‘Not how humans act’: How agentic AI is changing cyberattacks

[SINGAPORE] Reuben Koh knows when he’s watching artificial intelligence (AI) attack a network – the patterns look all wrong.

“We know that AI agents are being utilised in this manner because no human would do it that way,” he told Tech in Asia.

For decades, coordinated cyberattacks have been slow and methodical, unfolding over days or weeks. An attacker would gain initial access, then move carefully through the network, trying to avoid detection.

But nowadays, AI agents are increasingly handling almost every aspect of a cyberattack, with humans stepping in only for strategic decisions, said Koh, the director of security and technology strategy for Asia-Pacific and Japan at cybersecurity firm Akamai Technologies.

In November 2025, US-based Anthropic published a report detailing what it called the first documented AI-orchestrated cyber espionage campaign.

The report noted that a Chinese state-sponsored group used Claude Code to conduct attacks against about 30 organisations, with AI agents executing an estimated 80 to 90 per cent of the work.

Anthropic described the attacks as happening at “physically impossible request rates”.

The report sparked controversy, with critics saying it was vague and lacked evidence. But for cybersecurity professionals like Koh, the findings simply confirmed what they were already seeing.

The speed problem

Agentic attacks operate at what Koh calls “machine speed”. AI bots are not cautious or methodical; they move comprehensively and simultaneously. They can probe dozens of systems at once, try hundreds of usernames and passwords, and exploit multiple vulnerabilities in parallel.

Even the social engineering portions of cyberattacks – which used to require extensive research, careful targeting, and skilled writing to steal users’ names and passwords – have become automated.

“Most of the time, they can be successful even before you finish your coffee,” said Koh. Consequently, this has changed how companies need to defend their systems.

Sheetal Mehta, global head of cybersecurity services for NTT Data, said part of the problem is that agentic attacks blend seamlessly into enterprise environments, making detection significantly harder.

With AI, cybercriminals are not deploying obviously malicious software that triggers alerts. Instead, they have access to the same standard tools that legitimate businesses use.

However, the speed advantage that cyberattackers gain from AI also works for the defence, Mehta said. His team has used AI to reduce response times to an attack from 40 minutes to 10 minutes.

He added that AI has enabled seven to 10 times productivity gains for security analysts. For example, an analyst processing 20 alerts per day can now handle 100 to 120.

NTT’s research found that 55 to 60 per cent of enterprises still face fundamental security challenges, Mehta said. Most organisations run on legacy systems that were not designed for AI threats.

He also pointed out the issues that tech can’t fix: human errors that compromise credentials, patches not applied on time, or vulnerabilities left unaddressed.

Productivity of errors

While AI’s ability to boost productivity gains has helped security firms, it is also partly responsible for a growing problem, said Damien Wong, senior vice-president of Tricentis, a software quality and testing platform.

The growing popularity of vibe coding, combined with the high-pressure environment that most software companies work under, has contributed to a rise in untested software on the market.

“The fact that people haven’t even tested the code is probably one of the key reasons why we have so much vulnerability in our systems today,” Wong noted. He called the volume of untested software “a deluge”.

While acknowledging a 55 per cent upsurge in productivity for developers using GitHub Copilot, he also said there is a corresponding 40 per cent increase in bugs and software defects.

Tricentis surveyed more than 2,700 technology leaders globally for its Quality Transformation Report last year. Nearly half admitted they regularly release untested code into production.

This included the often AI-generated code used to install APIs, the software that allows systems to work together. Since APIs usually allow access to other parts of the systems, they are becoming one of the most prominent attack vectors, Wong said.

Once the AI agents gain access to the system, they quickly reset security settings or damage recovery files.

“If you think about it,” said Ryan Kalember, chief strategy officer for Proofpoint, a data security company, “an agent running inside an enterprise can act like an insider.”

Apart from APIs, another system causing issues is Anthropic’s Model Context Protocol (MCP), a software standard designed to make it easier for AI agents to work together.

Anthropic released MCP in November 2024, and adoption has accelerated rapidly.

The problem, said Akamai’s Koh, is that MCP is meant to connect systems together, not to keep them secure.

“The focus is on interoperability, which also means that it was not designed with security in mind,” he added.

Kalember has seen the exploitation firsthand. In August 2025, his team discovered a malicious MCP server for a tool called Postmark. The server let AI agents send e-mails, but an attacker had configured it to BCC their own e-mail address on every message sent.

The target was customer service agents, which represent the most common enterprise use case for AI automation.

In September 2025, Microsoft announced that MCP servers and agents will become fundamental components of Windows 11.

What enterprises must do

The only viable defence is to fight fire with fire. Organisations need AI-powered security systems that can catch anomalies, correlate threats and respond automatically at the same pace that attacks happen.

Human analysts simply cannot process information fast enough anymore.

But before organisations can defend against sophisticated AI attacks, they need to understand where they stand. NTT’s Mehta noted that most don’t, and many enterprises lack a baseline of their level of risk.

Organisations need to map out their current security state, he said. They need to know their current level of cyber risk, define what level of risk remains acceptable to their business, and build an integrated view of their security controls. They should also understand how to recover after an attack. Only then can they start thinking about transformation plans and AI-powered defences.

Grasping the nitty-gritty of AI, however, may not be necessary.

Akamai’s Koh emphasised that while security teams need AI literacy, they don’t need to understand the technical details of how large language models work.

“They need to know the differences between generative AI and an AI agent,” he said. “But more than that, they need to know how to harness an AI-powered tool to help them in their work.” TECH IN ASIA