"The agents used novel and creative techniques we hadn't anticipated," the researchers said, describing attack paths that blended social engineering, credential exploitation and lateral movement across systems.
Autonomous attackers
Unlike traditional automated attacks that follow fixed scripts, the agents adapted in real time. When one approach failed, they tried others — much like a human penetration tester would.
The test was conducted in a controlled environment, but the researchers say the capabilities demonstrated are already within reach of real-world attackers using publicly available models.
Dual-use dilemma
The same agentic capabilities that help security teams automate defense — scanning for vulnerabilities, triaging alerts, responding to incidents — can be pointed the other way.
"This is the dual-use reality of AI agents," said one analyst. "Every defensive tool is a potential offensive weapon, and the barrier to entry keeps falling."
What defenders should do
Unit 42 recommends organizations assume AI-assisted attacks are already happening. Key defenses include monitoring for anomalous agent-like behavior, tightening identity controls, and segmenting networks to limit lateral movement.
The researchers also urge vendors to build guardrails into agent frameworks — while acknowledging that open-source models make enforcement difficult.
Industry reaction
The findings land amid a flurry of AI security news: Anthropic recently disclosed that Chinese actors tried to extract Claude's capabilities, and researchers used Anthropic's Claude to breach OpenAI's own internal systems. The Unit 42 report adds a concrete timeline — under 10 hours — to an abstract fear.
For CISOs, the message is clear: the age of AI-vs-AI cybersecurity has arrived.
