Defending at AI Speed: Same Gaps, Less Effort

On November 2025, Anthropic disrupted an espionage campaign where a human operator set the target and Claude ran nearly all of the operation itself: scanning infrastructure, exploiting a flaw, harvesting credentials, moving laterally. The human checked in at only a handful of points per campaign.

That case isn't isolated. Anthropic's own review of 832 accounts banned for misuse found AI use climbing across the attack chain, and separate cases from Sysdig, Palo Alto Networks Unit 42, and Check Point Research show the same shift: the technique doesn't change, the labor does.

In this session, Cyberthreat Research Manager Lucie Cardiet walks through four documented cases of AI-accelerated, human-directed attacks (an espionage campaign mostly run by a model, a cloud compromise that reached admin access in minutes, an investigation covering 50-plus MITRE ATT&CK techniques in under 10 hours, and AI-assisted ransomware built by a novice operator) and what they mean for detecting a familiar attack running at an unfamiliar speed.

You'll walk away with:

• How to tell a human-directed, AI-accelerated attack from a fully autonomous one, and why that distinction changes what you defend against.
• The behavioral signals (burst rate, latency between steps, volume per identity per hour) that catch these attacks without a new detection category.
• Three checks you can run this week, with the tools you already have.