Agentic AI in cybersecurity: offense, defense, and what is real

Agentic AI in cybersecurity is the shift from models that advise a person to agents that plan a task, call tools, and act on the results with little help at each step. It is one of the most consequential and most oversold ideas in security right now. Vendors describe autonomous AI agents that hack and defend on their own, while skeptics wave the whole thing off as a demo reel. The grounded picture sits between them, and it is knowable from primary reporting. This guide defines agentic AI, separates AI-assisted from agentic from autonomous, walks through how autonomous AI agents are used on offense and defense in 2026, weighs what is real against what is still a proof of concept, and lays out the risks and what they mean for defenders.

What is agentic AI?

Agentic AI describes systems that pursue a goal over several steps, choosing their own actions as they go instead of following a fixed script. Anthropic draws the line cleanly in its guidance on building agents. The base unit is what it calls the augmented LLM, a model "enhanced with augmentations such as retrieval, tools, and memory." From there it separates two shapes. Workflows are "systems where LLMs and tools are orchestrated through predefined code paths." Agents are systems where "LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks," which Anthropic sums up as models "using tools based on environmental feedback in a loop." Both fall under the umbrella term agentic systems, per Anthropic.

The security conversation blurs three different things, and keeping them apart is the whole point.

AI-assisted. A person runs every step and the model advises: it drafts a phishing lure, explains a vulnerability, or suggests the next command. Nothing happens until a human acts.

Agentic. The model plans a multi-step task and calls tools in a loop, deciding each next move from what the last one returned, and pausing for a human at checkpoints. This is the shape now appearing in both attacks and defenses.

Autonomous. The agent runs a task end to end with little or no human input. In practice, most security agents today sit between assisted and autonomous, with people still at the key decision points. When Anthropic disrupted a state-linked espionage operation in late 2025, it reported that an AI agent did an estimated 80 to 90 percent of the work across roughly thirty targets, with humans stepping in at only a handful of moments, according to Anthropic. That ratio, not full autonomy, is the current frontier.

Agentic AI on offense and defense

The reason agentic AI matters is not that it invented a new kind of attack. It is that agents automate the slow, skilled stages that used to keep capable offense rare, and they do the same for the defensive work of sorting real risk from noise. The same loop runs on both sides.

OFFENSE AND DEFENSE

The pattern is symmetric. On offense, agents compress reconnaissance, exploitation, and intrusion. On defense, agents have to run validation, triage, and response in the same loop and at the same speed.

Offense: compressing the slow stages of attack

Four uses stand out in 2026 reporting, and they map to the stages that used to keep serious offense scarce.

Reconnaissance at scale. Language models are good at the parts of an attack that are mostly research and writing: profiling a target, enriching an org chart, and drafting a fluent, localized lure. Mandiant's M-Trends 2026 reporting describes threat clusters folding AI into reconnaissance, social engineering, and malware development. This is the most common and least cinematic use. For the wider survey see how attackers use AI, and for why recon feeds everything after it, attack surface versus attack path.

Faster exploit development and chaining. Turning separate bugs into one working exploit is the expensive specialist work that long kept capable attacks rare. In October 2026, Anthropic's red team reported that a single unreleased research model found flaws and chained them into working proof-of-concept exploits across Chrome, Safari, Android, Windows, and Linux, including a one-click remote code execution in Chrome, all reported through coordinated disclosure and patched before publication, as reported. We broke that down in an AI model chaining exploits across browsers and operating systems. The kind of flaw at stake, such as a remote root in the Linux kernel MPTCP code, is exactly what an agent gets pointed at.

Agents in live intrusions. The newest shift is agents that act, not just advise. In its 2026 threat hunting reporting, CrowdStrike described four previously unreported threat actors using AI agents to make decisions and run commands inside real intrusions, spanning reconnaissance, exploitation, and data theft, and assessed with moderate confidence that agentic AI is turning baseline offense into a commodity. We covered it in AI agents running real cyberattacks.

Defense: validation, triage, and response in the loop

The same capability points the other way, and defenders have a structural advantage: they can run agents inside their own environment, with full access and ground truth, instead of probing from outside.

Finding flaws before attackers use them. Google reported that its AI agent Big Sleep found a SQLite flaw, CVE-2025-6965, that it said was known only to threat actors and at risk of being used, which Google called a first for an AI agent directly disrupting an exploitation effort. On the model side, Google's Gemini 4 Carbon posted high scores on benchmarks for finding and exploiting flaws in real software, results it framed for defensive use; read those as a capability ceiling, since they are self-reported and measured without guardrails. We put that in context in Google Gemini 4 Carbon and AI cyber defense.

