Welcome Back to XcessAI

Cybercrime has always had a labour problem.

Finding vulnerable systems takes time. Understanding unfamiliar networks requires expertise. Writing tools takes skill.

Once inside, someone still needs to search for valuable data, steal credentials, move through systems and decide what to do next.

This limited how many attacks an individual hacker or criminal group could conduct at once.

Artificial intelligence is beginning to change that constraint.

New research from CrowdStrike describes four previously unreported threat groups using AI agents not merely to help write malicious software, but to make decisions and execute parts of real cyberattacks.

One group built a system in which one AI agent supervised the operation while another executed tasks. Another allowed agents to pursue targets with substantial autonomy and delegate work to specialist agents in parallel.

Even the least technically sophisticated group studied by CrowdStrike successfully compromised government and private-sector systems while relying heavily on publicly available AI tooling.

The important development is not that AI has invented cybercrime. It hasn't. Most of these attacks relied on familiar vulnerabilities, stolen credentials and poor security practices.

What AI appears to be changing is something more fundamental.

The economics of attacking someone.

Cybercriminals have been using AI for years.

That is essentially the criminal version of a copilot.

The human still performs the operation. AI makes individual tasks easier.

Agentic systems change the architecture.

Instead of asking AI how to perform each step, an attacker can increasingly define an objective and allow software to perform multiple steps towards it.

The progression resembles what is already happening inside legitimate businesses:

AI answers → AI uses tools → AI performs tasks → AI coordinates tasks → AI pursues objectives

The technology does not care whether the workflow is preparing an investment report or searching a network for exploitable systems.

CrowdStrike observed attackers building exactly these kinds of structures. In one campaign targeting healthcare organisations in Argentina, a "Supervisor" agent selected the next task while an "Executor" agent performed it. The attackers compromised at least 15 organisations, with evidence that credentials and medical records were stolen from at least one victim.

Another group created systems capable of conducting reconnaissance and allowing AI to choose among possible actions, while more advanced versions could delegate work across multiple specialised agents.

This starts looking less like a hacker using an assistant.

It starts looking like a small digital workforce.

There is an important qualification. These systems were not generally discovering extraordinary new ways to break into organisations.

CrowdStrike says the attacks largely exploited existing security weaknesses rather than novel vulnerabilities.

That might sound reassuring. It shouldn't.

Because there is an enormous amount of ordinary vulnerability in the world.

Historically, many of these weaknesses survived partly because attackers also faced constraints.

There are millions of potential targets. Investigating each one requires effort.

A skilled hacker has limited hours in the day. AI changes that calculation.

Reconnaissance can happen automatically. Different systems can be analysed in parallel. Tools can be generated or adapted quickly. Results can be processed continuously.

An attacker can increasingly supervise the operation rather than perform every action personally.

CrowdStrike describes agentic AI as operating at machine speed, sometimes achieving objectives within an hour. It believes these capabilities are beginning to commoditise baseline offensive cyber operations.

Anthropic reached a similar conclusion in its own threat-intelligence research.

It has observed malicious actors using Claude across a spectrum of autonomy, from conventional assistance through to multi-agent systems running reconnaissance, exploitation and data theft against multiple victims in parallel for hours or days.

In some cases, scheduled agents operated with no human continuously in the loop.

But Anthropic makes an important distinction.

Humans still tend to make the decisions that matter most to them, particularly choosing targets, reviewing results and deciding how stolen information will be monetised.

This is not autonomous AI spontaneously deciding to become a criminal.

Humans remain behind the operation.

What changes is the amount of labour required from them.

Anthropic describes the effect in economic terms: autonomy reduces the skills, labour and cost required for each campaign while leaving the potential payoff broadly unchanged.

That makes targets that were previously uneconomic to pursue suddenly more attractive.

Think of a criminal business model.

Suppose investigating and attacking a small company historically required two days of skilled human work.

Perhaps the expected payoff wasn't worth the effort.

Now imagine an AI system can investigate hundreds of similar companies while the human operator manages exceptions.

The expected payoff from each victim hasn't changed. The cost of pursuing them has.

Lower the marginal cost of an activity and you usually get more of it.

This may be the most important implication for businesses.

Companies often think about cybersecurity risk partly through their attractiveness as a target.

That reasoning becomes weaker if attackers can automate much more of the work.

Amazon did not become enormous because every individual product became more valuable. Digital distribution made it economically possible to sell millions of products with relatively little additional effort.

Something similar could happen with cybercrime. A small company may not justify hours of expert hacker attention. It may justify seconds of machine attention.

That means AI could expand the economically addressable market for crime.

Attackers no longer need every victim to be highly valuable. They need the operation across thousands of potential victims to be profitable. And that is a very different threat model.

All four groups studied by CrowdStrike found ways around AI safeguards.

Attackers framed their activity as legitimate security testing, manipulated the context presented to models and in some cases modified the surrounding software environment so that models would continue operating.

That exposes an important limitation in how we think about AI safety.

Guardrails matter.

They can make malicious use harder, identify suspicious behaviour and allow providers to detect and terminate accounts.

Anthropic says it investigates malicious activity, bans offending users and uses the results to strengthen subsequent safeguards.

But guardrails should not be confused with a security perimeter.

A criminal does not need one particular model to cooperate perfectly.

CrowdStrike observed attackers using different models and switching between them partly because protections vary.

Open-weight models create another route entirely.

As models proliferate, criminals can route tasks between systems just as legitimate companies increasingly do.

That creates an uncomfortable asymmetry.

The defender may want every dangerous request stopped. The attacker needs only one workable path.

There is another consequence.

AI may compress the difference between highly skilled attackers and less experienced ones.

