Enterprises have deployed AI agents into core systems and left the identity layer ungoverned

A threat actor operating inside a Sophos customer environment ran what amounted to a software development programme, using around 12 AI agents coordinated through a commercial coding assistant to write and test malware against Sophos, CrowdStrike and Windows Defender endpoint protection, according to the company’s AI Security 2026 report published in July. The operation produced nearly 80 modules and more than 70 evasion techniques, with every result committed to version control and improved on the following pass. The same operator later deployed ransomware and stole data.

Sophos tracks the actor as STAC6994. J. P. Peterson, Chief Technology Officer at Sophos, said the tradecraft itself was not new, and that the agents turned weeks of manual iteration into days of automated iteration. Attackers still need initial access, still move laterally and still exfiltrate through observable channels, he stated. “What has changed is the clock.”

The STAC6994 case gives an unusually complete picture because the development environment was left on a device Sophos analysts could examine. The attacker had provisioned virtual machines from Ludus and was using the Cursor IDE, running parallel testing across three environments: one virtual machine carrying Sophos endpoint protection, one carrying CrowdStrike, and one with no EDR at all as a control. A fourth operated as a Sliver command-and-control server. One agent, running Claude Opus 4.5, handled core operations and rule-setting, while others managed operational security hardening, documentation, proxy stress testing, virtual machine deployment and testing against the EDR agents. Code commits flowed to Git through Model Context Protocol.

At the centre of the setup was a Python-based modular payload generator that wrapped raw payloads in layers of encryption and evasion, producing custom executables in Rust and Go. Agent documentation claimed near-universal success against the endpoint agents. However, Sophos analysts noted the evidence did not fully support that conclusion, and found no indication of AI embedded inside deployed malware. The report describes the operational signal as tempo, with a full development cycle compressed from weeks into days.

Sophos connects that tempo directly to the vulnerability management problem. CISA’s Binding Operational Directive 26-04, issued on 10 June 2026, cut mandatory patching to three days for the highest-risk flaws, citing AI as a factor narrowing the gap between disclosure and exploitation. The first real-world test came almost immediately, with CVE-2026-10520 in Ivanti Sentry exploited within 24 hours of proof-of-concept publication and added to the KEV catalogue on 12 June. CVE-2026-42208 in LiteLLM was exploited within 36 hours, with attackers targeting databases holding upstream LLM provider keys.

The report treats the three-day directive as a floor, on the basis that AI-assisted exploitation is compressing the disclosure-to-exploitation window to hours, and argues that organisations measuring patching cadence in weeks face worsening exposure. The asymmetry extends well beyond detection speed into the operational machinery around it. An attacker adopting a new tool faces no procurement cycle, no compliance review and no change advisory board, while a defender receiving an AI-assisted containment recommendation within minutes may still be bound by a change ticket, a maintenance window and a 48-hour service level agreement. An AI-assisted campaign against FortiGate devices compromised over 600 firewalls across 55 countries in five weeks.

The identity layer around enterprise AI has become the most immediate governance failure

Sophos identifies the credential and identity fabric connecting AI services to enterprise systems as the area where existing controls were never designed to hold. The Salesloft/Drift incident showed the mechanism plainly, with Drift OAuth tokens used to breach multiple Salesforce environments. In April 2026, Vercel disclosed a breach triggered by an employee registering with a corporate Google Workspace account and granting blanket permissions to the Context.ai OAuth app, after which a compromise at Context.ai handed attackers those tokens and access into Vercel’s internal environments.

The scale of the exposure is growing quickly. BeyondTrust reported a 466.7% increase in active AI agents within enterprise environments over the past year, and Zscaler recorded 410 million data loss prevention policy violations generated by ChatGPT alone. Research from Saviynt and Cybersecurity Insiders found 75% of respondents had discovered shadow AI tools and 95% doubted they could detect or contain misuse. In comparison, 71% of large enterprises have deployed AI agents accessing core business systems, and only 16% govern that access effectively. Pentera put the share of enterprises with a dedicated AI security budget at 1%. Splunk found that concern rose among CISOs at organisations with greater AI maturity, suggesting those further along in adoption “are starting to notice some trade-offs.”

Developer infrastructure is where AI-related attacks are already happening at scale

Sophos recommends that any organisation with a development team treat AI development infrastructure as its top immediate risk, describing this as the one area where AI-related attacks have moved beyond theoretical proof-of-concept. The SANDWORM_MODE npm worm campaign involved at least 19 typosquatted packages mimicking legitimate developer utilities and AI coding tools, installing a rogue MCP server that used embedded prompt injection to coerce legitimate AI assistants into silently retrieving and exfiltrating SSH keys and cloud credentials. The Nx Console VS Code extension compromise harvested credentials from HashiCorp Vault, npm, AWS, GitHub, 1Password and Anthropic.

The controls Sophos proposes are largely process-driven, covering dependency management, version pinning, review of new open-source libraries before inclusion, and close monitoring of developer endpoints. The report sets out seven blast-radius controls for agentic deployments, among them agent sandboxing, credential isolation that keeps long-lived secrets out of model context windows, sealed tool endpoints brokered through a fixed schema, egress restriction, extended EDR coverage to containers and ephemeral virtual machines, human-gated approval for irreversible operations, and boundaries on injection propagation across agents.

Autonomy remains the exception, and the industry evidence does not yet support the alarm around it

Fully autonomous AI-driven intrusion campaigns remain unconfirmed at scale. GuidePoint’s GRIT 2026 ransomware report stated that concerns about “super-affiliates deploying fully autonomous ransom-bots” have been overstated, and that AI usage remains rudimentary among less mature actors. Recorded Future placed most observed AI malware at the lower levels of its AI Malware Maturity Model and found no confirmed examples of malware running local models on victim hosts, advising defenders to prioritise monitoring abuse of legitimate AI services “rather than overreacting to sci-fi scenarios.”

Trajectory is where the report holds firmest. The UK AI Security Institute measured a roughly sixfold improvement in autonomous offensive capability over 18 months, with each model generation completing steps in multi-stage intrusion scenarios that prior generations could not. On the defensive side, McKinsey found security concerns to be the leading barrier to scaling agentic AI for nearly two-thirds of respondents, with inaccuracy cited by 74% and cybersecurity by 72%. Sophos concludes that models are already capable enough for the work, and that the binding constraint sits in whether organisations can operate them at the trust level autonomous security operations require. Defenders who do not adjust their tempo, the report states, will find themselves further behind than they assumed.