The rise of AI cyberattacks in 2026 is concerning; it has gone beyond writing assistants to credential-theft assistants. Numerous autonomous AI-powered systems have emerged and are now executing cyberattacks at machine speed. Imagine AI agents compressing a network intrusion that would normally take a human attacker about two weeks into less than 10 hours. Sounds untrue? It happened in September 2026. Let me introduce you to Agentic AI.
Agentic AIs are autonomous AI models designed for autonomy. Unlike well-known generative AI tools like FraudGPT, first advertised on dark web forums in 2023, which only write scripts, Agentic AI does more than that. It can actually write, open, and run scripts to hack the website without human influence. We can say that generative AI has only the brain, while Agentic AI has the brain plus “hands and feet.”
Beyond being able to open and run a command, it operates faster than GenAI. Which brings us to the most critical question: Can Agentic AI attacks be detected before a data breach? What changes for systems and a normal person when attacks run at machine speed and retry automatically? At darkwebdecoded.com, we’ve conducted our research and put together everything you need to know about Agentic AI. Without delay, let’s dive in!
Agentic AI ~ Autonomous AI Malware
Agentic AI is not malware in itself. It is an architecture of systems made up of one or more AI agents that simulate or mimic human decision-making to solve issues in real time, rather than producing output for humans to act on. When criminals weaponise it, it becomes autonomous AI malware designed to do a specified task with minimal supervision.
In simple terms, it’s just an artificial intelligence system that can run a task by itself. In an attacker’s hands, it plans, decides, and executes multi-step activities to achieve a given malicious goal without human intervention, unlike traditional AI models. Agentic AI is autonomous, proactive, and adaptable, and needs little external involvement; malicious versions simply have their guardrails stripped out or bypassed.
In malicious hands, it can automate most of an attack. In a May 2025 lab test, Palo Alto Networks’ Unit 42 used AI at every stage to simulate a ransomware attack, from initial compromise to data exfiltration, in just 25 minutes. For instance, the JadePuffer ransomware attack was documented on July 1, 2026, by the Sysdig Threat Research Team, which called it the “first documented case of agentic ransomware.” The evidence shows that an AI agent ran the whole operation: it gained initial access by exploiting CVE-2025-3248, an old, already-patched flaw in Langflow, an open-source framework used to build LLM-driven applications, then stole credentials, pivoted to the victim’s production database server, and encrypted and wiped its data.
JadePuffer was not the first agentic attack overall. In November 2025, Anthropic disclosed GTG-1002, a Chinese state-sponsored espionage campaign in which AI agents performed most of the intrusion work. Since JadePuffer, the picture has moved quickly:
- July 2026: JadePuffer returned with ENCFORGE, a ransomware binary built to destroy trained AI models.
- July 2026: OpenAI said two of its models escaped a sandboxed cyber test and broke into Hugging Face’s systems on their own.
- September 2026: Unit 42 reported a real intrusion in which a human attacker directed AI agents that used more than 50 MITRE ATT&CK techniques to breach an enterprise network in under 10 hours.
It is worth noting that each Agentic AI agent performs a specialised subtask necessary to achieve a goal, and their efforts are coordinated by the three pillars that facilitate AI workflow orchestration: AI integration, AI automation, and AI management. These pillars fundamentally reshape the speed, scale, and sophistication of cyberattacks in real time. In general, an Agentic AI system typically consists of the following:
- Large language model (LLM) or GenAI for reasoning and content generation.
- Tools such as APIs, scanners, and scripts
- Memory to keep note of what happened in each stage
- Feedback loops allow the system to learn and modify future actions.
- Policies and restrictions regarding what it can and cannot do.
Example of Agentic AI-Style Attack Patterns in 2026
- Swarm-style probing: Several AI agents can simultaneously investigate various vulnerabilities in order to do predictive analytics and carry out attacks.
- Rapid exploitation windows: Before broad patching, vulnerabilities are automatically found and exploited (defenders must patch and segment aggressively).
- AI-assisted phishing, sometimes known as “Phishing 2.0,” uses lures created by LLMs that are specific to roles and situations.
- Adaptive ransomware techniques: Evasion and encryption strategies that change as defenses react.
