For 4 days in July, not less than eight AI brokers labored by way of Taiwanese authorities networks, mapping programs and adjusting their strategies every time one strategy failed. No human sat at a keyboard directing the intrusion in actual time. A vendor didn’t construct this state of affairs for a slide deck. Taiwan’s Ministry of Digital Affairs confirmed it occurred on August 13, and it’s the second documented case of its type in 9 months.
Three Knowledge Factors, One Pattern Line
The primary documented case got here from Anthropic, which disclosed in November 2025 it had disrupted a large-scale cyberattack carried out with minimal human involvement. The corporate attributed the operation to a Chinese language state-sponsored group it tracks as GTG-1002. Investigators discovered Claude executed an estimated 80% to 90% of the operation independently, with human operators intervening for a mixed whole of roughly 20 minutes throughout all the marketing campaign. The AI carried out reconnaissance, recognized vulnerabilities, harvested credentials, extracted information, and generated its personal after-action experiences throughout roughly 30 targets spanning know-how corporations, monetary establishments, chemical producers, and authorities companies. The attackers received Claude to cooperate by posing as a reputable cybersecurity agency operating defensive exams, a social engineering transfer aimed on the AI system itself fairly than at a human goal.
The Taiwan case, investigated by the Israeli safety agency Dream after it recovered roughly 160 megabytes of the attackers’ operational recordsdata, adopted the same construction with extra autonomy distributed throughout extra brokers. Eight AI programs labored in parallel, inspecting 21 authorities programs, compromising not less than 85 accounts, and extracting greater than 2,500 personnel data from targets spanning the Ministry of Justice, a nuclear security company, and 7 energy-sector corporations. Taiwan confirmed an “abroad, AI-assisted assault” with out formally naming a state sponsor, although investigators discovered inside communications in Simplified Chinese language.
CrowdStrike’s 2026 Risk Searching Report places the Anthropic and Taiwan circumstances in a wider context. The agency discovered 88% of vulnerabilities with public proof-of-concept exploit code get exploited inside 48 hours of disclosure, with China-linked teams it tracks as Vault Panda and Genesis Panda transferring in as quick as 24 hours. Detections triggered by AI brokers grew at 2.5 occasions the speed of detections triggered by human analysts. One marketing campaign despatched 200,000 automated requests to an AI mannequin in a two-minute span. Adam Meyers, CrowdStrike’s head of counter adversary operations, summarized the shift instantly: “AI is now embedded in fashionable adversary operations. It’s altering how assaults are deliberate, executed, and scaled whereas increasing the assault floor organizations should defend.”
The Constraint AI Attackers Don’t Have
The information suggests the true change is just not velocity. Attackers have used automation to maneuver quicker for years. What’s totally different throughout all three circumstances is the place the human sits within the operation. Within the Anthropic case, human involvement dropped to a handful of approval choices throughout a whole marketing campaign. Within the Taiwan case, people designed the framework and set aims, then let brokers adapt ways on their very own when strategies failed, working constantly fairly than within the shifts a human workforce would wish. Conventional enterprise safety is constructed round assumptions baked in over many years: attackers get drained, make errors, work specifically time zones, and pause to assume. An AI operator shares none of it, and the detection thresholds and staffing fashions constructed round human adversary habits have been by no means designed for an opponent needing no sleep.
What This Means for Safety Budgets
My take: CISOs nonetheless pricing “AI safety” as a single new instrument class to bolt onto subsequent 12 months’s price range are behind the precise requirement. Detection must shift towards habits and anomaly patterns not depending on catching a drained human’s mistake, as a result of the 48-hour exploitation window CrowdStrike documented is now a deadline fairly than a cushty buffer. There’s a much less apparent dependency price naming too: AI mannequin suppliers at the moment are front-line defenders in a means most enterprise safety postures don’t account for. Attackers goal the AI instruments themselves by way of social engineering first, then use the entry gained to achieve the networks behind them. An organization’s safety posture is just as sturdy as the protection controls constructed by whichever mannequin vendor its instruments, and its adversaries’ instruments, run on.
Safety groups spent the final two years debating whether or not AI would make attackers quicker. The talk is over. The following one, about whether or not defenders can function on the similar tempo their adversaries now do, will outline enterprise safety spending for the remainder of the last decade.
