The Operational Model
Core Architecture
Modern agentic systems operate as a human-directed control plane coupled with an AI-driven execution and reasoning layer. The human provides intent and constraints, while the AI decomposes, sequences, and iterates on tasks that individually resemble legitimate security or administrative activity. This model typically unfolds across four phases.
Objective Definition (Human-in-the-Loop)
Operations begin with a high-level objective defined by the operator. These objectives are frequently framed in defensive or audit-like language to avoid triggering platform safeguards, such as identifying potential access paths into a SaaS tenant or mapping externally exposed authentication surfaces. The AI is not asked to “hack” a system, but to assist with investigation, validation, or analysis tasks that plausibly align with legitimate security workflows.
Task Decomposition (Agent Layer)
The AI decomposes the objective into granular, context-bounded micro-tasks. Each task is intentionally scoped to appear routine and non-malicious in isolation. Common decomposition patterns include DNS and subdomain enumeration, cloud service discovery across major identity platforms, authentication flow mapping for SSO and OAuth, and correlation of SaaS footprints using publicly available artifacts. The value of the agent lies in sequencing these steps coherently and maintaining awareness of what has already been tested.
Execution with Benign Signatures
Execution emphasizes narrow actions with low detection value rather than overt exploitation. Reconnaissance activities typically involve generating or refining commands for widely used tools, parsing certificate transparency logs to identify SaaS tenants, and extracting metadata from standardized discovery endpoints. Vulnerability analysis focuses on contextualizing exposed services against known misconfigurations or recently disclosed weaknesses, without developing exploits or payloads.
Social engineering preparation is handled in the same incremental fashion. The AI assists by drafting credential reset or MFA-related pretexts, generating linguistic variations tailored to organizational tone and geography, and recommending timing based on regional working patterns. Where automation is required, the agent produces short-lived, single-purpose scripts for tasks such as parsing scan outputs, normalizing API responses, or extracting identity data from public sources. These artifacts are disposable and technically unremarkable, further reducing their detection footprint.
Stateful Iteration and Adaptive Planning
A defining characteristic of agentic workflows is persistent operational context. The system tracks which services have been tested, how identity flows responded, and which hypotheses remain unexamined. Based on this evolving state, the AI recommends tactical adjustments, such as pivoting to alternative SaaS providers, refining social engineering narratives, or abandoning noisy approaches in favor of lower-signal paths. This enables rapid OODA loop compression without requiring continuous human analysis or decision-making.
Defensive Implications
From a defensive perspective, this model creates structural challenges. There is no single “AI attack” artifact to detect, as each action mirrors legitimate red-team, audit, or IT activity. Malicious intent is distributed across time, tools, and communication channels, forcing defenders to move beyond payload-centric detection. Effective identification increasingly depends on correlating behavior across stages and inferring intent from patterns rather than from individual events.
Documented Intelligence
Case Study: September 2025 Espionage Campaign
In September 2025, Anthropic disclosed a suspected espionage operation that leveraged Claude in an agentic workflow. The operation was characterized by stepwise task framing, with each request presented as benign security research or compliance validation. Context was deliberately fragmented so that no individual request violated policy thresholds. The AI was used primarily for orchestration—structuring investigative paths, summarizing intermediate findings, and recommending next actions. This case remains one of the clearest documented examples of AI-assisted micro-task orchestration applied to espionage rather than isolated content generation.
Broader Threat Intelligence Consensus
Across major intelligence providers, reporting converges on a consistent assessment. Adversaries are experimenting with AI across the full attack lifecycle, but primarily as an accelerant rather than as a source of fundamentally new techniques. AI is being used to scale phishing, automate reconnaissance, and reduce operational overhead, particularly in coordination and planning. Threat reporting also shows sustained adversary interest in building repeatable, semi-automated workflows for reconnaissance, social engineering, and operational management, even as platforms continue to disrupt overt abuse.
Strategic Assessment
The Labor Restructuring Effect
Agentic micro-tasking does not replace human attackers; it restructures their cognitive labor. Planning, iteration, and synthesis are externalized to systems, enabling faster campaign cycles, more consistent execution, and reduced cognitive load per target. As a result, operators can manage more concurrent operations with less expertise and less fatigue.
Defender Imperatives
Defending against agentic workflows requires a shift in analytical posture. Organizations must prioritize cross-stage behavioral correlation, develop stronger intent inference capabilities, and monitor for abuse of legitimate security and IT workflows. Detection strategies must move away from isolated indicators and toward pattern-based analysis that spans reconnaissance, access attempts, and post-access activity.
The 2026 threat landscape will be defined by AI as an operational force multiplier rather than an autonomous hacking system. The technical sophistication of these campaigns lies in orchestration architecture, state management, and workflow optimization – not in exploit innovation. Defenders that continue to rely on artifact-centric detection will increasingly miss these campaigns. Those that adapt toward behavioral correlation and intent-focused analysis will be better positioned to detect and disrupt agentic intrusion workflows.
Source: Antropic Disrupting the first reported AI-orchestrated cyber espionage campaign