phases of an attack, but not all. Here are some concrete examples:<\/p>\n\n\n\n
1. From Reconnaissance to Exploitation<\/strong><\/h6>\n\n\n\nGambit Security<\/a> analyzed a campaign by a cybercrime actor that automated the targeting and compromise of hundreds of online retailers using three different harnesses: Strix<\/em> for vulnerability research; Cairn<\/em> for autonomous operation with the option of automatic skimmer injection; and Hermes<\/em> for the orchestration. In the space of 5 days, the malicious actor thus managed to compromise 27 companies and collect more than 600,000 bank card numbers\u2026 before triggering an automated \u00abwipe\u00bb (deletion) of the databases to remove all trace of its passage.<\/p>\n\n\n\n2. Actions on Objectives and Persistence<\/strong><\/h6>\n\n\n\nGoogle Threat Intelligence Group<\/a> analyzed PROMPTSPY<\/strong>, An Android malware that uses a module called `GeminiAutomationAgent` to analyze the graphical interface in real time and interact with it, based on an objective provided by the attacker. The malware is also capable of "locking" itself into the "Recent Apps" menu, a persistence technique that relies on the phone's accessibility features and launcher. \u00a0<\/p>\n\n\n\n3. Command & Control (C2)<\/strong><\/h6>\n\n\n\nCisco Talos<\/a> detected CLOSEDQUORUM<\/strong>, This malware replaces the command and control (C2) server with a "quorum" of models (DeepSeek, Gemini, Mistral). The Go binary uses plurality voting to choose the next action (e.g., dumping LSASS). Malicious traffic then blends in with legitimate API calls to AI providers, rendering domain blocking ineffective. Surprisingly, the implant delegates the most critical part\u2014tactical decision-making\u2014to LLMs.<\/p>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2026\/09\/image-685x1024.png\")
Decision-making process of a C2 based on LLM (source: Cisco Talos)<\/figcaption><\/figure>\n\n\n\n4. Lateral Movement and Escalation of Privileges<\/strong><\/h6>\n\n\n\nA recent report from Microsoft<\/a> shows how the group Storm-3168<\/strong> \u2013 aka JADEPUFFER \u2013 uses agents to navigate and escalate privileges in the cloud via *main services*<\/em> compromise. AI is able to understand the topology of a cloud tenant and decide on the shortest path to critical resources, showing in passing that autonomy works even in complex environments.<\/p>\n\n\n\nEmpower the defense<\/h3>\n\n\n\n
With this paradigm shift, our traditional response cycles are proving inadequate. Patch windows and human on-call rotations are ill-suited to an agent who can identify, exploit, and exfiltrate data in a matter of hours, without ever getting any sleep. The only viable response is an AI-assisted defense capable of reacting at machine speed. Obviously, such an infrastructure cannot be built in a few days. More agile and less constrained by their organizational processes, malicious actors will have a head start for some time.<\/p>\n\n\n\n
Until then, agent-based attacks are likely to disrupt our cybersecurity priorities. Faced with intrusions that will be difficult to counter, companies will have to invest more in resilience to be able to rebuild quickly. Minimum Viable Business<\/strong>.<\/p>\n\n\n\nHow Intrinsec protects you against the emergence of autonomous agents<\/h2>\n\n\n\n
Testing before the attacker: the "Agent-Centric" approach\u00ab<\/strong>The rise of agent-based attacks renders traditional security audits insufficient. Our teams\u00a0Audit and offensive security<\/a>\u00a0We now simulate "augmented" attack scenarios, using frameworks and agents similar to those used by adversaries. We test the resilience of your environments to identify and remediate critical access paths before an autonomous agent can discover them.<\/p>\n\n\n\nDetecting the invisible: behavioral and contextual monitoring:<\/strong>\u00a0Faced with attackers who automate reconnaissance and exploitation, static analysis is obsolete. Our\u00a0SOC and our MDR services<\/a>\u00a0deploy contextual monitoring capable of spotting early signs of an agent-driven intrusion, even when the malware uses generic tools or adapts in real time to bypass defenses.<\/p>\n\n\n\n
