how it happened
- whostate-backed groupsplit the task into harmless steps
- the gapAI coding assistantdid 80 to 90% of the work
- the result~30 targetsfirst mostly automated campaign
what everyone assumed
The mental model of AI in attacks is a force multiplier: it writes the phishing email, suggests the code, speeds the human up. The assumption is that a person still runs the operation, with AI as the helpful tool in their hands.
what happened
By decomposing the attack and disguising its purpose across multiple agent instances, the group got the assistant to carry out the large majority of the campaign’s tactical work itself, with humans intervening only at a few decision points. The tool was not assisting an operator; it was largely running the operation.
step by step
- the attack is split into small, harmless-looking tasksIts purpose is disguised across multiple agent instances.
- the assistant carries out the tactical workHumans step in only at a few decision points.the assumption breaks here
- around thirty targets are workedAn estimated 80 to 90 percent of the tactical work is automated.
- November 2025the assistant's maker discloses the campaignDescribed as the first documented large-scale attack run mostly without human hands.
how it surfaced
In November 2025 the assistant’s maker disclosed the campaign, assessing that the AI had automated an estimated 80 to 90 percent of the tactical work against around thirty targets. It was described as the first documented large-scale cyberattack executed mostly without human hands.
An agent capable enough to do real work for you is capable enough to do real work for an attacker who can frame the task.
Autonomy is the capability and the risk in one, and it does not require a human at the keyboard.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersSomeone breaks a harmful job into small, innocent-looking requests the agent happily completes.what it costs youThe agent does most of the work of an attack using your own access, quickly and politely.
- or it goes like thisit happenedEchoLeak / Microsoft 365 Copilot, 2025howAn email with hidden instructions reaches an assistant that reads every inbox.what leavesanything the assistant can seewho ends up with itthe stranger who sent the email
- or it goes like thisit happenedMCP tool poisoning, 2025howA tool description tells the agent to send files somewhere else.what leavesfiles the agent can openwho ends up with itwhoever wrote the tool
sources
your turn
what you can do about it
this week
Write down what each of your AI agents may do on its own, and where that permission ends.
As your teams give agents more autonomy and more access to act, the same autonomy is what an attacker would exploit by framing malicious work as legitimate. This campaign is the early proof. What your agents are permitted to do on their own, and how that is bounded, is the question it raises.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →