The evolution of weaponry has always been about extending human reach—from the spear that lengthened the arm to the aircraft that delivered destruction across oceans. Yet throughout this progression, one constant remained: a human hand chose the target and executed the strike. In the cyber domain, that same principle held true for years, with attackers relying on tools that required manual direction at every stage. Today, however, a new paradigm emerges where the instrument itself can decide where to strike, fundamentally altering the balance between operator and effect. This shift is not merely an incremental improvement; it represents a philosophical break in how offensive capability is conceived and deployed.
Agentic artificial intelligence marks the moment when a tool stops being a passive assistant and becomes an autonomous actor capable of pursuing an objective without continual human oversight. For the past three years, AI has functioned largely as a sophisticated scribe—drafting phishing lures, suggesting exploit code, or outlining malicious functions—before handing the product back to a person to weaponize. That era, while dangerous, kept the technology tethered to its operator’s intent and skill level. Agentic systems cut that tether, taking a high‑level goal and independently navigating the steps needed to achieve it, from reconnaissance to execution. The consequence is a dual‑edged sword: it empowers novices with genuine potency while accelerating the tempo of seasoned adversaries far beyond what defenses have traditionally anticipated.
Consider the novice threat actor, historically hampered by gaps in technical knowledge or coding ability. Such individuals can now invoke an agentic model, state a desired outcome—say, credential harvesting from a specific organization—and watch the system autonomously gather open‑source intelligence, craft convincing lures, dispatch them, and manage responses, all without a single line of manual script. I have coined this phenomenon “script kiddie as a service” to capture the democratization of sophisticated attacks. The barrier to entry collapses; motivation and access to a capable model become the primary determinants of threat potential, reshaping the attacker landscape in real time.
When many unskilled operators rely on similar foundation models and apply them in comparable ways, their tactics begin to converge, forming what analysts call a behavioral monoculture. This uniformity creates a silver lining for defenders: predictable patterns in phishing phrasing, exploit chains, and command‑and‑control traffic become easier to spot at scale. Yet the downside is a surge in volume—more actors can launch credible campaigns, increasing the noise floor and straining detection resources. Skilled adversaries will inevitably deviate from the baseline, adding nuance and evasion, but the bulk of the threat will still exhibit recognizable fingerprints that can be leveraged for proactive mitigation.
For seasoned offensive practitioners, agentic AI does not necessarily impart new expertise; rather, it amplifies existing tradecraft through parallelization and speed. By encoding proven methodologies into an agent’s playbook, a single operator can launch dozens of campaigns simultaneously, compressing weeks of manual effort into hours. This acceleration widens the overall threat surface, as both the number of effective attackers and the tempo of their actions increase. Authorized red‑team operations that ignore these capabilities risk training against outdated scenarios, leaving organizations unprepared for the velocity and scale of real‑world adversaries who have already integrated agentic workflows into their arsenals.
One illustrative use case is autonomous social engineering. An agent first scrapes publicly available data—LinkedIn profiles, corporate press releases, conference recordings—to build a richly detailed target portrait. A second agent then consumes that profile to generate hyper‑personalized messages, adapt tone based on replies, and steer the conversation toward a predefined goal, such as obtaining credentials or eliciting a file transfer. Throughout this loop, no human intervenes; the system manages the dialogue, adjusts tactics in real time, and pursues the objective with relentless consistency. The result is a spear‑phishing effort that feels bespoke and credible, bypassing many traditional heuristics that rely on generic templates.
The danger here is not merely the speed of delivery but the quiet erosion of the signals defenders have long trusted. Conventional phishing filters leaned heavily on linguistic tells—poor grammar, repeated phrases, identical payloads sent to thousands of recipients. Agentic craftsmanship erases those clues; each communication is fluid, unique, and grounded in verifiable facts about the recipient. While infrastructural indicators like sender reputation and domain authentication still function, they now bear a heavier burden of detection. As the semantic and template‑level cues fade, security teams must invest more heavily in behavioral analytics, anomaly detection, and real‑time reputation scoring to keep pace.