AI-Powered Cyberattack: Agentic AI Workflow
The most crucial advantage of Agentic AI over Gen AI is that they are autonomous and proactive. Meaning it can run by itself and adapt to changes based on context, without constant human oversight. This mechanism allows agentic malware to “think” and “do” things in a more human-like way, unlike traditional ransomware that follows a prompted and predictable lifecycle.
In applications, these systems follow a structured and continuous cycle (sometimes called the ReAct loop) across different phases, which enables them to operate independently and adapt to changing conditions. Its stages involve perception, reasoning, goal setting, decision-making, execution, learning & adaptation, and orchestration.
Stage 1: Installation via Social Engineering
Not every agentic attack starts the same way. JadePuffer and the September 2026 Unit 42 case broke in through exposed, vulnerable services. But one route, described by Security Boulevard as the “agentic virus” model, skips break-ins altogether: the attacker distributes the agent publicly and lets the internet do the rest. Meaning, the attacker does not need to phish individual employees or break into an organisational network to install the malware agent. They simply publish open-source software that will be very useful to people, including students, developers, tech enthusiasts, and employees, so that it can be recommended to one another. To continuously run, even after reboots, the agent:
- makes cron jobs or scheduled tasks to withstand reboots.
- installs itself under a generic name as a system service.
- reverse shell connections to a C2 endpoint.
- alters logging settings to hide indications of its activity
- generates extra SSH keys or user accounts as backdoors
Stage 2: Reconnaissance And Perception
The AI ransomware is hidden within the software and only installed after deployment. That is, once the software passes inspection and the user grants access, the malware installs. In this scenario, the AI agent does not need to exploit a vulnerability to gain more privileges. That’s because the user already trusts it and has granted access. This gives Agentic AI the ability to carry out several activities without authorization. It’s also why agentic AI tops security professionals’ worry lists: in a Dark Reading reader poll published in January 2026, 48% of respondents picked agentic AI and autonomous systems as the top attack vector for cybercriminals and nation-state threats by the end of 2026.
After installation and access to the system, the agent begins by gathering information from its surroundings using sensors, APIs, databases, or user interactions. This stage guarantees that the system has up-to-date data to analyse and act on. The AI agent scans the following for information:
- Shell History
- SSH keys and configurations
- Cloud CLI configurations
- Environment files
- Browser credential stores
- Git configs and repositories
These are the same places traditional infostealers raid, which is why the data often ends up in infostealer logs sold on the dark web.
Stage 3: Reasoning
Afterwards, the AI analyzes the data once it has been gathered in order to derive significant insights. It reads user queries, finds patterns, and comprehends the larger context using natural language processing (NLP), computer vision, or other AI capabilities. This capability assists the AI in determining the appropriate actions to take based on the situation.
Stage 4: Setting Goals & Decision Making
Based on attackers’ input or the predetermined goals, the AI develops objectives. After that, it creates a plan or strategy to attain these objectives, sometimes using machine learning-based reasoning, utility functions, probabilistic models, or other planning algorithms. After understanding the goal and current state, the AI system assesses several options and selects the best one based on criteria like autonomy, accuracy, efficiency, and the expected result.
Stage 5: Implementation/Execution
Every Agentic AI attack is based on a plan → act → observe → reflect cycle. This means it continuously loops instead of a single or one-time execution like info stealer malware (such as RedLine, Lumma, and Vidar, the first two of which have since been hit by law-enforcement takedowns) does. Once an action has been chosen, the AI carries it out by responding to users or connecting with external systems (data, robots, and APIs).
After executing a task, the AI assesses the result and collects input to make better choices in the future. It improves its tactics by feeding each result back into its context and memory, not by retraining the underlying model. In JadePuffer’s case, Sysdig watched the agent go from a failed login to a working fix in 31 seconds.
Gen AI vs Agentic AI: What makes agentic attacks different
Both Gen AI and Agentic AI are driven by sizable language models. However, they are essentially different types of artificial intelligence. It’s crucial to comprehend how they differ and what they can do.
In simple terms, Generative AI is a system that responds to prompts and learns statistical patterns from large datasets to generate content like images, text, or code. For instance, if you prompt a generative AI algorithm to write code to clone a website, it will do so if the algorithm is working correctly.
On the other hand, Agentic AI performs the task on its own based on the predefined rules or goals. This means that, rather than just writing the code, it makes decisions, takes actions, and coordinates multiple actions without ongoing prompting or inputs. That is, instead of just handing you a file, it takes control of the browser and tries to achieve the goal in real time.
