Cybercrime at machine speed: How agentic AI is changing the risk equation

The weaponisation of AI-powered penetration-testing tools is no longer theoretical. Threat actors are using them in real intrusions, exposing a potentially significant weakness in how businesses and insurers think about cyber risk.

For years, we have been asking when artificial intelligence will fundamentally change the cyber threat landscape. The answer may be that it already has, although perhaps not in the way many expected.

The most consequential development is not necessarily AI discovering extraordinary new vulnerabilities or inventing sophisticated new forms of malware. It is something rather more straightforward, and potentially more dangerous.

AI is making it possible to find and exploit the weaknesses that already exist in our technology, repeatedly, relentlessly and at a scale previously beyond the reach of most attackers.

Recent threat intelligence suggests we are entering a new phase of cybercrime in which human operators increasingly delegate the work of reconnaissance, vulnerability discovery, exploitation and lateral movement to autonomous AI agents.

For businesses, that changes the speed at which an attack can develop. For insurers, it raises difficult questions about the frequency, severity and potential aggregation of cyber losses.

From penetration testing to automated intrusion

Penetration-testing tools are nothing new. Security professionals have long used them to identify weaknesses in systems before criminals can exploit them. Equally, criminals have long repurposed legitimate security tools for malicious purposes.

What is changing is the degree of autonomy.

Agentic penetration-testing frameworks combine large language models with conventional security tools, allowing AI agents to interpret results, select their next actions, execute commands and adapt when something does not work. Rather than following a rigid script, an agent can assess an environment, investigate potential weaknesses, test different approaches and use what it learns to inform its next move. Several agents can perform different tasks simultaneously, sharing findings and building on each other’s progress. The human attacker still sets objectives and frequently makes important decisions. But much of the work that previously required skilled operators, working sequentially, can now be delegated to machines.

And we are seeing this happen with increasing frequency and scale in live incidents, as well as hearing wider reports that suggest our experience is not isolated.

On 21 October 2026, Microsoft reported that Storm-0940, a China-state-aligned threat actor, had been using ARTEX, an open-source agentic penetration-testing framework, to automate attacks against hundreds of organisations globally. In some cases, the attackers obtained privileged access to cloud infrastructure less than three hours after initially targeting an organisation. The same actor was linked by Microsoft to the ConnectWise supply-chain compromise, following which ARTEX was used in attempts to authenticate to more than 2,250 downstream customer tenants. Not all those attempts succeeded, and attempted access should not be confused with confirmed compromise. Nevertheless, the scale and speed are striking.

Days later, Google and Mandiant described observing multiple threat actors using frameworks including ARTEX, Hexstrike and CAIRN during live intrusions. Their investigations found agentic tools being used for activities ranging from reconnaissance and privilege escalation to lateral movement, database exploitation and preparation for data exfiltration.

This is no longer simply a question of whether AI could be used offensively. It demonstrably is. 

Why cloud infrastructure presents such an attractive target

One particularly concerning aspect is the exposure of modern cloud and software development environments.

Businesses increasingly depend on common cloud platforms, standardised web applications, shared development tools and automated deployment infrastructure. There are considerable commercial advantages to this standardisation. It makes technology cheaper to develop, easier to deploy and simpler to scale. But it also creates opportunities for attackers.

Where organisations share software, configurations or security weaknesses, an attack method that works against one environment may be repeatable against others. AI-driven tools make it easier to discover these similarities and adapt exploitation techniques across different targets.

A recent Wiz investigation provides a particularly instructive example. In an intrusion involving a substantial multi-cloud environment, AI agents moved through internet-facing applications, cloud infrastructure, Kubernetes clusters, identity systems and software development pipelines. One confirmed entry point involved a vulnerable internet-facing application. From there, the agents harvested credentials, mapped internal access and explored additional ways of compromising the environment.

Significantly, the same attacking infrastructure was observed scanning more than 600 other Wiz customer environments during the relevant period. That does not mean 600 organisations were compromised. It does, however, illustrate the capacity for broad, opportunistic targeting alongside a sophisticated intrusion.

Perhaps most concerning was what happened when the agents reached the organisation’s software development infrastructure. Continuous integration and continuous deployment (CI/CD) systems, which automate software building, testing and deployment, became mechanisms for executing further malicious activity. The agents exploited access to development pipelines, harvested secrets, tested credentials against other systems and used deployment infrastructure to extend their reach.