2. Actions on Objectives and Persistence<\/strong><\/h6>\n\n\n\nGoogle Threat Intelligence Group<\/a> analyzed PROMPTSPY<\/strong>, An Android malware that uses a module called `GeminiAutomationAgent` to analyze the graphical interface in real time and interact with it, based on an objective provided by the attacker. The malware is also capable of "locking" itself into the "Recent Apps" menu, a persistence technique that relies on the phone's accessibility features and launcher. \u00a0<\/p>\n\n\n\n3. Command & Control (C2)<\/strong><\/h6>\n\n\n\nCisco Talos<\/a> detected CLOSEDQUORUM<\/strong>, This malware replaces the command and control (C2) server with a "quorum" of models (DeepSeek, Gemini, Mistral). The Go binary uses plurality voting to choose the next action (e.g., dumping LSASS). Malicious traffic then blends in with legitimate API calls to AI providers, rendering domain blocking ineffective. Surprisingly, the implant delegates the most critical part\u2014tactical decision-making\u2014to LLMs.<\/p>\n\n\n\nDecision-making process of a C2 based on LLM (source: Cisco Talos)<\/figcaption><\/figure>\n\n\n\n4. Lateral Movement and Escalation of Privileges<\/strong><\/h6>\n\n\n\nA recent report from Microsoft<\/a> shows how the group Storm-3168<\/strong> \u2013 aka JADEPUFFER \u2013 uses agents to navigate and escalate privileges in the cloud via *main services*<\/em> compromise. AI is able to understand the topology of a cloud tenant and decide on the shortest path to critical resources, showing in passing that autonomy works even in complex environments.<\/p>\n\n\n\nEmpower the defense<\/h3>\n\n\n\n
With this paradigm shift, our traditional response cycles are proving inadequate. Patch windows and human on-call rotations are ill-suited to an agent who can identify, exploit, and exfiltrate data in a matter of hours, without ever getting any sleep. The only viable response is an AI-assisted defense capable of reacting at machine speed. Obviously, such an infrastructure cannot be built in a few days. More agile and less constrained by their organizational processes, malicious actors will have a head start for some time.<\/p>\n\n\n\n
Until then, agent-based attacks are likely to disrupt our cybersecurity priorities. Faced with intrusions that will be difficult to counter, companies will have to invest more in resilience to be able to rebuild quickly. Minimum Viable Business<\/strong>.<\/p>\n\n\n\nHow Intrinsec protects you against the emergence of autonomous agents<\/h2>\n\n\n\n
Testing before the attacker: the "Agent-Centric" approach\u00ab<\/strong>The rise of agent-based attacks renders traditional security audits insufficient. Our teams\u00a0Audit and offensive security<\/a>\u00a0We now simulate "augmented" attack scenarios, using frameworks and agents similar to those used by adversaries. We test the resilience of your environments to identify and remediate critical access paths before an autonomous agent can discover them.<\/p>\n\n\n\nDetecting the invisible: behavioral and contextual monitoring:<\/strong>\u00a0Faced with attackers who automate reconnaissance and exploitation, static analysis is obsolete. Our\u00a0SOC and our MDR services<\/a>\u00a0deploy contextual monitoring capable of spotting early signs of an agent-driven intrusion, even when the malware uses generic tools or adapts in real time to bypass defenses.<\/p>\n\n\n\n
3. Command & Control (C2)<\/strong><\/h6>\n\n\n\nCisco Talos<\/a> detected CLOSEDQUORUM<\/strong>, This malware replaces the command and control (C2) server with a "quorum" of models (DeepSeek, Gemini, Mistral). The Go binary uses plurality voting to choose the next action (e.g., dumping LSASS). Malicious traffic then blends in with legitimate API calls to AI providers, rendering domain blocking ineffective. Surprisingly, the implant delegates the most critical part\u2014tactical decision-making\u2014to LLMs.<\/p>\n\n\n\nDecision-making process of a C2 based on LLM (source: Cisco Talos)<\/figcaption><\/figure>\n\n\n\n4. Lateral Movement and Escalation of Privileges<\/strong><\/h6>\n\n\n\nA recent report from Microsoft<\/a> shows how the group Storm-3168<\/strong> \u2013 aka JADEPUFFER \u2013 uses agents to navigate and escalate privileges in the cloud via *main services*<\/em> compromise. AI is able to understand the topology of a cloud tenant and decide on the shortest path to critical resources, showing in passing that autonomy works even in complex environments.<\/p>\n\n\n\nEmpower the defense<\/h3>\n\n\n\n
With this paradigm shift, our traditional response cycles are proving inadequate. Patch windows and human on-call rotations are ill-suited to an agent who can identify, exploit, and exfiltrate data in a matter of hours, without ever getting any sleep. The only viable response is an AI-assisted defense capable of reacting at machine speed. Obviously, such an infrastructure cannot be built in a few days. More agile and less constrained by their organizational processes, malicious actors will have a head start for some time.<\/p>\n\n\n\n
Until then, agent-based attacks are likely to disrupt our cybersecurity priorities. Faced with intrusions that will be difficult to counter, companies will have to invest more in resilience to be able to rebuild quickly. Minimum Viable Business<\/strong>.<\/p>\n\n\n\nHow Intrinsec protects you against the emergence of autonomous agents<\/h2>\n\n\n\n
