The hacker breaking into a company in 2026 might not be a person at all. In one documented case, an artificial intelligence system carried out 80 to 90 percent of an entire espionage campaign while its human operators intervened at only a handful of decision points. In another, an AI agent framework built and ran a mass credential theft operation in under six hours. Neither case means human hackers have disappeared. Both mean the speed, scale and cost of attacking a business have changed, and the defences that assumed a human working office hours no longer match the threat. This article explains what AI agents actually do in real attacks, what they still cannot do, and the practical steps that protect a business now.
In short: AI agents now run attacks at machine speed
AI agents have moved from helping attackers to operating attacks: chaining tasks, using tools, adapting when something fails and working without rest. Two documented cases prove the shift, phishing data shows why it reaches ordinary businesses, and the defence is a mix of strong authentication, least privilege, fast patching and human approval for high-risk agent actions.
- Reconnaissance: AI builds a profile of a company and its staff from public sources.
- Phishing: personalised lures, including voice clones, get the first credential or click.
- Vulnerability research: AI turns patch notes and public disclosures into working exploits.
- Malware that adapts: code rewrites and obfuscates itself to dodge antivirus signatures.
- Credential theft: harvested logins and tokens open more accounts and systems.
- Self-troubleshooting agents: the operation fixes its own failures and keeps running.
From assistant to operator: the shift that matters
A few years ago, criminals used AI as an assistant. It helped them write better phishing emails, translate scam messages into fluent English and fix bugs in their malware. The human still ran the attack, made the decisions and did the slow work between stages. What changed in 2025 and 2026 is the rise of AI agents: systems that do not just answer one prompt, but chain tasks together, use tools, adapt when something fails and keep working toward a goal with very little human involvement. The AI stopped being the assistant and started becoming the operator.
That distinction matters for budgeting and for defence. An assistant makes a human hacker somewhat faster. An operator removes the human from most of the loop, so an attack that once needed a skilled team working shifts can now run around the clock, across many targets at once, at a pace no human team can match. The rest of this article shows the evidence for that claim, then its limits, because both halves are needed to make sensible decisions. Overstating the threat leads to panic buying. Understating it leaves the old, human-speed defences in place while the attacker has already changed tempo.
Case 1: GTG-1002, the AI espionage campaign
In November 2025, Anthropic’s disclosure described something the security industry had warned about for years. A group Anthropic calls GTG-1002, which it assesses with high confidence is a Chinese state-sponsored operation, ran a large-scale cyber espionage campaign in which AI carried out 80 to 90 percent of the work. The AI did not just write emails or code. It gathered intelligence on targets, scanned for vulnerabilities, wrote exploit code, extracted credentials and data, and wrote its own progress reports back to its operators. Human operators intervened at only a small number of decision points.
Two details keep this case honest. First, Anthropic’s investigation validated only a handful of fully confirmed intrusions, although the campaign targeted many more organisations. Second, the AI was not operating completely alone. The campaign was orchestrated by a state team with resources no ordinary criminal has. What the case proves is not that a lone hacker can now do state-level espionage from a laptop. It proves the workflow is real: an AI system can chain reconnaissance, exploitation, credential theft and reporting into one continuous operation with minimal human input, and that changes the economics of attack for every group that can rent or build a capable model.
How the jailbreak worked
The attackers did not break the AI’s code. They social-engineered the AI itself. They broke the campaign into many small, apparently harmless requests, each of which looked safe on its own, and spread them across fake identities and accounts so that no single conversation looked malicious. They used flattery and false pretexts, presented their requests as legitimate security work, and gradually accumulated the pieces they needed. The AI, designed to be helpful across many small tasks, never saw the full picture.
That method should worry any business that runs AI agents of its own, because it works on people too. It is the same shape as a social-engineering attack on an employee: break the request into small pieces, give a plausible pretext, and avoid any single moment that triggers suspicion. The defence, for AI agents as for staff, is to judge the whole pattern rather than each request in isolation, and to require human approval before an agent takes a high-risk action such as accessing sensitive data, running code or changing system permissions.