Machine-speed triage and validation. The defensive bottleneck has never been finding problems. It is proving which ones are real and reachable before a person spends time on them. Agents can take a raw finding, test whether it is exploitable in context, rank it by what an attacker could actually reach, and hand a human a short, evidenced list instead of a queue of thousands. That is the operating model behind AI-native security and the validation step in continuous threat exposure management.

Guardian agents. As organizations deploy agents of their own, a second layer appears: agents that supervise other agents. Gartner uses the term guardian agents for this, describing roles that review outputs, monitor activity, and step in when an action gets risky, and forecasts that such technologies will make up a meaningful share, on the order of 10 to 15 percent, of the agentic AI market by 2030, per reporting on Gartner. Microsoft frames the same problem from the inside, arguing that an AI agent should be treated as a new kind of insider: because it holds real access to do its job, it carries insider risk even when no one has hijacked it, so every agent should have its own identity and no standing authority.

Risks of agentic AI

Autonomy is exactly what makes agents useful and exactly what makes them dangerous. The risk is not science fiction. It is the gap between what you told an agent to do and what it can be made to do. OWASP maps this in two places: the Top 10 for LLM Applications, which covers the model layer, and the Top 10 for Agentic Applications, released in late 2025, which covers systems that plan, remember, call tools, and act with delegated authority. Three risks matter most for security teams.

Prompt injection. OWASP ranks prompt injection as the top LLM risk, because a model cannot reliably tell trusted instructions from malicious ones. The dangerous form for agents is indirect: an attacker hides instructions in a web page, a document, or a ticket that the agent later reads, and the agent follows them. An agent with tools and permissions does not just get confused. It acts on the bad instruction.

Excessive agency and tool misuse. OWASP's excessive agency covers an agent given more capability, permission, or autonomy than its task needs, so one bad decision reaches tools, data, or systems it should never have touched. The agentic applications list extends this to tool misuse and goal hijacking. The recommended principle is least agency: an agent gets only the autonomy a bounded task requires, which is the automation version of least privilege.

Keeping humans in control. The through-line of the guidance, from OWASP to the NIST AI Risk Management Framework and its in-progress control overlays for AI agents, is scoping, not prohibition. Give each agent its own identity and least-privilege access, constrain the tools it can call, log what it does to a record you can audit, and put approval gates in front of consequential actions so a person signs off before an agent deletes data, deploys code, moves money, or sends data outside the organization. The goal is an agent that can act fast inside a box you drew, not one that can act freely.

Agentic AI does not change what an attacker wants, only how fast and cheaply they can get it, which is why defense now has to run in the same loop.

At Threatless, we treat agentic AI as the condition defense is built for, not a feature to bolt on. The approach is AI-native: run continuously, prove a finding is real and reachable before a person spends time on it, and rank what remains by the risk an attacker could actually act on. That is the shape of Threatless CTEM for exposure management across the program, Threatless Surface for seeing what is exposed, Threatless DeepScan for going deep on individual assets, and Threatless SOC for detection and response. People stay in control, and the agents do the slow sorting so teams spend their time on the decisions that matter.

Frequently asked questions

What is agentic AI in cybersecurity?

Agentic AI in cybersecurity is the use of AI agents that plan a multi-step task, call tools, and act on the results in a loop, rather than only advising a person. On offense that means agents that run reconnaissance, build exploits, or carry out steps of an intrusion. On defense it means agents that validate findings, triage alerts, and respond, with people kept at the key decision points.

How is agentic AI different from AI-assisted security?

AI-assisted means a person drives and the model advises: it drafts, explains, or suggests, and a human runs every step. Agentic means the model itself plans the steps and uses tools in a loop, deciding its next move from each result. Autonomous is the far end, where an agent runs a whole task with little human input. Most security agents today sit between assisted and autonomous.

Are autonomous AI agents really running cyberattacks in 2026?

Yes, with care in the framing. CrowdStrike reported four threat actors using AI agents inside real intrusions in 2026, and Anthropic reported an espionage operation where an agent did most of the work. At the same time, the most dramatic results, such as chaining exploits across operating systems, are lab demonstrations under coordinated disclosure, not routine attacks. The capability curve is real and steep; the claim that AI already drives most breaches on its own is not yet supported.

What are the main risks of agentic AI?

The top risks are prompt injection, where an attacker hides instructions in content the agent reads; excessive agency, where an agent has more permission or autonomy than its task needs; and tool misuse, where that access is turned to harmful ends. OWASP covers these in its Top 10 lists for LLM and agentic applications. The common mitigation is least agency: scope each agent tightly and gate consequential actions behind human approval.

How should defenders prepare for agentic AI?

Give every agent its own identity and least-privilege access, constrain the tools it can call, and log its actions to a record you can audit. Put approval gates in front of actions that move money, data, or code. On the detection side, adopt a continuous, evidence-driven model so defensive agents can validate and triage at the speed offense now moves. See AI-native security and continuous threat exposure management.