Everyone's still arguing about whether AI agents belong in security. Attackers already decided.
Since early September, Google, Anthropic, Palo Alto Networks, CrowdStrike, Microsoft and an independent researcher have each published an investigation of AI agents running real intrusions. These weren't demos. They were attacks on real companies, reconstructed from logs. The clearest example is the newest one.
- Sign-in rate
- 2,900/min
- Across 2,250+ Microsoft 365 tenants
- To admin
- < 3 h
- From first targeting, per Microsoft
- To DC creds
- 20 min
- Lateral movement, per CrowdStrike
- Per break-in
- $50
- In AI tokens, per NorForge
Storm-0940: agents that never clock out
On October 21, Microsoft published its findings on Storm-0940, a group it calls China state-aligned. In the ConnectWise supply chain compromise, the group used ARTEX, an open-source framework of AI agents that runs an attack from reconnaissance to data theft with little human input.
The speed of the activity allows very little time for Defenders to respond to those alerts.
It isn't one case
Storm-0940 is the latest of seven. Here they are in date order, each with the number that matters most from it.
Early Sep · Palo Alto Unit 42
Agents ran a full ransomware intrusion in under ten hours.
They chained more than 50 known techniques from a public web service to the company's cloud access keys. An agent also wrote an 80-page report on the victim's weaknesses, delivered with the ransom note.
Way inPublic API, then tokens found in source code
< 10 h
Unit 42 puts the human equivalent at about two weeks
Sep 8 · Google GTIG
One prompt and a set of playbooks ran a credential-theft campaign.
Agents scanned for weaknesses, harvested credentials, fixed their own broken scripts, and routed traffic through the victim's own cloud so it looked legitimate.
Way inA cloud account the actor had already compromised
< 6 h
from instructions to thousands of stolen credentials
Sep 10 · Anthropic
Suspected ShinyHunters affiliates let agents do nearly all the work.
They breached a software provider and took data belonging to about 200 of its customers, pulling 2,100+ Azure AD token sets across 40+ tenants in about 34 hours. A separate Russian-linked actor had agents rebuild its malware each time a security tool caught it.
Way inA stolen developer token, in one case
~3 h
from one stolen token to full cloud admin
Oct 7 · CrowdStrike
An open-source pentest framework was turned on South Korean banks.
ARTEX was published on GitHub on July 26. By late September it was being used against banks. CrowdStrike found the operator's Claude Code session logs on an exposed server. Shinhan Bank says about 25,000 customers were affected.
Way inNot confirmed; one service was a loan inquiry portal
2 months
from public release to bank intrusions
Oct 19 · NorForge, via Reuters
One operator's agents broke into more than 100 companies.
Researcher Snorre Fagerland found exposed control panels for Cairn, another open-source agent platform. The agents had gone after 1,200+ sites, mostly online shops, on about $5,000 in tokens.
Way inOrdinary bugs in web shops, then an uploaded web shell
$50
per successful break-in
Oct 21 · Microsoft
A China state-aligned actor ran ARTEX against 2,250+ Microsoft 365 tenants.
Storm-0940 used stolen identities for several ConnectWise cloud apps, signing in at about 2,900 attempts a minute. Most failed. Where they got in, one app assigned itself Global Administrator.
Way inStolen ConnectWise application identities
< 3 h
from first targeting to privileged access, in multiple cases
Oct 22 · CrowdStrike
Four separate actors ran agentic campaigns, and the count is climbing.
One agent moved laterally and harvested domain controller credentials with no further human direction. All four actors got past commercial AI safety controls. CrowdStrike says the real limit on scale is token budget.
Way inVaries; one supervisor agent handed tasks to a second
~20 min
to domain controller credentials
How fast it moves
Five of the reports give a time from a starting point to a goal. On one scale, the gap with human work is hard to miss.
CrowdStrike
Lateral movement to domain controller credentials
Microsoft
First targeting to privileged access
Anthropic
Stolen developer token to full cloud admin
Google GTIG
One prompt to thousands of stolen credentials
Unit 42
Public web service to cloud access keys
Unit 42 estimate
The same intrusion, run by a human team
What changed, and what didn't
Look at the way in each time: a stolen app identity, tokens hard-coded in a repository, a stolen developer token, a cloud account that was already compromised, web shops with ordinary bugs. No zero-days. The techniques are old. Three things around them are new.
01
Speed
Two weeks of human work now takes an afternoon. The gap between first access and real damage, which defenders used to count on, is now measured in hours.
02
Cost
At $50 a break-in, the economics flip. Anthropic's report says it plainly: when an attack costs little effort, less obvious companies become worth hitting.
03
Stamina
Agents don't get tired, take weekends, or wait for a shift change. CrowdStrike says the real limit on scaling these campaigns is token budget, not skill.
The sceptics have a point
The case against AI agents in security is fair. Agents can be wrong. They need clear limits on what they're allowed to touch. And a human should confirm what's real before anyone acts on it.
We agree with all of that. We built our own agents around it: nothing is reported until it's reproduced, every action stays inside an enforced scope, and approval gates sit in front of anything sensitive. But those are reasons to build security agents properly. They aren't reasons to wait.
If your defence checks once a quarter and theirs checks every minute, you've lost on timing alone.
An attacker's agent doesn't wait for your quarterly review. It probes your exposed apps, your cloud identities and your third-party integrations every minute. Storm-0940 didn't come in through a server. It came in through an integration customers had already approved. A point-in-time test, or a review once a quarter, sees none of that.
What to do about it
Nothing on this list is exotic. It's the basics, done at the speed these attacks now move.
- 01
Inventory machine identities
App registrations, service principals, OAuth grants, CI tokens, API keys. Three of these cases began with a credential that belonged to software, not a person. Know which ones can reach production, cut their permissions, and alert when one gains a role.
- 02
Review third-party integrations
Every app you've consented to is a door someone else holds a key to. Check what each one can do in your tenant, and whether it still needs to.
- 03
Get secrets out of code
Unit 42's attacker found tokens in source repositories and used them to reach the secrets manager. Scanning every push for secrets costs far less than that did.
- 04
Automate the first response
When privileged access can come three hours after first contact, a ticket that waits for Monday is too late. Have playbooks that revoke tokens, kill sessions and isolate cloud resources without a meeting first.
- 05
Test continuously, from the outside
Find what's reachable before an attacker's agent does, and re-test after every fix. If they check every minute, a quarterly cadence describes a company that no longer exists.
What isn't settled
Handle the exact numbers with care. Several are estimates, and some reach us only through press coverage.
- Microsoft's post calls the 2,900-a-minute figure attempts in one place and failures in another.
- The $50 Cairn figure counts only successful break-ins. NorForge's own report, which counts failed attempts too, gets closer to $5 per task.
- "Autonomous" covers a range. In most cases a person picked the target, wrote the playbook, and stepped in when the agents got stuck.
None of that changes the conclusion. The agents do the labor, and they do it around the clock. The question for defenders is no longer whether to use agents. It's whether yours are built well enough to keep up.