In the first days of July 2026, according to Dream Research Labs, an automated attack framework downloaded the JavaScript bundles from a government web portal and parsed them.
Not exploited. Parsed. Out of code the portal serves to every visitor by design, it pulled API endpoints, an identity-provider configuration and two signing keys, then mapped 21 connected government systems including the single sign-on infrastructure tying them together.
Nothing was broken. Any pentester does this in the first hour of an engagement. What is new is that a framework did it, ranked what it found, and moved on without waiting to be told.
I have read five cases this year that get filed under AI attacks. Side by side they say something the headlines do not. Not one needed a technique that did not already exist. The newest compressed a full chain into under ten hours, and the compression came from removing the pauses between known steps.
The five cases
A human operator with an accelerant.
Sysdig documented an intrusion on 28 November 2025 that started with AWS credentials exposed in public S3 buckets and ended in a backdoor administrator. Eight minutes to Lambda execution, admin privileges in under ten. Sysdig's title says AI-assisted and its finding is careful: "multiple indicators that suggest the threat actor leveraged large language models." My reading is a person at the keyboard with models speeding up reconnaissance and code generation, which is not the same as an agent. I have covered it here.
A human setting objectives, with agents executing.
Unit 42 published this on 2 September 2026, and it is the hardest case in the set. A public API breached, repositories combed for hard-coded tokens, those tokens opening the secrets manager, CI/CD hijacked for cloud keys, and finally the victim's own AI endpoints turned into attack infrastructure. Under ten hours, more than 50 MITRE ATT&CK techniques.
Read their framing rather than the headlines. The opening says the network was breached "autonomously," but the figure caption is precise: "The actor sets objectives and makes consequential decisions." Their summary of what made it notable is the sentence that matters: "AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft." The two-week comparison quoted everywhere is their own red-team estimate, not an observed intrusion. One control held: an attempt to backdoor Terraform configurations failed because "hard branch-protection controls stopped this." And they corrected the post on 3 September to clarify this was an intrusion and not ransomware, which several outlets still have wrong.
An agent, inside a deliberately weakened lab.
Hugging Face disclosed an agent-run intrusion in mid-July, and on 21 July OpenAI confirmed it was driven by a combination of its own models. Their technical timeline covers roughly 17,600 recovered actions across 4.5 days.
The context gets dropped constantly: the evaluation "deliberately disabled OpenAI's production safety classifiers and reduced cyber refusals," and "no human directed the individual steps." That does not shrink it. A weakened sandbox still produced a real multi-stage intrusion against a real third party, and one over-scoped credential gave the agent cluster-admin on two clusters within one second of impersonating it.
AI tooling abused as infrastructure, with no model deciding.
Self-replicating worms have been moving through npm since 2025. The payload runs at install time, harvests every token on the host, and republishes itself through whatever the victim can publish to. Elastic Security Labs identified the latest wave on 4 August, reporting over 400 compromised packages.
The propagation logic is deterministic code, not a model choosing moves. But AI tooling is all over it: a hook that fires on a new Claude session, commits authored as claude@users.noreply.github.com, and a collector hunting Anthropic, OpenAI and Cursor credentials. This is what AI in an attack chain mostly looks like right now: developer tooling as execution surface, AI keys as loot, and nothing deciding anything.
A near-autonomous framework, in the wild.
Back to the Dream case, published 12 August. The recovered workspace runs to 1,395 files covering 12 attack waves, dispatching up to eight sub-agents per wave while ranking 14 attack chains continuously. Three findings carry the rest of this post: unauthenticated APIs returning valid sessions with no credentials supplied, one API honouring JSON Web Tokens signed with the none algorithm, and 85 accounts cracked by spraying, of which 84 pivoted through an SSO bridge into an internal system.
Note the word Dream uses and most coverage dropped: near-autonomous. There was a person in this loop, and model refusals were bypassed by framing the activity as authorised penetration testing.
The counts originate in the framework's own reports. Dream validated the SSO pivot rate itself and says it notified the affected organisations before publishing, while its spokesperson told CSO Online that the research found no evidence of a confirmed breach of the entity's systems, declining to name the entity. The techniques are the durable part.
The same three blind spots
I map intrusions against three structural gaps in how detection works. These five did not need forcing into the shape.
Gap 1. Nothing looks wrong.
Dream's entire reconnaissance phase ran against material the target publishes on purpose. The weaknesses that worked were server-side and mundane: unauthenticated APIs, weak token validation. No payload on disk, because there was no payload. Sysdig's case is the same shape one layer down, on native AWS services and real credentials, with every action supported and logged correctly.