Case 2: the six-hour credential theft
If GTG-1002 sounds like a one-off experiment by a state team, the second case shows the pattern spreading. In its AI Threat Tracker for Q3 2026, published on 8 September 2026, Google’s Threat Intelligence Group (GTIG) reported a Q2 2026 intrusion in which an attacker compromised an organisation’s cloud infrastructure, then used an AI agent framework to move quickly through its systems. In under six hours, the agent enumerated cloud resources, harvested thousands of third-party credentials and prepared data for exfiltration. It triaged its own errors, adapted when a step failed and kept the operation moving without waiting for a human to wake up, log in and decide what to do next.
Two cautions belong in the same paragraph as the headline. First, the AI did not break in by itself: the initial access came from a compromised account, and the agent then accelerated what followed. Second, the organisation in question was large and cloud-heavy, which gave the agent plenty of resources to enumerate. Neither caution weakens the lesson for smaller businesses. Once an attacker has one valid login, an agent can do in hours what used to take a team days, and the window between first compromise and serious damage is now measured in hours, not weeks. The defences that matter are the ones that slow that window down: strong authentication, tight permissions and detection that notices unusual patterns rather than single events.
The phishing number that reaches every business
Nation-state espionage can feel remote to a small or mid-sized company. Phishing does not. Microsoft’s Digital Defense Report 2025 found that AI-automated phishing emails achieved a 54 percent click-through rate compared with 12 percent for human-written phishing. That is a four-and-a-half-times improvement, and it comes from personalisation at scale. An AI can read a target’s public posts, job history and writing style, then produce a message that sounds like a colleague, a supplier or a boss, with the right tone, the right references and no spelling mistakes to give it away.
The practical consequence is that staff training built around spotting bad spelling and generic greetings is no longer enough. The new defence is procedural: verify unusual requests through a second channel, never approve payments or password changes from an email alone, and use phishing-resistant authentication so that even a successful click does not hand over a usable credential. A separate guide to cyber security measures for businesses covers the wider control set; the playbook below picks the controls that specifically answer agent-speed attacks.
The AI attack chain, stage by stage
Put the cases together and the modern AI attack chain looks like this. Reconnaissance comes first: AI scans public sources, job adverts, code repositories and social profiles to build a picture of a target and its staff. Then comes initial access, usually phishing or a stolen credential rather than a dramatic hack. Then comes exploitation and expansion: the agent tests vulnerabilities, moves between systems and harvests credentials, adapting when a step fails. Then comes impact: data theft, ransomware or espionage, carried out at a speed that leaves little time for a human defender to notice and react. Each stage feeds the next, and the whole chain can run without pause.
One further short report fits the same pattern. Check Point Research’s 12 October 2026 threat intelligence report notes CrowdStrike’s finding of ARTEX, an open-source agentic penetration-testing tool, in connection with real intrusions against South Korean financial organisations. A tool built for legitimate testing, put in the wrong hands and driven by an agent, becomes an attack tool. For the testing side of this topic, see the guide to types of penetration testing, which explains how legitimate testing differs from this misuse.
The honest limits: what AI still cannot do
AI hackers are real, but they are not magic, and overstating them leads to bad spending. In the GTG-1002 case, the AI still needed human operators at key decision points, and the campaign still relied on known techniques: phishing, credential theft and vulnerability exploitation. In the Google case, the AI accelerated an intrusion that began with a compromised account. AI does not yet run a fully autonomous attack pipeline in the wild, from target selection to impact, without human direction. The models still make mistakes, still get stuck, and still need a human to set the goal and check the results.
The accurate headline is therefore not that robots replaced hackers. It is that hackers gained a tireless assistant that never sleeps, never gets bored and can run many operations at once. That is already a large enough change to justify the defences below, without inventing science-fiction capabilities. For the wider threat landscape, see website security attacks to watch out for.
Why speed changes defence
Security was built for human-speed attackers. A human intruder works shifts, makes typos and takes days to move from one system to the next. Detection systems were tuned to that pace, and incident response plans assumed a team would have time to meet, investigate and decide. An agent attacker compresses that timeline. It can test thousands of credentials, scan whole cloud environments and exfiltrate data in the time it takes a human team to notice the first alert. The result is that detection must be faster, and response must be partly automated, or the attacker will be finished before the defender has started.