CrowdStrike's least sophisticated actor reportedly demonstrated limited security expertise and sometimes had to intervene when the AI became stuck or refused to continue.

Yet the group still managed to compromise multiple targets.

CrowdStrike expects that lower-skilled actors will increasingly be able to conduct campaigns at a scale and effectiveness previously associated with more organised criminal groups.

This doesn't mean expertise stops mattering.

Highly skilled attackers will also have access to the same technology.

They may use it better. But the floor rises.

A mediocre programmer with excellent AI tools can write better software. A mediocre analyst with AI can analyse more information. A relatively inexperienced hacker with agents may eventually conduct more sophisticated operations than their underlying skills would previously have allowed.

We have spent years discussing how AI might democratise coding, design, research and entrepreneurship. It may democratise some forms of crime too.

There is a strange symmetry here with enterprise AI.

Last week we discussed the difference between companies that merely have AI and companies beginning to redesign workflows around it.

Cybercriminals appear to be learning the same lesson. The sophisticated groups in CrowdStrike's research weren't simply opening a chatbot and asking for hacking advice.

They were building workflows.

In legitimate organisations, we call this agentic transformation.

In criminal organisations, the architecture can look remarkably similar.

The objective is different. The organisational logic is not.

That tells us something important about AI itself. The real economic power of agents may not come from making any individual action dramatically better.

It comes from connecting thousands of actions into a process that requires progressively less human labour.

That is valuable whether the process is preparing accounts, writing software or stealing credentials.

The uncomfortable implication of agentic cybercrime is that companies probably shouldn't wait for completely new defensive technologies.

Most of the attacks observed by CrowdStrike still relied on familiar weaknesses.

What AI changes is how cheaply, quickly and persistently those weaknesses can be exploited.

That makes some fairly mundane security measures more valuable, not less.

1. Make stolen passwords less useful

Require multifactor authentication wherever possible, particularly for email, remote access, administrator accounts and systems containing sensitive data.

Where available, use phishing-resistant methods such as hardware security keys or passkeys rather than relying only on SMS codes or push notifications. CISA continues to identify strong MFA as one of the most effective ways to reduce account compromise.

2. Patch what attackers can see

Agentic systems are particularly well suited to scanning large numbers of targets for known weaknesses.

That makes forgotten internet-facing servers, old VPNs, outdated software and unpatched applications increasingly dangerous.

Companies need a reliable inventory of what is exposed to the internet and a process for fixing critical vulnerabilities quickly. CISA continues to rank software updates and attack-surface reduction among its core business security practices.

3. Reduce what a compromised account can reach

Assume occasionally that an attacker will get in.

The next question is how far they can travel.

Use least-privilege access, separate administrator accounts and segmentation so that compromising one employee does not provide access to the entire organisation.

This becomes more important when an AI agent can explore a network continuously and make lateral-movement decisions far faster than a human attacker. CrowdStrike has already observed an AI agent moving laterally and obtaining domain-controller credentials in roughly 20 minutes without further human direction.

4. Improve visibility

If attackers are operating at machine speed, discovering an intrusion days later becomes increasingly inadequate.

Businesses need logging across critical systems, endpoint monitoring and clear alerts for unusual authentication, privilege escalation and data movement.

The objective is not simply to collect logs.

It is to make suspicious activity visible quickly enough that somebody can act on it.

5. Protect the recovery path

Assume that prevention will occasionally fail.

Maintain backups that cannot easily be reached from normal production systems and regularly test whether they can actually be restored.

A backup that has never been tested is closer to an assumption than a recovery plan. CISA specifically recommends separate, secure backups and regular restoration practices to reduce the impact of ransomware and destructive attacks.

6. Don't treat AI guardrails as part of your security architecture

This may be the newest lesson.

Companies should not assume that criminals will be stopped because commercial AI models refuse malicious requests.

CrowdStrike's four observed groups all found ways around model safeguards, while Anthropic says sophisticated threat actors continually attempt to circumvent its controls. AI providers will keep strengthening those protections, but businesses should treat them as an additional friction for attackers rather than a defensive perimeter.

None of these measures is particularly futuristic.

That is the point.

The immediate response to agentic cybercrime may not require an entirely new cybersecurity philosophy.

It may require doing the existing one much better and much faster.

Because if AI lowers the cost of attacking weak systems, then every basic weakness becomes easier to monetise.

Attackers will not be the only ones using AI. Defenders will increasingly use agents to detect anomalies, investigate alerts and respond at machine speed as well. The result may become an arms race in which both sides automate, making speed and resilience increasingly important.

The hacker stereotype is deeply human. Someone sits in a dark room typing commands into a terminal.

That image may gradually become outdated. The future criminal operator may spend less time personally hacking systems and more time managing infrastructure that hacks systems.

The machines do more of everything in between.

This doesn't create some autonomous criminal superintelligence. The evidence does not support that conclusion. Humans remain deeply involved. And most of the attacks CrowdStrike observed still depended on ordinary weaknesses that organisations could have prevented.

But that may actually be the more important lesson.

AI does not need to invent completely new forms of cybercrime to transform the threat. It merely needs to make existing crime cheaper, faster and scalable.

When that happens, the economics change. Targets that were previously too small become worthwhile. Attackers who were previously too weak become capable. Campaigns that were previously limited by human labour can run continuously. And one criminal organisation can potentially pursue far more victims at the same time.

The biggest change may therefore not be a smarter hacker. It may be something much more familiar from every other industry transformed by automation. A more productive one.

Until next time,
Stay adaptive. Stay strategic.
And keep exploring the frontier of AI.

Fabio Lopes
XcessAI

💡Next week: I’m breaking down one of the most misunderstood AI shifts happening right now. Stay tuned. Subscribe above.

Read our previous episodes online!