Why AI-Driven Attack Exploitation Changes Everything Defenders Thought They Knew

I’ve read a lot of attack write-ups over the years.

A playbook, executed step by step.

But that 'exploitation’ world is changing slowly.

And I think it’s worth sitting with, because it shows something that’s been more theory than reality until now: what happens when the attacker isn’t the one doing the work anymore.

(This is based on a intrusion attack observed and published as part of sysdig report).

The attacker found a publicly exposed Python notebook, uses a CVE to gain shell access to the server. Nothing unusual so far. This is a routine finding, the kind of thing scanners pick up every day.

Here’s where it gets interesting. Instead of manually poking around the environment, the attacker handed control to an AI agent. From that point on, the agent explored on its own. It read files, enumerated running services, and searched for credentials. It found cloud credentials sitting on the host.

The agent used those credentials to access AWS Secrets Manager and pulled out an SSH private key. To avoid tripping rate limits, it spread 12 API requests across 11 different IP addresses within 22 seconds. Nobody told it to do this. It worked that out on its own.

With the SSH key in hand, the agent authenticated to a downstream gateway server, opened multiple parallel SSH sessions, and discovered an internal PostgreSQL database it had no prior knowledge of. It didn’t know the schema. It didn’t know the table names. It didn’t know the structure.

It figured all of that out in real time, and dumped the entire database in under two minutes!

I want to be careful not to overstate this. The initial access vector here was nothing new, an exposed notebook is a known, common finding. What changed is everything that happened after.

A scripted attacker needs to know what they’re looking for before they look. An agent figures it out as it goes.

This is the core shift, and I think it’s the most important one happening in offensive security right now. A traditional script, even a sophisticated one, is built around assumptions. It expects certain file paths, certain service names, certain credential formats. If the environment doesn’t match those assumptions, the script fails or stalls.

An AI agent doesn’t need those assumptions. It looks at what’s actually in front of it, reasons about what it might be useful for, and decides what to do next. Scripted versus adaptive isn’t a small technical detail. It’s a different category of attacker behavior.

The agent inferred a constraint it was never told about, and adjusted on its own.

The part that stuck with me most is the 12 requests across 11 IPs in 22 seconds. Nobody programmed “avoid rate limits” into this. The agent encountered a constraint, or anticipated one, and changed its own behavior to work around it.

This matters because so much of detection has historically relied on patterns. Too many requests from a single source. Repeated failed logins. A recognizable sequence of reconnaissance steps. These patterns work because human attackers, and scripted tools, tend to repeat themselves. An adaptive agent can vary its approach while still pursuing the same goal, which means the patterns we’ve trained our defenses to catch may simply not appear.

This is a cost problem as much as a capability problem.

Historically, attacking a new target meant building a new playbook. Every environment is different, so every attack required time, effort, and some level of expertise specific to that target. That cost was a natural limiting factor. It’s part of why not every exposed system gets fully exploited the moment it’s found.

An AI agent removes that cost. It doesn’t need a pre-written playbook because it can build the attack path on the fly, specific to whatever environment it lands in. What used to require significant manual effort becomes faster, cheaper, and dramatically easier to scale.

And the human’s role changes with it. In this intrusion, the attacker wasn’t executing each step. They were supervising. Watching what the agent found, reading what it was learning about the environment, occasionally nudging it forward. That’s a fundamentally different skill profile than the one needed to manually enumerate a target and write exploit code by hand.

Two attacks against two different targets can now look completely different, even with the same agent and the same goal.

This is the part that should worry defenders most. Traditional exploits leave behind recognizable fingerprints, the same commands, the same order of operations, the same tells, because the underlying playbook doesn’t change much between targets.

An AI agent, working things out as it goes, will naturally take different paths through different environments. The PostgreSQL database in this case was unknown to the agent at the start. In a different environment, it might have found a different kind of datastore and taken a completely different route to the same outcome: data exfiltration.

If detection depends on recognizing a known sequence of actions, and the sequence is different every time, that detection approach starts to lose its footing.

I don’t think the lesson here is to panic about AI agents specifically. The initial access vector in this case, an exposed notebook, is something good asset management and exposure scanning would catch regardless of what comes after. That part of the story is old news. Misconfigured assets, exposed dev tools, forgotten endpoints, these have been on every hardening checklist for years, and they remain the most common way attackers get a foot in the door. Nothing about AI changes that. If anything, it raises the stakes on getting the basics right, because the cost of missing them just went up.

But the part that comes after is where I think defenders need to recalibrate. If an attacker can get an agent to autonomously explore, adapt, and exfiltrate from an environment it has zero prior knowledge of, in under two minutes, then a few assumptions that have quietly shaped detection and response strategy for years no longer hold.

The first assumption is time. Security teams have long built their response models around the idea that attackers need time, dwell time to explore, time to figure out what’s valuable, time to move laterally without tripping alarms. Mean time to detect and mean time to respond have been measured against that backdrop. An agent that can go from shell access to a full database dump of an unfamiliar system in under two minutes compresses that window to almost nothing. If your detection pipeline has any meaningful lag, an autonomous agent may have already finished before a human analyst even sees the first alert.

The second assumption is familiarity. We’ve generally assumed that real damage requires an attacker who understands the target, its tech stack, its data layout, its weak points. That assumption underpins a lot of “low and slow” detection thinking, the idea that sophisticated attacks require a learning curve, and that learning curve gives defenders a chance to notice something is wrong before the worst happens. An agent that can reverse-engineer an unknown database schema and exfiltrate it on the fly removes that learning curve entirely. Familiarity with the target is no longer a prerequisite for doing serious damage to it.

The third, and probably the hardest one, is repeatability. Detection built around known sequences and recognizable patterns assumes that attacks against similar targets will look broadly similar, similar commands, similar order of operations, similar artifacts left behind. That’s been true because human attackers and scripted tools tend to reuse what works. An adaptive agent breaks that assumption. Two intrusions with the same goal, against two different environments, can take completely different paths and leave behind completely different traces. Signature-based and sequence-based detection starts to lose its footing when the thing it’s trying to recognize doesn’t repeat itself.

None of this means detection becomes impossible. It means the center of gravity needs to shift, from recognizing what an attack looks like to recognizing what it does. An agent that’s enumerating credentials, accessing secrets managers, opening unusual numbers of parallel sessions, and pulling large volumes of data from a database it has never touched before is doing things that are anomalous regardless of the specific sequence. Behavioral and outcome-based detection, watching for the effect rather than the exact method, becomes more important than it’s ever been.

This is a much harder problem than catching a known signature, and it’s one the industry is going to be working through for a while. But it’s also not a problem we’re starting from zero on. Anomaly detection, least privilege, and tight monitoring of sensitive systems like secrets managers and databases have always mattered. What’s changed is the urgency. The gap between “we have good hygiene” and “we have good hygiene that responds fast enough to keep up with something that doesn’t need time or familiarity” just got a lot more important to close.