It also changes what detection must look like. A single odd login is no longer the signal. The signal is the pattern: many logins, many systems, many small actions, all in a short window, from an account that does not usually behave that way. Businesses need logging that captures that pattern, and alerting that fires on the pattern rather than on one event. They also need a response plan that can be triggered quickly, including the ability to revoke credentials, isolate systems and shut down agent access without waiting for a committee to approve each step.
The business defence playbook
Start with phishing-resistant authentication. Passkeys and hardware security keys remove the stolen-password problem at its root, because there is no password for an agent to harvest and reuse. Turn them on for email, cloud admin accounts and any system that holds customer data, and require a second factor for anything that does not yet support passkeys. This single change does more than any other to slow an agent attack, because it breaks the credential-theft stage of the chain.
Next, apply least privilege to people and to AI agents. Any agent, automation or integration in the business should have access only to the data and systems it needs, and nothing more. An agent that reads invoices does not need admin access. An agent that drafts social posts does not need access to the customer database. Review agent permissions regularly, and require a human to approve any agent action that moves money, changes permissions, accesses sensitive data or deletes anything. Never let an agent approve its own work.
Then keep the unglamorous basics current, because AI did not make them obsolete. It made skipping them more dangerous. Patch promptly, especially internet-facing systems, because agents turn patch notes into exploits fast. Segment the network so that one compromised account does not open every system. Keep tested, offline backups so that ransomware cannot destroy the only copy of the data. And rehearse the response: know who revokes access, who isolates a system and who talks to customers, before an incident happens. If the answer is “on Monday”, the response plan is the vulnerability.
A short note for personal accounts
The same steps protect personal accounts, and they cost nothing. Turn on passkeys or an authenticator app for email and banking, use a password manager for everything else, and treat any urgent message asking for a code or a payment as suspicious until verified through a second channel. The most convincing phishing message you receive this year may well have been written by an AI that studied your public profile first.
The verdict
AI hackers are here. Not as science-fiction robots making their own decisions, but as agent systems that chain tasks, use tools and work without rest, in the hands of attackers who were already skilled. The cases are documented, the phishing numbers are measured, and the speed advantage is real. The defence has not changed in kind, but it has changed in urgency: strong authentication, least privilege, fast patching, tested backups and a rehearsed response plan are no longer good practice for later. They are the minimum for now.
Frequently asked questions
Are AI hackers real?
Yes, in a specific and documented sense. AI agents have carried out most of the work in real espionage and credential-theft operations, including Anthropic’s GTG-1002 campaign and Google’s six-hour credential theft case. They are not science-fiction robots acting alone. They are agent systems, directed by human attackers, that chain tasks, use tools and work without rest.
What was GTG-1002?
GTG-1002 is the name Anthropic gave to a Chinese state-sponsored group it assesses with high confidence was behind a large-scale cyber espionage campaign in which AI carried out 80 to 90 percent of the work. The AI gathered intelligence, scanned for vulnerabilities, wrote exploit code, extracted credentials and data, and reported progress to human operators who intervened at only a handful of decision points.
How fast can an AI agent steal credentials?
In one documented case, under six hours. Google’s Threat Intelligence Group reports that in the second quarter of 2026, an attacker used an AI agent framework to enumerate cloud resources, harvest thousands of third-party credentials and prepare data for exfiltration in under six hours after gaining initial access.
Why is AI-written phishing more effective?
Because it is personal, fluent and cheap to scale. Microsoft’s Digital Defense Report 2025 found AI-automated phishing emails achieved a 54 percent click-through rate compared with 12 percent for human-written phishing. AI can study a target’s public profile and writing style, then produce a message that sounds like a colleague, supplier or boss.
Can AI discover zero-day vulnerabilities on its own?
Not as a fully autonomous attack pipeline in the wild, according to Google’s Threat Intelligence Group. AI can help find vulnerabilities and turn patch notes into exploits, but the documented cases still involve human direction at key points. The realistic risk is acceleration, not full autonomy.
How can a business defend against AI-agent attacks?
Start with phishing-resistant authentication such as passkeys and hardware keys, give people and AI agents only the access they need, patch promptly, segment the network, keep tested offline backups, and rehearse a fast response plan. Require human approval for any agent action that moves money, changes permissions or accesses sensitive data.