Testing before the attacker: the "Agent-Centric" approach\u00ab<\/strong>The rise of agent-based attacks renders traditional security audits insufficient. Our teams\u00a0Audit and offensive security<\/a>\u00a0We now simulate "augmented" attack scenarios, using frameworks and agents similar to those used by adversaries. We test the resilience of your environments to identify and remediate critical access paths before an autonomous agent can discover them.<\/p>\n\n\n\nDetecting the invisible: behavioral and contextual monitoring:<\/strong>\u00a0Faced with attackers who automate reconnaissance and exploitation, static analysis is obsolete. Our\u00a0SOC and our MDR services<\/a>\u00a0deploy contextual monitoring capable of spotting early signs of an agent-driven intrusion, even when the malware uses generic tools or adapts in real time to bypass defenses.<\/p>\n\n\n\n
4. Lateral Movement and Escalation of Privileges<\/strong><\/h6>\n\n\n\nA recent report from Microsoft<\/a> shows how the group Storm-3168<\/strong> \u2013 aka JADEPUFFER \u2013 uses agents to navigate and escalate privileges in the cloud via *main services*<\/em> compromise. AI is able to understand the topology of a cloud tenant and decide on the shortest path to critical resources, showing in passing that autonomy works even in complex environments.<\/p>\n\n\n\nEmpower the defense<\/h3>\n\n\n\n
With this paradigm shift, our traditional response cycles are proving inadequate. Patch windows and human on-call rotations are ill-suited to an agent who can identify, exploit, and exfiltrate data in a matter of hours, without ever getting any sleep. The only viable response is an AI-assisted defense capable of reacting at machine speed. Obviously, such an infrastructure cannot be built in a few days. More agile and less constrained by their organizational processes, malicious actors will have a head start for some time.<\/p>\n\n\n\n
Until then, agent-based attacks are likely to disrupt our cybersecurity priorities. Faced with intrusions that will be difficult to counter, companies will have to invest more in resilience to be able to rebuild quickly. Minimum Viable Business<\/strong>.<\/p>\n\n\n\nHow Intrinsec protects you against the emergence of autonomous agents<\/h2>\n\n\n\n
Testing before the attacker: the "Agent-Centric" approach\u00ab<\/strong>The rise of agent-based attacks renders traditional security audits insufficient. Our teams\u00a0Audit and offensive security<\/a>\u00a0We now simulate "augmented" attack scenarios, using frameworks and agents similar to those used by adversaries. We test the resilience of your environments to identify and remediate critical access paths before an autonomous agent can discover them.<\/p>\n\n\n\nDetecting the invisible: behavioral and contextual monitoring:<\/strong>\u00a0Faced with attackers who automate reconnaissance and exploitation, static analysis is obsolete. Our\u00a0SOC and our MDR services<\/a>\u00a0deploy contextual monitoring capable of spotting early signs of an agent-driven intrusion, even when the malware uses generic tools or adapts in real time to bypass defenses.<\/p>\n\n\n\n
Empower the defense<\/h3>\n\n\n\n
With this paradigm shift, our traditional response cycles are proving inadequate. Patch windows and human on-call rotations are ill-suited to an agent who can identify, exploit, and exfiltrate data in a matter of hours, without ever getting any sleep. The only viable response is an AI-assisted defense capable of reacting at machine speed. Obviously, such an infrastructure cannot be built in a few days. More agile and less constrained by their organizational processes, malicious actors will have a head start for some time.<\/p>\n\n\n\n
Until then, agent-based attacks are likely to disrupt our cybersecurity priorities. Faced with intrusions that will be difficult to counter, companies will have to invest more in resilience to be able to rebuild quickly. Minimum Viable Business<\/strong>.<\/p>\n\n\n\n Testing before the attacker: the "Agent-Centric" approach\u00ab<\/strong>The rise of agent-based attacks renders traditional security audits insufficient. Our teams\u00a0Audit and offensive security<\/a>\u00a0We now simulate "augmented" attack scenarios, using frameworks and agents similar to those used by adversaries. We test the resilience of your environments to identify and remediate critical access paths before an autonomous agent can discover them.<\/p>\n\n\n\n Detecting the invisible: behavioral and contextual monitoring:<\/strong>\u00a0Faced with attackers who automate reconnaissance and exploitation, static analysis is obsolete. Our\u00a0SOC and our MDR services<\/a>\u00a0deploy contextual monitoring capable of spotting early signs of an agent-driven intrusion, even when the malware uses generic tools or adapts in real time to bypass defenses.<\/p>\n\n\n\nHow Intrinsec protects you against the emergence of autonomous agents<\/h2>\n\n\n\n