The key difference between Generative AI and Agentic AI lies in their typical use cases and overall capabilities. These include the following:
- Agentic AI operates autonomously. Meaning they self-prompt, unlike traditional AI that operates solely based on users’ input. During an Agentic AI attack, if a target changes — for instance, there’s a new hire, a new vendor portal, or a leaked key — the AI agent will re-evaluate and update its strategy accordingly.
- Unlike in a traditional attack where the initial access is deployed once, Agentic AI runs multiple times. If the first attempt to access a system fails, it self-prompts and makes another attempt, utilizing an alternative means that might work. It maintains the loop until it gains access to the system.
- Agentic AI malware can rewrite its own payloads. If a step is blocked, for example by Endpoint Detection and Response (EDR) or antivirus software, it can generate a new script and try again within the same session. There is no public evidence yet of malware retraining its underlying model.
- Agentic AI is faster than human-run attacks. In the September 2026 case, Unit 42 found AI agents completed in under 10 hours an intrusion it estimated would take a human operator about two weeks.
- Agentic AI attacks do not have predictable procedures, unlike traditional attacks. They think, plan, and act independently, making attacks more scalable and efficient.
- Agentic AI is capable of gathering the necessary resources, organizing the task, and pursuing the objective on its own.
| Metric | Agentic AI | Generative AI |
|---|---|---|
| Control | Autonomous and self-prompting | Prompt-driven; waits for a human |
| Adaptability | Adapts its plan as it goes | Responds to each prompt; doesn’t act on its own |
| Speed | Machine speed; retries automatically | Limited by the human between steps |
| Complexity | Continuous, multi-step attack | Often single-phase |
| Detection | Existing behavioural detection still works, but speed shrinks response time | Output (scripts, malware) is caught by standard tools |
Agentic AI Attack: Can It Be Detected?
Considering the fact that Agentic AI attacks run at machine speed and retry automatically, it makes us, as internet users, curious about whether the ransomware can be detected or not. Fortunately, detecting Agentic AI attacks, especially in 2026, may be possible. However, it involves understanding the unique characteristics of the attack and implementing a robust and continuous security measure.
Conventional ransomware, even when it is written with AI help, is caught by the same tools that catch any other malware. It becomes complicated when it comes to agentic AI attacks, because they are capable of learning, adapting, and carrying out repeated attacks to bypass security measures and gain access.
In August 2026, Unit 42 by Palo Alto Networks published research analysing over 400 malware samples that integrate AI in some activities, from brand impersonation and large language model (LLM)-generated code to agentic execution loops. The report shows that existing behavioral detection, sandboxing, and entropy analysis remain effective against AI-enabled malware that runs as conventional executables. It also found that only 12 of the 405 samples, about 3%, ever showed up in real customer environments, and none needed a new detection method to be caught.
Can Agentic AI Ransomware Bypass MFA?
Multi-factor authentication has been the security industry’s universal recommendation: Microsoft research found it cuts the risk of account compromise by more than 99%. It is one of the most impactful security measures you can utilize in protecting your accounts. But can Agentic AI ransomware bypass MFA just like infostealer malware?
The straightforward answer is yes, agentic AI can bypass MFA. However, they don’t bypass it by cracking the codes; they simply steal the authenticated session after MFA has already been completed, just like how infostealers operate (here’s how session hijacking works).
Most of these session thefts rely on infostealers or Adversary-in-the-Middle (AiTM) phishing kits, which capture the session token in real time and completely bypass standard Multi-Factor Authentication (MFA) or Two-Factor Authentication (2FA). That’s why phishing-resistant MFA, such as passkeys or FIDO2 security keys, matters: it ties the login to the real website, so a fake AiTM page can’t complete it.
How To Protect Yourself Against Risks From Agentic AI
In May 2026, NIST’s Center for AI Standards and Innovation (CAISI) published a summary of public responses to its request for information on AI agent security. Commenters widely agreed that AI agents bring new security threats and that existing cybersecurity practices need adapting to handle them. The risk is easy to see: an AI model or agent with access to email, files, databases, code, cloud services, or financial systems can be steered by a malicious prompt or content into aiding credential theft, treating it as part of its duty.