Beyond messaging, the same autonomous principles are reshaping exploit development. Frontier language models are becoming adept at chaining tool calls, self‑correcting based on environmental feedback, and navigating complex APIs with minimal prompting. Consequently, the threshold for producing a working exploit drops with each model release, prompting regulatory scrutiny—witness the recent federal actions targeting specific high‑capacity models. When these models are coupled with a retrieval‑augmented database of known vulnerabilities, they can autonomously scan a target, infer likely exposure points, select a matching exploit from the store, and announce readiness to execute, much like a hunting dog signaling a scent trail.
Malware, too, is undergoing an agentic metamorphosis. Existing strains are being rewritten by AI‑driven systems to produce quieter, more evasive variants that slip past signature‑based controls honed on earlier forms. This trend traces back to early prototypes such as the Guided Network Access Weapon (GNAW), which demonstrated how an agent could dynamically adjust its network behavior based on real‑time feedback. The danger lies in the model’s tendency to prioritize task completion over ground truth: it will assert that a particular exploit will succeed based on superficial pattern matches, without verifying version numbers, patch levels, or service reachability. When such overconfidence meets a retrieval system that returns loosely related results, the likelihood of false positives—and consequently, wasted effort or accidental detection—increases sharply.
This challenge underscores why the SANS Secure AI Blueprint, devised by Chief AI Officer Rob T. Lee, frames the problem across three interlocking tracks: Protect AI, Utilize AI, and Govern AI. Governance establishes the policies and oversight that keep these powerful tools accountable. Protection hardens the production systems an organization actually runs, reducing the attack surface. Utilization, however, is where the rubber meets the road—where AI is actively employed for both offensive and defensive purposes, and where offensive operations constitute the sharpest edge of insight. Only by running live agentic attacks against one’s own defenses can an organization truly gauge whether its safeguards hold under realistic pressure.
Leadership often envisions “AI security” as a matter of policy binders and governance committees meeting behind closed doors. Yet the Utilize track delivers tangible proof: actual exploit attempts launched against live systems reveal whether theoretical controls survive contact with adversary tactics. An organization may approve every guideline imaginable and purchase the latest defensive stacks, but until someone turns the agentic tooling inward, the effectiveness of those measures remains untested. The operator who launches these validation exercises becomes the linchpin of accountability, bridging the gap between abstract risk management and concrete, measurable resilience.
Returning to the weapon metaphor, the core issue has not changed: while machines can now aim themselves, they lack the discernment to judge whether a shot should be taken. An agent will confidently declare a target viable and request permission to fire, even when the target is a mirage constructed from flawed data or hallucinated associations. The responsibility to separate genuine opportunity from convincing illusion has therefore shifted squarely to the human in the loop. This judgment—knowing when to trust the machine’s output and when to intervene—has become the most critical skill in modern offensive and defensive cyber work, outweighing raw technical dexterity.
This August, I will explore these dynamics in depth during the SEC535: Offensive AI – Attack Tools and Techniques course at SANS San Antonio 2026. Over three intensive days of hands‑on labs, participants will practice AI‑assisted reconnaissance, autonomous social engineering, deepfake and voice‑cloning tactics, AI‑supported vulnerability discovery, and the use of AI in malware development and evasion. By wielding the tooling themselves, attendees will gain an experiential grasp of the technology’s reach, its inherent limits, and the precise junctures where blind trust becomes hazardous. Understanding the distance between knowing a capability exists and being able to employ it responsibly is the essence of true mastery.
The machine will handle the aiming; you must supply the judgment behind the shot. To translate this insight into action, organizations should institute regular red‑team exercises that incorporate agentic workflows, invest in continuous validation of AI‑generated outputs, and train security teams to spot the subtle behavioral anomalies that evade traditional filters. Leaders ought to balance governance with practical utilization, ensuring that policy informs practice without stifling the ability to test defenses under realistic conditions. Those who embrace this balance will be best positioned to anticipate, detect, and neutralize the next generation of autonomous threats.