Cyber threat actors are beginning to use artificial intelligence as an active participant in attacks, rather than simply as a tool for research or content generation, according to a new report from Mandiant.
The AI Risk and Resilience report found that adversaries are increasingly offloading operational tasks to autonomous or agentic systems capable of conducting reconnaissance, validating vulnerabilities, harvesting credentials and adapting attacks at machine speed.
Mandiant, part of Google Cloud, said the shift represented a significant change from the comparatively basic use of generative AI previously observed across the threat landscape.
Instead of asking a chatbot for technical advice, some attackers are now incorporating large language models into multi-stage attack workflows, allowing the technology to make decisions and pivot as an operation unfolds.
Google Threat Intelligence Group has tracked threat actors deploying agentic tools such as Hexstrike and Strix for autonomous reconnaissance and vulnerability validation. Adversaries are also building middleware, proxy relays and automated account-registration pipelines to bypass AI safety controls and gain access to premium commercial models.
The report highlighted what GTIG assessed with high confidence was the first publicly confirmed case of a cybercriminal using an AI-developed zero-day exploit to prepare a mass exploitation campaign.
The vulnerability enabled attackers to bypass two-factor authentication on a popular open-source system administration platform. GTIG coordinated with the affected vendor to disclose the flaw and disrupt the associated activity.
The development is particularly significant because vulnerability exploitation has remained the leading initial infection vector observed by Mandiant for six consecutive years.
Mandiant said frontier AI models could now help identify previously unknown vulnerabilities and chain together complex exploits at a speed that placed greater pressure on security teams already struggling with alert volumes and limited resources.
Other cases examined in the report showed attackers integrating AI directly into compromised environments.
During an investigation at a global healthcare organisation, a threat actor used stolen developer credentials to establish a virtual machine as an AI-assisted offensive hub. The attacker loaded project documentation into an AI model, used it to debug data-harvesting tools and created scripts capable of rotating IP addresses when servers were blocked.
The campaign ultimately compromised thousands of credentials and exfiltrated API keys and financial information.
Mandiant also observed malware using embedded AI models to examine the security tools installed on an endpoint and dynamically rewrite its commands to evade detection. Because the resulting malicious code was not stored in a consistent form, traditional signature-based tools and forensic techniques could fail to identify it.
The report argued that defending against machine-speed attacks would require organisations to move beyond manual triage and static controls.
Recommended measures included eliminating long-lived credentials, placing strict restrictions around outbound network access, monitoring unusual CPU and GPU activity and automatically suspending entire malicious execution trees when suspicious AI-driven behaviour was detected.
Security operations centres would also need telemetry covering model prompts, token usage, API calls, agent activity and access to sensitive assets.
Mandiant said AI systems were neither inherently unsecurable nor capable of defending themselves. Resilience would depend on organisations establishing strong identity boundaries, monitoring agent behaviour in real time and being able to contain compromised workflows before they could move laterally through an environment.