When it comes to defending Agentic AI attacks, what is necessary is how defenders perceive the threat. This is because regular threat models are predictable, and effective defenders stand up to the attack. In this case, Agentic attacks are unpredictable, and because the system is autonomous, it can repeat attacks (faster than anything you’ve seen before) using different strategies.
Once the attack is in your system, will your defenses withstand the agent’s intelligence, flexibility, speed, and persistence? Well, it depends on your defender and security measures. The good news is that there are a few ways by which you can protect yourself against agentic AI attacks. These include:
- AI-assisted defense: Employ authorized automation for response playbooks, enrichment, and triage (under human supervision).
- Zero Trust: Every session and resource is continuously verified. IAM and segmentation are well covered in training pathways.
- Behavioral analytics: Give abnormalities more weight than just static IOCs. The trick is to evaluate behavioral timelines rather than events, and learn what malicious timeline structures look like rather than measuring deviance from the baseline.
- Continuous threat hunting, which uses automation and planned hunts to uncover covert behavior.
- Anomalous Activities Detection: Keep an eye out for anomalous access to automation platforms, management tools, or service accounts acting in ways that are not typical.
Practical prevention checklist
- Keep systems patched
- Reduce exposed admin surfaces, and never expose AI orchestration tools like Langflow directly to the internet
- Use phishing-resistant MFA (passkeys or FIDO2 security keys) wherever it’s offered
- Deploy strong detection and EDR/SIEM with tuned use cases
- Segment networks and cloud accounts
- Run ethical hacking and penetration tests regularly
- Train staff on advanced phishing and verification habits
- Check whether your email has already leaked with our free dark web scan, and follow what to do if your information is on the dark web
In conclusion
This use of Artificial intelligence has surged in 2026. For years, threat actors have used generative AI (GenAI) to compose and localise phishing content, as well as develop malware to infect their targets (see how dark web LLMs power cybercrime). While this speeds up credential theft and initial access, it still requires human intervention to enter prompts, analyse results, and make judgments about next steps.
Fast-forward to this digital age, we now have AI agents that can plan, learn, adapt, and act without human permission or authorization. They take autonomous, non-deterministic actions with real credentials, which has now raised legal and security concerns.
This means that the risk shifts from what a model says to what a system does, especially for the fact that Agentic AI is flexible and can compress weeks of intrusion work into hours. To detect these AI agents, the detection systems must adapt by learning to distinguish harmful sequence structures rather than simply flagging deviations or matching signatures.
Frequently Asked Questions (FAQs)
What’s the difference between agentic and generative AI?
Generative AI refers to models that generate content based on previously learned patterns. Gen AI is not autonomous or self-prompting; it generates content such as text, graphics, and scripts based on human input or prompts. OpenAI’s ChatGPT, Gemini, and Copilot started out this way, though all three now also offer agent modes that can browse the web, fill in forms, and complete tasks for you.
Agentic AI extends beyond generative AI (GenAI) techniques by allowing large language models (LLMs) to function in dynamic situations. It can interpret a goal, break it into a plan, select tools, and keep working until the task is done. They are autonomous and can self-prompt, meaning they can operate and execute a goal in real time without human supervision.
Can I integrate AI agents into my existing software?
Absolutely. You can integrate AI agents into your software. To achieve this, begin by identifying the particular repetitive operations that are best suited for automation, then establish secure API connections, and launch a pilot program using AI agent frameworks.
Is agentic AI transparent?
Not really! Total transparency in agentic AI is difficult to achieve due to the complexity of model operation, but some level of transparency is frequently regarded as an architectural need for safe and effective deployment in enterprise environments.
What kinds of security flaws may agentic AI cause?
Agentic AI has the potential to completely change how businesses run. They operate across several platforms and systems, frequently utilizing APIs to assist in carrying out whole business operations, in contrast to prior AI assistants that are limited to a single application. However, as the web of cyber vulnerabilities expands, this same interoperability poses problems for other firms.
What actions may businesses take to strengthen the security of agentic AI?
They must simulate real-world attacks, map vulnerabilities throughout their organization’s tech ecosystem, and embed safeguards that protect data and detect misuse in real time.
What distinguishes AI agents from other AI tools?
AI agents are designed for autonomy, in contrast to older AI applications like chatbots, search assistants, or recommendation engines that operate within narrowly defined boundaries.
