The Tipping Point: When Cyber Attacks Stop Being Limited by People
For decades, the number and sophistication of cyberattacks were constrained by the people behind them. Skilled attackers were relatively rare, complex intrusions required experience, and investigating a failed attack often meant spending hours figuring out what went wrong.
I think we have just crossed a threshold that fundamentally changes this situation.
Over the past weeks, we have seen real-world attacks involving autonomous AI frameworks such as ARTEX and Cairn. These frameworks can plan significant parts of an intrusion, execute tools, evaluate their results and try alternative approaches when something fails. The human operator still provides objectives and may intervene, but no longer needs to direct every step.
This capability is already being used in real attacks. And I think the consequences for the coming years will be substantial.
1. Past: Attacks Were Limited by People
For a long time, the attacker ecosystem had a fairly clear distribution of skills. At the bottom were large numbers of poorly skilled attackers running port scanners, public exploits, brute-force tools and Metasploit modules without necessarily understanding how they worked. When an exploit failed or a target behaved differently than expected, many simply moved on.
A smaller group had enough technical knowledge to adapt existing tools, investigate vulnerabilities, develop scripts and carry out more complex intrusions. And then there was a relatively small group of highly capable operators who could develop sophisticated malware, discover or purchase exploits, evade security controls and maintain access to well-defended organizations for months.
Of course, large-scale automated attacks existed long before AI. Botnets, vulnerability scanners and exploit frameworks could already target enormous numbers of systems. But the adaptive parts of complex intrusions still required considerable human expertise. Someone had to understand the results, choose the next step and troubleshoot unexpected problems.
Human skill, time and attention remained important constraints.
2. Now: The Threshold Has Been Crossed
For years, researchers experimented with combining LLMs and penetration-testing tools. Many early implementations were impressive demonstrations but struggled with complex tasks. They lost context, made mistakes, got stuck and required frequent human intervention.
That has changed.
Models have become capable enough, and orchestration frameworks mature enough, that agents can now perform substantial parts of real intrusions autonomously. Frameworks like ARTEX and Cairn make it possible to give an agent an objective, provide it with tools and let it explore possible attack paths.
It can enumerate exposed services, investigate vulnerabilities, test credentials, execute commands, evaluate the results and try different approaches when something fails. The operator can monitor the process and intervene when necessary, but doesn’t have to make every decision.
The important development is the combination of increasingly capable models, orchestration, persistent context and access to offensive tools. Open-weight models make this particularly interesting because attackers can operate their own infrastructure, modify models and combine them with custom skills without depending entirely on commercial AI providers.
And we’re no longer talking about laboratory experiments. In September 2026, Gambit Security documented a campaign in which 105 Cairn attack projects were launched in five days, with at least 27 organizations compromised to varying degrees. Google, Mandiant, Microsoft and CrowdStrike have since documented additional real-world activity involving agentic offensive frameworks.
These attacks aren’t necessarily sophisticated or stealthy. They often use familiar techniques and generate plenty of recognizable activity. But the agents can work through failures and alternatives at a speed that previously required considerably more human effort.
That is the threshold I believe we’ve crossed: autonomous attack execution has become operationally useful.
3. Near Future: The Economics of Cyberattacks Change
What worries me most is what happens next.
Get Florian Roth’s stories in your inbox
Join Medium for free to get updates from this writer.
The average attacker doesn’t suddenly become a top-tier intrusion specialist. But someone with limited technical knowledge can now operate tools that make decisions and perform tasks previously requiring much more experience. Skilled operators, meanwhile, can automate large parts of their work and run more operations in parallel.
These agents don’t need sleep, holidays or weekends. They can operate continuously, testing different approaches against different targets. As models become more capable and inference becomes cheaper, the cost of running these operations will likely continue to decrease.
That changes the economics of an attack.
Organizations that previously weren’t attractive enough to justify hours or days of manual investigation may become worthwhile when they can be processed automatically. The attacker can investigate many more potential targets, concentrate effort where access appears promising and move on when the cost becomes too high.
I’m particularly concerned about the implications for critical infrastructure. These environments often depend on complex, interconnected systems and software that cannot easily be replaced or updated. The ability to conduct many adaptive intrusions in parallel creates additional risks, even if the individual attacks rely mostly on familiar techniques.
I actually expect AI to make software considerably more secure in the long run. Automated code reviews, testing and vulnerability discovery should help eliminate many common programming mistakes. But organizations have an enormous backlog of existing software to secure, while attackers can apply more capable models and tools to that software almost immediately.
That’s why I expect the near future to be particularly difficult.
The limiting factors for offensive operations are shifting. Human expertise and working hours still matter, but compute, infrastructure, available tools and the defenses encountered are becoming increasingly important.
And unlike the speculative AI attack scenarios we’ve discussed for years, the operational capability behind this development is already here.
The question is no longer whether AI agents can contribute to real intrusions. We have evidence that they can carry out substantial parts of them. What we don’t yet know is how quickly attackers will turn that capability into much larger, continuously operating campaigns.
Sources and further reading
Reports behind the campaign examples
- Gambit Security: Autonomous AI agents attacking online retailers — September 22, 2026. Investigation of a financially motivated campaign using Cairn, Strix and Hermes, reconstructed from recovered attacker infrastructure, agent records and evidence of compromise.
- CrowdStrike: Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance — October 7, 2026. Analysis of a campaign against financial organizations, including recovered ARTEX configurations, prompts and Claude Code session histories.
- Microsoft: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise — October 21, 2026. Storm-0940’s use of ARTEX, including the ConnectWise-related activity and multiple intrusions reaching privileged cloud access in less than three hours.
- CrowdStrike: VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign — October 29, 2026. A separate operation targeting more than 200 organizations, with confirmed post-exploitation activity at nine.
Broader context and analysis
- Google Threat Intelligence Group and Mandiant: ARTEX and Friends: Enter Agentic Offensive Frameworks — October 30, 2026. Observations of ARTEX, Cairn and Hexstrike during incident-response investigations, and analysis of the shift toward automated, adaptive intrusions.
- CrowdStrike: CrowdStrike Uncovers New Agentic AI Campaigns — October 21, 2026. Four additional actors using different agent configurations to make operational decisions and execute attacks, illustrating that this development extends beyond ARTEX and Cairn.
- Huntress: AI, Scripts, Operator: Inside the ConnectWise Attack — Analysis of rapid tooling changes, retry behavior and the limits of identifying AI involvement from victim-side telemetry alone.
Framework documentation
- Cairn on GitHub — Project documentation for the general-purpose AI state-space search engine, initially validated through autonomous penetration testing.
- ARTEX Global Edition on GitHub — A public fork of ARTEX with architecture documentation and defensive guidance.
