AI is the new cybersecurity threat: How automated agents and AI bots are helping hackers

The stereotypical image of the hacker as a man in a hoodie may not be accurate anymore. A bunch of AI agents might do more cyberattacks in the near future than humans. In fact, that's already happening. Artificial Intelligence is fast becoming one of the greatest cybersecurity threats in 2026. AI has now shifted from a tool that assists with tasks to an active participant in cyberattacks. The most recent case is the record $6.3 billion Binance cryptocurrency hack on October 29. Binance said the attackers used a compromised internal AI tool to gain control of wallet engineers' computers. This enabled unauthorised use of a wallet-signing service. The FBI has blamed North Korean hackers, which it denies.

How AI is helping cyberattacks

AI agents are often built on open-source penetration-testing frameworks. They run on commercial large language models (LLMs) like Anthropic's Claude and China's DeepSeek. They find vulnerabilities and exploit them, harvesting credentials and stealing data with limited human oversight. Worryingly, one needs no sophisticated tech skills: a few prompts to an AI agent would do.

Rise of agentic activity with speed and scale

CrowdStrike, a US cybersecurity firm, reported a nearly threefold rise in likely agentic AI intrusions in the second half of 2026, compared to the first half. Anthropic, the parent of Claude AI, and others say malicious actors disguise attacks as authorised penetration testing to bypass AI safeguards.

The open-source CyberStrikeAI framework lets attackers run dozens of agents at once. They autonomously handle reconnaissance, vulnerability scanning, exploitation, command-and-control and data theft.

Tokyo-based security firm Trend Micro found one operator running 44 agents against at least 19 organisations, 16 in Japan. The agents generated Japanese-language forms and fake login pages. Kaspersky found CyberStrikeAI targeting schools and universities in Africa and Latin America.

China-linked group Vapor Panda used another framework, ARTEX, against over 200 organisations, including ministries and defence bodies, in 14 countries, with nine intrusions confirmed.

South Korean police arrested a seven-member ring that used ARTEX from late August. The group breached about 90 organisations and stole roughly 8.2 million records.

A single Chinese-speaking operator outsourced almost an entire campaign to AI agents, Reuters reported. Mixing DeepSeek and Anthropic's Claude Code through a platform called Cairn, the agents attacked over 1,200 sites and breached those of more than 100 companies. The cost was minimal: about $5,000 worth of AI tokens.

Multi-agent frameworks are helping cyberattacks, adapting on their own against blocks

A Spanish- and English-speaking operator used a dual-agent design against at least 15 Argentine healthcare organisations, CrowdStrike said. A "Supervisor" Claude Code agent directed an "Executor" agent. In one intrusion, the agent reached a domain controller and harvested password hashes in about 20 minutes, unaided.

Agents switch tactics when blocked. The Reuters report said agents facing a hardened application pivoted to a weaker control panel and exploited a flaw there.

AI is accelerating and scaling existing hacking tactics rather than inventing new ones. Agents excel at rapid iteration, parallel tasking, localised social engineering and sustained probing.

AI is now a force multiplier for skilled and unskilled actors alike. It increases the speed, volume and reach of attacks, giving defenders less time.