In October 2026, a security researcher at NorForge found exposed control panels for an open-source AI penetration testing tool and discovered how they were being used. According to The Hacker News, which reviewed the findings alongside Reuters, an operator pointed autonomous AI agents at more than 1,200 websites and reached sites belonging to more than 100 companies. The researcher estimated the AI usage cost at about $5,000, or roughly $50 per successful break-in.
That same week, CrowdStrike published research on four threat actors using autonomous AI agents in real intrusions. As Cybersecurity Dive reported, the main barrier for attackers is "not engineering complexity but token budgets." CrowdStrike counted three times as many likely agentic intrusions in the second half of 2026 as in the first half.
Defenders are moving more slowly. PwC surveyed 3,934 business and technology executives across 71 countries for its 2027 Global Digital Trust Insights report, released October 1, 2026. Only 22% said they would authorize fully autonomous AI agents for cyber defense, and 50% of security leaders named attacks on their AI systems among the threats they are least prepared for.
What Changed When Attackers Went Autonomous?
Attackers no longer need skilled people for every step. An autonomous agent can scan, exploit, persist, and retry around the clock for the price of the tokens it uses. That changes the economics of attacking you: a campaign with a 10% success rate is profitable when each attempt costs a few dollars, and no one has to stay awake to run it.
The NorForge campaign shows the shape. Hacker News reports an overall success rate of around 10%, with successful break-ins taking about 23 hours on average. The operator's instructions reportedly ran to fewer than 100 Chinese characters. The tool, Cairn, was built for authorized penetration testing. Named victims included Deere, SharkNinja and Cummins, and Deere and SharkNinja described limited damage.
CrowdStrike's research points the same way. One Russian-speaking actor gave Claude Code a seven-part to-do list and what CrowdStrike called "near-total autonomy," and the attacks led to theft of corporate client data from a US help-desk platform. Two of the four actors used simple setups and still compromised numerous organizations. CrowdStrike expects agentic attacks to "almost certainly increase in volume and sophistication" over the next year.
The month-by-month numbers matter more than any single incident. By CrowdStrike's count, August 2026 had more than twice as many likely agentic incidents as July, and September had twice as many as August. Treat those as one vendor's telemetry, not a census of the internet, but the direction is hard to argue with.
Why Won't Security Leaders Let AI Defend on Its Own?
Because they cannot yet trust it or explain it. PwC asked what holds back greater autonomy for AI agents in security operations. 55% ranked AI reliability and maturity among their top three barriers, and 46% cited accountability and explainability in AI decision-making. 44% of CISOs pointed to a lack of workforce skills in AI oversight and governance.
Those are reasonable objections, not timidity. A defensive agent that isolates the wrong server, revokes the wrong executive's credentials, or blocks a payment processor during a sales peak causes a real outage, and somebody has to answer for it. An attacker's agent carries no such accountability. If it breaks something, nobody calls the attacker's board.
The asymmetry is the whole problem. Attackers can accept a 10% success rate and a lot of collateral noise. Defenders need to be right almost every time, and they need to show their work afterward. That is why "let the AI handle it" is not a serious answer for most security teams, and why "keep a human on every action" is not one either.
Is Fully Autonomous Defense Actually the Answer?
Not for most companies, and not yet. The better answer is bounded autonomy: let AI act alone on narrow, pre-approved, reversible actions at machine speed, and keep humans on decisions that are hard to undo. In our experience, the gap closes when containment is automatic, and judgment stays human, not when one replaces the other.
Gartner is betting in the same direction. Among its top strategic technology trends for 2027, announced October 20, 2026, and reported by Network World, it predicts that by 2031, organizations deploying autonomous exposure remediation will reduce their average vulnerability containment window "from weeks to within 48 hours." That is automation aimed at the window attackers exploit, not a fully autonomous security operations center.
The same Gartner list carries a warning for anyone deploying agents of their own. It predicts that by 2028, 25% of enterprise security breaches will trace back to AI agent abuse "due to unmanaged machine privileges and legacy credential practices." Defensive agents are agents too. Giving one broad, standing administrator access to fight autonomous attackers creates exactly the kind of privileged machine identity attackers want to steal.
What Should Defensive AI Be Allowed to Do Without Asking?
Start with actions that are fast, narrow, and easy to reverse. These are the boundaries we use when we design security automation for clients. Each one buys speed without asking anyone to trust a black box with irreversible decisions, and each one leaves a record a human can review the same day.
Contain, don't destroy. Let the agent isolate a host, quarantine a file, suspend a session, or block an address on its own, because each of those can be undone in minutes. Require human approval for anything that deletes data, wipes a machine, changes a production configuration, or touches payment systems. Speed matters most in the first minutes, and containment pays off there.
