Artificial intelligence is changing cybersecurity on both sides of the battlefield. Security teams are using AI to detect vulnerabilities, investigate suspicious activity, analyze large volumes of data, and respond to incidents. At the same time, attackers are beginning to use increasingly capable AI systems to automate parts of their own operations.

That shift has become more significant as AI agents move beyond simple chat interfaces. Modern agents can reason through multi-step tasks, use external tools, execute code, inspect files, interact with computer systems, and continue working with less human intervention.

Anthropic’s latest threat intelligence findings highlight why this development deserves attention. The company says malicious actors are increasingly using AI across multiple stages of cyber operations, with some campaigns relying on AI to perform much more of the operational work while humans act primarily as supervisors.

The important question is therefore no longer simply whether hackers are using AI. The bigger question is how much of a cyberattack can an AI system perform without continuous human direction?

What Anthropic’s Latest Findings Tell Us

Anthropic has been tracking the use of AI in cyber operations for some time. Its research has shown a gradual shift from relatively simple uses of AI, such as generating code or phishing material, toward more complex activities that happen after an attacker has already gained access to a target.

The company’s latest disclosures add another layer to that trend. Anthropic says it has disrupted malicious activity involving actors based in Russia and China, including operations in which AI was used throughout multiple stages of cyber activity.

One reported campaign associated with Russian cyber activity used AI to assist with tasks including phishing and adapting malicious software. Other activity involving Chinese actors included large-scale attempts to exploit AI models and automate interactions with them.

The significance of these incidents is not that AI has suddenly invented cyberattacks. Cybercriminals have been automating attacks for decades. What is changing is the flexibility of the automation.

Traditional automation normally follows predefined instructions. An AI agent can potentially interpret new information, decide what to do next, use another tool, evaluate the result, and continue.

That makes the system much closer to an operational assistant than a conventional automation script.

From AI Assistant to AI Operator

The distinction between an AI assistant and an AI operator is essential for understanding the security implications.

An assistant might help a security researcher understand a vulnerability or write a piece of code. A human remains responsible for deciding what happens next.

An operator is different. It may be given an objective and a collection of tools, then perform a sequence of actions to reach that objective.

This is the same fundamental capability that makes AI agents attractive for legitimate businesses.

A developer can ask an agent to investigate a software problem, inspect a repository, modify files, run tests, and propose a solution. A security team can ask an agent to analyze alerts, investigate suspicious activity, and organize evidence.

The same architecture can become dangerous when the objective is malicious and the available tools provide access to real systems.

This is why the rapid development of AI agents is also creating a new cybersecurity challenge: the security of the agent itself becomes part of the security problem.

Why Autonomy Changes the Threat Landscape

Human attackers have obvious limitations. They need to read information, make decisions, type commands, switch between applications, analyze results, and decide what to do next.

An AI agent can potentially perform many of these activities much faster and in parallel.

That does not mean an AI agent can automatically compromise every system. Real-world environments are complicated, security controls vary, and models can make mistakes. But the economics of cyber operations can change when a large amount of repetitive cognitive work can be delegated to software.

This is particularly important for attacks that require many small decisions.

An attacker may need to interpret information from one system, decide what information is relevant, determine which tool should be used next, analyze the response, and then continue the investigation.

Agentic AI is designed precisely for this type of multi-step workflow.

Anthropic’s earlier research into AI-enabled cyber threats found that malicious actors were increasingly applying AI to later stages of attacks, rather than limiting its use to initial access or preparation. The company has also argued that the surrounding agentic infrastructure—the code, tools, and systems connecting an AI model to real-world actions—can be as important as the underlying model itself.

The Real Innovation Is the Scaffolding Around the Model

When people discuss AI-powered cyberattacks, they often focus on the model itself.

But a powerful language model does not automatically become an autonomous cyber operator.

It needs an environment that allows it to interact with tools, receive information, execute actions, maintain context, and respond to the results of previous actions.

This surrounding architecture is sometimes called agentic scaffolding.

In legitimate applications, scaffolding can include APIs, databases, software repositories, browsers, command-line tools, monitoring systems, and authentication layers.

In a malicious environment, the same concept can connect an AI system to offensive security tools and real infrastructure.

This is one of the most important lessons from the recent evolution of AI security research: the risk does not come from intelligence alone. It comes from intelligence combined with access and autonomy.

Why This Matters Beyond Cybercrime

The implications extend beyond traditional hacking.

As companies deploy AI agents to handle real business processes, those agents will increasingly receive access to sensitive information and internal systems.

An agent might eventually be able to read company documents, access customer records, modify code, send messages, interact with cloud infrastructure, or trigger business processes.

Every additional permission increases the potential impact of an error or compromise.

This creates a difficult balance for businesses. An agent with no permissions cannot accomplish much. An agent with unrestricted permissions may be extremely productive, but it also creates a much larger attack surface.

The solution is therefore unlikely to be simply “do not use AI agents.” Instead, organizations need to design agentic systems around strict boundaries.

AI Agents Need Security Boundaries

The security model for AI agents needs to be different from the security model used for ordinary chatbots.

A chatbot that answers a question generally has limited ability to affect the outside world. An agent that can execute commands, access applications, modify files, or communicate with external services is fundamentally different.

Organizations deploying these systems should therefore consider several layers of protection.