Nothing they did ever looked wrong.
Gap 2. Authentication succeeds.
Usernames come from an API that requires no authentication. Predictable patterns get sprayed in rounds. OCR solves the CAPTCHA. Any account that falls produces a correct sign-in, and there is no unauthorised access event to open a ticket on.
The none-algorithm finding deserves its own line. An API that honours a token asserting it needs no signature is not being tricked. It has agreed to skip the check, and to that API a forged token and an issued one are the same thing.
Authentication succeeds.
Gap 3. Movement isn't visible.
The figure to remember is 84 of 85. Those credentials broke on an office automation portal, a low-value edge system. The SSO bridge then extended that access into internal dashboards and personnel data. The credential falls in one plane, the access is realised in another, and the federation between them does exactly what it was built to do, logging a successful sign-in on every hop.
Three audit logs, three SOC tickets, one breach.
The compression is real. It is not model speed.
Breakout time, the interval between initial access and the first lateral move, was retired as a metric by CrowdStrike on 1 September, on the grounds that what the industry had been calling machine speed was human speed with better tools. No replacement was named, beyond the argument that attacks now run at inference speed and leave no time at all.
The next day, Unit 42 published a ten-hour intrusion and gave its own account of where the ten hours came from. Not inference. This, verbatim: "AI agents reduce the time between steps in the attack flow: AI agents in this attack were designed to parse raw tool output and quickly take next steps." Model latency is not mentioned anywhere in the report. What is mentioned is parallelism, real-time re-planning without operator round-trips, and no human dwell between a tool returning output and the next action firing.
Set the durations next to each other. Sysdig, human at the keyboard with models assisting: eight minutes. Unit 42, human setting objectives with agents executing: under ten hours. A ransomware crew Sophos tracked with no AI anywhere: under 17 hours. Dream: roughly four days. Hugging Face: 4.5 days.
There is no clean line from more automation to less time. The two cases where no human was directing the individual steps are the two slowest, by roughly a factor of ten, and a human with no AI at all came in slower than a human running agents. Duration tracks how tightly the objective was defined, not how much of the work a model did. The compression is real, and calling it inference speed points at the wrong control.
What to do about it
Nothing here changes the framework. It changes the order of the list.
- Enumerate what your own front end publishes. API endpoints, OAuth client IDs, identity-provider configuration. Assume the bundles are parsed and cross-referenced, because now they are.
- Treat unauthenticated APIs as an identity problem, not a hygiene finding. An endpoint returning staff names and SSO identifiers without a credential is a username list. Rank it by what it feeds, not by what it exposes.
- Validate token algorithms and audit federation trust. A JWT accepted with
noneis an auth system that has agreed not to authenticate. And 84 of 85 means the SSO bridge is your real blast radius. - Inventory your AI tooling and compute as attack surface. The npm worms run through a session hook and hunt AI provider keys. Unit 42's attacker turned the victim's own model endpoints into infrastructure, hiding orchestration traffic in expected traffic and billing the compute to the victim.
- Hunt the loop, not the payload. Unit 42's indicators are the most concrete thing published on agentic intrusions so far: bursty API requests, rapid 401 to 200 state shifts, parallel authentications, and sudden model usage from unexpected identities.
Where behavioral detection sits in this
All five intrusions were logged. Unit 42's case is the cleanest illustration of why that is not enough. An API call, a repository checkout, a secrets read, a pipeline run, a cloud key used against a model endpoint. Every one authorised on its own and in the right log. Ten hours is a long time in incident response, and no time at all if the only way to see the chain is to assemble five systems by hand afterwards.
Hugging Face's account of how theirs surfaced is the most useful paragraph published all summer. The first signals came from several layers at once and "on their own, each was ambiguous." Then: "[...] those were correlated by our AI-based security agent stack and resolved into a coherent attack signal. However, it failed to correctly raise the alert's criticality and trigger the on-call team, costing precious time in the response."
Correlation worked. The stack assembled ambiguous signals into one coherent attack, and then the finding sat there because nothing decided it was urgent enough to wake anyone. That is a triage failure at the end of a detection success, which is a different problem with a different fix.
Detection isn't broken. It's incomplete. That was true when the operator was a person typing, and these five say it holds when the operator is a framework ranking 14 attack chains at once. Track the behavior, not the brand behind the attack.
The long version of the three gaps is in Mind Your Attack Gaps.