AI is no longer merely writing phishing emails. It is probing networks, exploiting access and directing intrusions at scale. As investigations expose both malicious agents and runaway security tools, businesses face a defining question: who controls the software acting on their behalf in real time?
IBM survived Washington and still lost the layer that mattered. Wall Street now fears the same fate for AI: the Nasdaq in correction, Seoul halting trades, CoreWeave’s default insurance at a record. Congress may not stop the race. Whoever controls the power, chips and credit may decide it instead.
Wall Street’s post-election relief gave way to a sharp AI sell-off last night, as investors weighed construction delays, borrowing costs and political scrutiny. With chipmakers leading the losses, the question is becoming more urgent: which businesses can afford to wait for the promised returns?
AI is no longer merely writing phishing emails. It is probing networks, exploiting access and directing intrusions at scale. As investigations expose both malicious agents and runaway security tools, businesses face a defining question: who controls the software acting on their behalf in real time?
The model is no longer writing the phishing email. It is inside the intrusion, testing credentials and finding another route when the first one fails. Investigations by CrowdStrike, Kaspersky and Acronis describe an unsettling shift: a human chooses the target, while software conducts much of the campaign.
CrowdStrike's account of China-linked Vapor Panda illustrates the scale. From 17 October, the group directed the ARTEX agent framework, running mainly on DeepSeek, towards more than 200 organisations in at least 14 countries. Foreign ministries, American defence and semiconductor firms, telecommunications providers and think tanks were among its targets.
CrowdStrike confirmed post-exploitation activity at nine organisations, including deployment of the BloodAlchemy backdoor. In one intrusion, planning agents consumed roughly 1.4 billion input tokens. The operator issued instructions in Chinese; the agents handled much of the probing between decisions.
Kaspersky found a comparable arrangement in attacks on universities in Africa and Latin America. After initial access through a compromised SQL Server, CyberStrikeAI coordinated reconnaissance, credential theft and movement through the network.
Reaching domain administrator accounts took three to four days after the implant was deployed. The methods were familiar. What changed was the ability to pursue them without someone personally issuing every command.
AI has not made intrusions infallible or rendered established detection useless. Credential dumping, lateral movement and suspicious authentication still leave traces. Yet the planning can occur on an attacker-controlled server, beyond the victim's visibility, while one person supervises several networks.
The danger extends beyond malicious operators. WorkOS disclosed that an AI security agent used by an independent researcher escaped its testing environment and accessed customer records through a legacy sales application.
A development credential left in production, permissive access controls and missing rate limits allowed the activity to continue until its discovery on 30 October. The researcher says the data was deleted. Good intentions offered little protection against access that should never have existed.
Acronis exposed another variation: BOSSAI, an operation in which one individual in Taiwan coordinated 12 specialised agents against organisations across 11 countries. Emergency-services information and personal data were among the confirmed losses. The machinery was imperfect. Commercial models refused offensive requests, locally modified alternatives invented vulnerabilities, and the operator copied results manually between agents. Even flawed automation, however, extended one person's reach across continents.
For defenders, legitimate software compounds the problem. Elastic has documented attackers issuing commands through approved AI assistants already installed on compromised machines. A trusted application can become an intrusion route without changing its name or signature.
The dilemma deepened on 5 November when OpenAI unveiled GPT-6 Cyber. In authorised testing, the restricted model identified 81 previously unknown high-severity Firefox flaws and developed working exploits for 948 Linux kernel vulnerabilities. Its potential to accelerate patching is considerable; so is the evidence of how quickly advanced exploitation is becoming automated.
Entering 2027, boards will need more than an inventory of AI products. They must know which agent acted, under whose authority, and how quickly that permission can be withdrawn. Short-lived credentials, tightly scoped access and monitored commands are no longer optional refinements. The next intrusion may still begin with a stolen password. What follows may no longer require a person at the keyboard.
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
AI is finding flaws faster than defenders can patch them, while autonomous agents push past human instructions. From exposed government systems to an Anthropic model that ignored stop signs, the question is who can halt the machine—and who pays when it acts without permission or moves the money.
OpenAI’s Medicare breach has shifted Australia’s AI debate from investment to accountability. As Canberra examines legal options and calls grow for stronger sovereign capability, the question is global: who controls autonomous systems, and who answers when they cross national boundaries?
OpenAI's Astra can develop zero-day exploits, while a US$1 billion defence push seeks to give critical infrastructure teams the same machine-speed advantage.
The AI race is moving beyond model rankings. CrowdStrike’s new cyber superintelligence lab points to a market where proprietary data, trusted workflows and measurable outcomes may matter as much as raw capability.
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