Least-Privilege Access

An AI agent should receive only the permissions required for its specific task. If an agent only needs to inspect a repository, it should not automatically have permission to modify production infrastructure.

Tool-Level Controls

Every external tool available to an agent represents a potential path to an unintended action. Organizations need to determine which tools an agent can access and under which circumstances.

Human Approval for High-Impact Actions

Not every action needs human approval. Requiring a person to approve every low-risk operation would eliminate much of the benefit of automation.

However, high-impact actions should have stronger controls. Examples include changing production infrastructure, transferring sensitive data, modifying security configurations, or performing irreversible operations.

Continuous Monitoring

Traditional application logs are not enough when an AI system is making decisions dynamically. Organizations need visibility into what an agent was asked to do, which tools it used, what information it received, and what actions it ultimately performed.

Isolation

Agents performing experimental or potentially risky operations should run inside environments that limit their ability to affect production systems.

Isolation becomes particularly important when testing advanced AI systems for cybersecurity capabilities.

The Connection Between AI Coding and Cybersecurity

The rapid development of AI coding agents makes this issue even more important.

Modern coding agents can inspect repositories, understand software architecture, modify files, execute tests, and work through complex engineering tasks.

That same ability can be valuable for defensive security research because AI can help developers identify weaknesses and understand potentially vulnerable code.

For developers interested in this rapidly changing area, our analysis of OpenAI Astra and agentic coding explores how advanced AI coding systems are moving toward longer, more autonomous software-development workflows.

Tools such as CodeRabbit also demonstrate the more defensive side of AI-assisted software development, where AI can help developers review code and identify potential issues before software reaches production.

The distinction between coding assistance and autonomous system operation will become increasingly important as these capabilities converge.

Could AI Make Cyberattacks Easier for Less Skilled Attackers?

This may be one of the most consequential effects.

Advanced cyberattacks have traditionally required specialized knowledge. An attacker needed to understand networking, operating systems, programming, authentication, cloud infrastructure, vulnerabilities, and many other technical areas.

AI cannot magically eliminate all of that complexity, but it can reduce the amount of expertise required for certain tasks.

A less experienced attacker may be able to use an AI system to understand unfamiliar technology, generate code, interpret technical output, or troubleshoot an obstacle.

At the same time, sophisticated attackers can use AI to increase the scale and speed of their operations.

This creates a potential two-sided effect: the barrier to entry can fall while highly capable attackers become more efficient.

But AI Does Not Make Every Hacker More Powerful

It is important not to exaggerate the situation.

AI agents still make mistakes. They can misunderstand instructions, produce incorrect assumptions, fail against unexpected environments, and become stuck on tasks that a skilled human would solve quickly.

Real-world cybersecurity also involves unpredictable infrastructure, defensive monitoring, authentication barriers, network segmentation, and human decision-making.

Therefore, the emergence of autonomous cyber capabilities should not be interpreted as evidence that AI can effortlessly compromise any organization.

The more realistic concern is that AI can improve the efficiency of attackers in specific parts of the attack lifecycle and allow a smaller number of humans to supervise a larger amount of activity.

The Defensive Opportunity

The same technological development can strengthen cybersecurity defenses.

Security teams can use AI agents to investigate alerts, correlate evidence, review source code, search documentation, identify vulnerabilities, analyze logs, and assist with incident response.

This creates an emerging race between offensive and defensive automation.

If attackers can use AI to analyze thousands of potential targets, defenders can also use AI to analyze enormous volumes of security telemetry.

If attackers can automate vulnerability discovery, defenders can use similar technologies to identify and fix vulnerabilities before they are exploited.

This means that the answer to AI-powered attacks is not necessarily less AI. In many cases, it may require better defensive AI with stronger security controls.

What This Means for the Future of AI Agents

The debate around AI safety is increasingly moving from hypothetical scenarios toward practical questions about deployment.

How much autonomy should an AI agent have?

What permissions should it receive?

When should a human intervene?

How should an organization investigate an agent’s decisions?

What happens when an agent encounters an instruction that conflicts with its original objective?

And perhaps most importantly, how do we prevent an AI agent from turning access to legitimate tools into an unintended security pathway?

These questions will become more important as AI moves from generating information to taking actions.

The Bigger Picture: AI Is Becoming an Operational Technology

The most important development in this story is not that criminals are using AI. That has been happening for years.

The deeper change is that AI systems are becoming capable of operating across multiple steps instead of simply responding to individual prompts.

That transition is valuable for legitimate users because it makes AI more useful. An agent can perform a longer task instead of waiting for a human after every step.

But autonomy also increases the consequences of mistakes, misuse, compromised tools, and excessive permissions.

Cybersecurity is therefore becoming one of the clearest real-world tests of whether AI agents can be made both powerful and controllable.

Final Takeaway

Anthropic’s latest warnings about increasingly autonomous AI-powered cyberattacks should not be viewed simply as another cybersecurity headline.

They are part of a broader transition in artificial intelligence.

AI models are evolving from systems that primarily generate answers into systems that can plan, use tools, execute actions, and operate for longer periods.

That evolution has enormous potential for software development, cybersecurity, research, business automation, and productivity. It also means that traditional security assumptions may no longer be sufficient.

The central challenge will be finding the right balance between autonomy and control.

The organizations that benefit most from AI agents may ultimately be those that do not simply give them more capabilities, but build the right boundaries around those capabilities.