For 4 days in July, not less than eight AI brokers labored by way of Taiwanese authorities networks, mapping programs and adjusting their strategies every time one strategy failed. No human sat at a keyboard directing the intrusion in actual time. A vendor didn’t construct this state of affairs for a slide deck. Taiwan’s Ministry of Digital Affairs confirmed it occurred on August 13, and it’s the second documented case of its type in 9 months.
Three Knowledge Factors, One Pattern Line
The primary documented case got here from Anthropic, which disclosed in November 2025 it had disrupted a large-scale cyberattack carried out with minimal human involvement. The corporate attributed the operation to a Chinese language state-sponsored group it tracks as GTG-1002. Investigators discovered Claude executed an estimated 80% to 90% of the operation independently, with human operators intervening for a mixed whole of roughly 20 minutes throughout all the marketing campaign. The AI carried out reconnaissance, recognized vulnerabilities, harvested credentials, extracted information, and generated its personal after-action experiences throughout roughly 30 targets spanning know-how corporations, monetary establishments, chemical producers, and authorities companies. The attackers received Claude to cooperate by posing as a reputable cybersecurity agency operating defensive exams, a social engineering transfer aimed on the AI system itself fairly than at a human goal.
The Taiwan case, investigated by the Israeli safety agency Dream after it recovered roughly 160 megabytes of the attackers’ operational recordsdata, adopted the same construction with extra autonomy distributed throughout extra brokers. Eight AI programs labored in parallel, inspecting 21 authorities programs, compromising not less than 85 accounts, and extracting greater than 2,500 personnel data from targets spanning the Ministry of Justice, a nuclear security company, and 7 energy-sector corporations. Taiwan confirmed an “abroad, AI-assisted assault” with out formally naming a state sponsor, although investigators discovered inside communications in Simplified Chinese language.
CrowdStrike’s 2026 Risk Searching Report places the Anthropic and Taiwan circumstances in a wider context. The agency discovered 88% of vulnerabilities with public proof-of-concept exploit code get exploited inside 48 hours of disclosure, with China-linked teams it tracks as Vault Panda and Genesis Panda transferring in as quick as 24 hours. Detections triggered by AI brokers grew at 2.5 occasions the speed of detections triggered by human analysts. One marketing campaign despatched 200,000 automated requests to an AI mannequin in a two-minute span. Adam Meyers, CrowdStrike’s head of counter adversary operations, summarized the shift instantly: “AI is now embedded in fashionable adversary operations. It’s altering how assaults are deliberate, executed, and scaled whereas increasing the assault floor organizations should defend.”
The Constraint AI Attackers Don’t Have
The information suggests the true change is just not velocity. Attackers have used automation to maneuver quicker for years. What’s totally different throughout all three circumstances is the place the human sits within the operation. Within the Anthropic case, human involvement dropped to a handful of approval choices throughout a whole marketing campaign. Within the Taiwan case, people designed the framework and set aims, then let brokers adapt ways on their very own when strategies failed, working constantly fairly than within the shifts a human workforce would wish. Conventional enterprise safety is constructed round assumptions baked in over many years: attackers get drained, make errors, work specifically time zones, and pause to assume. An AI operator shares none of it, and the detection thresholds and staffing fashions constructed round human adversary habits have been by no means designed for an opponent needing no sleep.
What This Means for Safety Budgets
My take: CISOs nonetheless pricing “AI safety” as a single new instrument class to bolt onto subsequent 12 months’s price range are behind the precise requirement. Detection must shift towards habits and anomaly patterns not depending on catching a drained human’s mistake, as a result of the 48-hour exploitation window CrowdStrike documented is now a deadline fairly than a cushty buffer. There’s a much less apparent dependency price naming too: AI mannequin suppliers at the moment are front-line defenders in a means most enterprise safety postures don’t account for. Attackers goal the AI instruments themselves by way of social engineering first, then use the entry gained to achieve the networks behind them. An organization’s safety posture is just as sturdy as the protection controls constructed by whichever mannequin vendor its instruments, and its adversaries’ instruments, run on.
Safety groups spent the final two years debating whether or not AI would make attackers quicker. The talk is over. The following one, about whether or not defenders can function on the similar tempo their adversaries now do, will outline enterprise safety spending for the remainder of the last decade.
