AI Agents Are Now Running Full Cyberattacks, Unsupervised

On September 10, Anthropic published a threat intelligence report describing something defenders have worried about for years and rarely seen documented this plainly: a state-linked hacking group used Claude to run its own detection-evasion loop. Test the malware against security tools, note what got flagged, automatically rewrite and redeploy it, repeat, without a human doing the rewriting. One day later, a separate report showed hundreds of AI agents breaching 395 organizations in 48 countries through a single print-management vulnerability, some in under 30 seconds.

Neither of these is a hypothetical. Both are dated this week, and both point at the same gap.

Anthropic caught its own model being turned into an attack chain

Anthropic's report covers activity the company identified and disrupted between December 2025 and August 2026. It's worth pausing on the source: this isn't a competitor or a researcher speculating about misuse, it's the model vendor itself publishing case studies of its own product being weaponized.

The headline case, a group Anthropic tracks as GTG-20006, overlapping with the Russian state-linked actor known as Midnight Blizzard, used Claude to automate the cat-and-mouse cycle of malware evasion. Historically, that cycle forced attackers into slow, manual rewrites every time a signature caught up with them. Anthropic's own framing: AI now lets capable actors close that loop faster than defenders can respond, shifting the cost back onto the defending side.

The same report documents a different actor who used Claude to identify and abuse developer and authentication APIs, build tooling for bulk data export across tenant boundaries, and exfiltrate data from thousands of downstream customer organizations, then separately collected legitimate bug-bounty payouts from some of the same companies they'd compromised. A third case describes a credential-harvesting operation run across a fleet of cloud workers that scanned roughly 1.8 million Android app packages for hard-coded secrets. A fourth involved DNS hijacking against hotel Wi-Fi providers to redirect Ukrainian government, military, and diplomatic staff to attacker-controlled infrastructure.

Then a swarm of agents hit 395 organizations in the wild

Separately, threat-intelligence firm GreyNoise traced a campaign against PaperCut NG and MF, self-hosted print-management software that by default runs with SYSTEM-level privileges and sits domain-joined to Active Directory. A likely Russian-speaking attacker built working exploits for two disclosed vulnerabilities in a private lab, then handed the actual break-ins to hundreds of AI agents running on OpenAI's Codex harness and a DeepSeek model, largely unsupervised from that point forward.

The result: at least 440 compromised servers across 395 organizations in 48 countries. Some intrusions completed in under 30 seconds. One American high school went from initial access to domain admin in seven minutes.

Neither campaign needed a human operator watching the screen once the agents started working. That's the operational shift worth sitting with, not that AI wrote code, but that AI ran the operation.

Why this is a runtime problem, not an output problem

Look at what each of these cases actually required to succeed. The evasion loop needed agents to call security tools, read the result, and decide to rebuild, repeatedly, inside a single session. The cross-tenant exfiltration needed agents to discover and call developer and authentication APIs the way a legitimate integration would. The PaperCut campaign needed agents to chain a scan, an exploit, and a privilege escalation together fast enough that no analyst saw it happen in between.

In every case, the individual model output looks unremarkable. A tool call. An API request. A rebuilt binary. Nothing in the text of any single response reads as malicious. The pattern only shows up in the sequence, which tools got called, in what order, at what speed, against which systems, under which identity. That's a request-level and session-level question, and it's the layer output monitoring was never built to answer.

What this means for your stack

Three questions worth asking this week, regardless of which vendor's models your teams have standardized on: Can you see every tool call an agent makes in a session, not just its final answer? Would you catch a session that rebuilds and redeploys the same artifact five times in an hour? And if an agent starts calling authentication or export APIs it's never touched before, does anything flag that before the export completes?

AIDR evaluates that sequence at runtime, across every model and provider your teams have adopted, and blocks violations mid-stream rather than after the fact. The gateway underneath it is what ties every one of those tool calls back to a single identity and a single trace, so the pattern is visible in one place instead of scattered across five different providers' logs.