Revoke credentials automatically; restore them manually. When an agent sees a token or key used in a pattern that looks like abuse, it should revoke it immediately. A person should restore access. That split keeps the cost of a false positive small, a few minutes of inconvenience, while removing the attacker's foothold at machine speed.
Give the defensive agent its own identity and the least privilege it needs. No shared service accounts, no standing domain administrator rights, short-lived credentials scoped to the actions you have approved. Our MCP security guide covers how to authenticate agents properly. The same rules apply when the agent works for your security team.
Log every decision in language a human can read. PwC's respondents named explainability as a top barrier, so build for it. Every autonomous action should record what the agent saw, which rule or reasoning it applied, and how to reverse it. If your team cannot reconstruct a decision the next morning, the agent should not have been allowed to make it alone.
Expand autonomy on evidence, not on faith. Run the agent in recommend-only mode first and measure how often a human would have agreed. Promote an action to autonomous only after it has a track record your team accepts. This is the same discipline teams use for testing AI-generated code: trust is earned on data, one category at a time.
What Happens When Your Defensive AI Refuses to Help?
It has already happened. Fortune reported in October 2026 that during a roughly 48-hour attack on the AI coding platform OpenCode, the company's defensive agents ran on an OpenAI model that refused requests in the middle of the attack. OpenCode regained capability by joining OpenAI's Daybreak Blue program for verified security professionals. Fortune also reported that Hugging Face's closed model refused to help defend against an agent attack in July, so the company switched to an open model.
The lesson is uncomfortable. The safety guardrails that stop a model from helping attackers can also stop it from helping you, at the worst possible moment. Attackers using jailbroken or open models don't face that friction. A defense plan that depends on a single commercial model behaving a certain way under pressure has a single point of failure.
Plan for it the way you plan for any vendor outage. Enroll in your model providers' verified security programs before you need them. Test your defensive workflows against the provider's current policies, not last quarter's. Keep a fallback model, with its own approval and logging, that your team has already evaluated. And keep a runbook that works with no AI at all.
Where Should You Start?
With the window attackers exploit. Autonomous attackers are cheap and patient, so the companies they hurt most are the ones with exposures that stay open for weeks. Map your internet-facing assets, including AI tools and agent control panels, which is exactly what the NorForge operator left exposed. Then automate detection and containment on the narrow actions listed above.
Next, decide who owns the AI that defends you. PwC found that 53% of organizations already use managed services, with AI the leading focus area, and 44% of CISOs say AI oversight skills are a barrier. If you lack the people to supervise defensive agents, that is the gap to close first.
Our AI orchestrator is where we enforce approvals, budgets, and logs across agents, and our post on AI coding agent security covers the agents your own developers run. Finally, remember that autonomous attacks also cost you money in other ways. Our guide to cost exhaustion attacks covers the attackers who target your AI bill rather than your data.
Common Questions About Autonomous AI in Cyber Defense
What is an autonomous AI cyberattack?
An autonomous AI cyberattack uses AI agents that scan, exploit, and persist with little human direction. In one October 2026 campaign reported by The Hacker News, an operator's agents targeted more than 1,200 websites and reached more than 100 companies, at roughly $50 per successful break-in. CrowdStrike says token budgets, not engineering skill, now limit attackers.
Why don't companies let AI defend their networks autonomously?
Trust and accountability. In PwC's 2027 Global Digital Trust Insights survey of 3,934 executives, only 22% would authorize fully autonomous AI agents for cyber defense. 55% ranked AI reliability and maturity among their top three barriers, and 46% named accountability and explainability. A defensive mistake causes a real outage, and someone must answer for it.
What is bounded autonomy in security operations?
Bounded autonomy lets AI agents act alone only on narrow, pre-approved, and reversible actions, such as isolating a host or revoking a suspicious token, while humans approve anything destructive or hard to undo. The system logs every autonomous action in plain language. Autonomy expands one action category at a time as the agent builds a track record.
Can a defensive AI model refuse to help during an attack?
Yes. Fortune reported that OpenCode's defensive agents, running on an OpenAI model, refused requests mid-attack in October 2026, and that Hugging Face's closed model refused to help defend against an agent attack in July. Enroll in providers' verified security programs early, test against current policies, and keep an evaluated fallback model.
If autonomous attackers are on your risk register and you are not sure how much autonomy your defenses can safely have, talk to the Golabs team. We will map which actions can run at machine speed, which need a human, and what it takes to log both. Our tailored AI agents include scoped identities and approval gates from day one.