GitHub repositories, development workflows and infrastructure-as-code environments deserve particular attention in this context. These systems may contain sensitive configuration information or provide access to credentials and deployment permissions. Where compromised, they can become routes into production systems and, potentially, onward into customer environments.

The danger is not simply that criminals might steal source code. It is that they may obtain access to the machinery through which software and infrastructure are created, configured and controlled.

The economics of cybercrime are changing

There is, of course, a wider point here.

Historically, sophisticated cyber operations required substantial investment in people, expertise and time. An attacker might identify an opportunity but lack the resources to exploit it across a large population of potential victims. Even where vulnerabilities were known, exploiting them at scale required tools, infrastructure and skilled operators capable of adapting to different environments.

Agentic AI reduces some of those constraints. An attacker can direct agents towards multiple targets simultaneously. Those agents can investigate unfamiliar technology, troubleshoot unsuccessful attempts and continue operating without the interruptions associated with human working patterns.

This does not mean every attack will succeed or that AI has rendered existing security controls ineffective. The technology is still developing, and current agentic attacks can be (and often are) noisy, inefficient and prone to mistakes. But the direction of travel matters. If the cost of attempting an intrusion falls substantially, more targets become economically attractive. If successful techniques can be adapted and repeated more quickly, attackers can potentially exploit a vulnerability across a large population before organisations have had an adequate opportunity to respond. And if the time between initial compromise and serious damage contracts from days to hours, the value of security monitoring that depends on human intervention may diminish.

This is not simply an increase in attacker sophistication. It is a change in the economics of attacking.

The implications for cyber insurers

For insurers, these developments raise three particularly important issues.

The first is aggregation.

Cyber insurers already recognise the potential for common vulnerabilities, shared service providers and software supply-chain dependencies to generate correlated losses. Agentic exploitation could amplify that exposure by allowing attackers to identify and exploit common weaknesses more efficiently. An insurer’s portfolio may contain hundreds of businesses operating apparently independently, but relying on remarkably similar cloud architectures, software components and development environments.

The question is whether underwriting and accumulation models adequately recognise those technological commonalities, particularly where a single exploitable weakness could provide opportunities across multiple insureds.

The second issue is claims severity and incident response.

If an intrusion can progress from initial access to privileged cloud control in a matter of hours, the traditional window for investigation and containment becomes increasingly compressed. Claims teams and incident response providers may need to reconsider the practical assumptions underlying response times, escalation arrangements and the coordination of legal and technical workstreams.

There is also a forensic challenge. Agentic attacks may generate substantial volumes of activity across multiple systems simultaneously, complicating the task of reconstructing what happened, establishing the extent of compromise and identifying which actions resulted in loss.

The third issue concerns liability and the allocation of loss.

Where an attack exploits weaknesses in software development platforms, managed services or shared infrastructure, questions may arise about the responsibilities of technology suppliers and the businesses relying upon them. Those questions are familiar, but the consequences may become more significant where a single weakness enables multiple downstream compromises. For insurers, this may affect not only first-party cyber losses but also technology professional indemnity exposures, contractual disputes and potential recovery actions.

Policy language governing covered events, aggregation, exclusions and the allocation of liability will need to be considered against the facts of each incident. The use of an AI agent does not, of itself, change the applicable coverage analysis but what it may change is the scale and complexity of the losses that analysis must address.

Are we asking the right questions?

There is a temptation to conclude that the answer to AI-powered cybercrime must be equally sophisticated AI-powered defence. That will undoubtedly be part of the response. But it risks overlooking a more fundamental issue.

Many of the vulnerabilities being exploited are not new. They involve familiar problems, such as exposed applications, excessive permissions, compromised credentials, poorly secured development environments and inadequate separation between systems.

The essential protective measures are similarly familiar. Restrict privileges, manage credentials carefully, segment environments, control access to deployment infrastructure and ensure that security teams can detect and contain suspicious activity quickly.

What agentic AI changes is the margin for error.

Weaknesses that once might have remained undiscovered or required considerable effort to exploit may now be identified and tested repeatedly, at speed and across many environments. For businesses and their insurers, this raises a question that goes beyond the latest generation of security tools.

How much of our approach to cyber resilience still depends on attackers being constrained by human time, skill and resources?

If those constraints are disappearing, we need to revisit our assumptions about what constitutes an acceptable level of vulnerability, how quickly organisations must be capable of responding and how exposures accumulate across interconnected technology.

The greatest risk may not be that AI teaches criminals entirely new ways to break technology. It may be that it allows them to exploit, at unprecedented speed and scale, the weaknesses we have tolerated for years.