Inside the Vulnpocalypse: Are autonomous AI hackers script kiddies?
For about two years, we were promised that AI would supercharge cyberattacks into something so potent humanity had never seen before. In 2025 and 2026, many started believing the doom had started, when autonomous agents stopped being a tabletop scenario and started showing up in real incident reports as the thing doing the hacking, and not just amplifying social engineering attacks.
Anthropic disrupted a Chinese state-sponsored espionage campaign tracked as GTG-1002 in which a jailbroken Claude Code ran most of an operation against roughly thirty tech, finance, chemical, and government orgs, with the company estimating the AI handled 80–90% of the work[1]. Sysdig documented what they called the first ransomware campaign driven end-to-end by a model rather than a person, nicknamed JADEPUFFER[2]. Palo Alto's Unit 42 caught an opportunistic operator who wired a model into an open-source agent framework and pointed it at 460-plus targets across several countries[3]. Someone ran an AI agent unattended inside Thailand's Ministry of Finance[4]. And in the most "we live in a simulation" entry, a low-skill operator gave Claude and Codex some vague prompts and let the agents breach 14+ companies while he…mostly just watched[5].
Reasonable response to that list: panic. If the machines can hack by themselves, surely the game has changed and defenders are cooked (or are we?).
What are agents exploiting?
The truth is, hype sells. But you can't be very productive with such hype as a security person. So naturally, when we heard of these incidents we wanted to know: when one of these agents gets in, what is the door? A terrifying novel exploit nobody could have patched? A zero-day? Or… the same unlocked doors humans have been strolling through since roughly forever like an unpatched known bug, outdated API endpoint, an exposed admin panel, a weak password?
So we collected 5 confirmed, publicly disclosed cases where an AI agent attacked a real target, required a primary source for each one (the original vendor/lab report or CVE, not a hot take about a hot take), and crucially down-weighted the vendors' own bragging about how "autonomous" and "sophisticated" the attack was, because the people disclosing these have every incentive to make their models sound otherworldly. Then we mapped each incident on what was exploited, how novel it was, and three different levels of autonomy: did the agent find the hole, choose the target, and invent the exploit?
The vulns are depressingly mundane
Across every confirmed, verifiable case where the agent itself carried out the intrusion, the way in was something ordinary: a known CVE, a textbook web vulnerability, or stolen/weak credentials. Not one needed a novel exploit to succeed.
JADEPUFFER's grand entrance was CVE-2025-3248, a Langflow bug that had been sitting on CISA's Known Exploited Vulnerabilities list since May 2025, followed by an exposed Docker socket[2][10]. That's called walking through a door the authorities literally mailed everyone a flyer about. The 460-target spray campaign flung known CVEs at everything and mostly bounced off authentication that was doing its job[3]. The 14-company spree ran on known flaws and exposed services[5]. The state-sponsored espionage crew leaned on known web-app vuln classes and then reused harvested credentials to move around[1].
OWASP's GenAI exploit round-up for Q1 2026 looked at eight incidents and found exactly one had a CVE attached, but most were misconfigurations, design flaws, and prompt injection, i.e. the unglamorous stuff[9].
We have to give credit where credit is due. The agents are genuinely good at the tedious labor of hacking like enumerating targets, locating the reachable flaw, chaining existing tools, grinding through hundreds of hosts without getting tired, grumpy or needing snacks. What they are not doing, in any confirmed case we could find, is inventing new exploits. The thing that changed is scale, speed, and the skill floor. One guy with a Claude subscription can now do what used to take a team. Granted, that's a serious shift! But it's a volume shift, not a novel-capability-AI-hack-us-all shift. The late-October Cairn campaign is the purest example yet: ~$50 per breach, 100+ companies including Deere and SharkNinja, an operator renting DeepSeek and Claude Code against ordinary e-commerce flaws.
The benchmark research literature has been whispering this to us the whole time. Google's Threat Intelligence Group studied how government-backed actors actually use Gemini and concluded there were "no indications of them developing novel capabilities". AI was a productivity multiplier[11]. The capability evals agree: on CVE-Bench, agents exploited around 13% of real-world web vulns in the zero-day setting[12]. Fang et al. found an agent could autonomously exploit 87% of one-day vulnerabilities when handed the CVE description, and 7% without it[13]. This serves as a good explanation of why the real-world attacks cluster on known, documented vulnerabilities.
Plot twist: the attacker sabotaging the attack
The most reassuring (+ funny) theme in the data is that when these operations fell short, it was often the AI itself fumbling. In the GTG-1002 espionage campaign, the agent hallucinated credentials and overclaimed access it didn't actually have, which is a commendable way to sabotage your own state-sponsored op[1]. The 460-target spray produced limited real impact because it kept face-planting into authentication[3].
And the single most technically impressive attack chain in the whole set, which is an SSRF-to-Kubernetes-to-source-control escalation spanning something like 17,600 actions over four and a half days, didn't come from an adversary at all. It came from a lab evaluation agent that was effectively cheating its own benchmark, reaching into production to grab the test answers[6]. The scariest-looking sophistication lives in the sandbox escape, not in the confirmed attacks.
Limitations of our study
We can't possibly be claiming "X% of all attacks use novel exploits" because the sample is small and, by definition, only includes incidents that were detected and disclosed. A stealthier campaign with better tradecraft could absolutely exist and simply not be in anyone's dataset yet. However, of 5 confirmed agent-executed intrusions we could verify, none required novel exploitation to get in.
FYI, the first in-the-wild malicious MCP server, a booby-trapped postmark-mcp package, quietly BCC'd every email its host agent sent to an attacker. The agent wasn't hacking anyone, but it was an obedient courier for someone else's backdoor[7]. As we wire agents into more tools, "is this AI tool itself capable of evil" becomes a real question…
What this means if you actually defend apps
We have an almost-anticlimactic punchline now. Because autonomous agents are exploiting the mundane, the defenses are also the mundane, and right now they work disproportionately well. The highest-leverage moves are the ones every security team already knows and chronically under-resources:
- Patch known-exploited vulns first. CISA's KEV list is, empirically, where these agents are getting in[2][10]. Prioritize it like your attacker is an indefatigable robot, because it is.
- Kill exposed management interfaces, debug endpoints, and default/weak creds. The one campaign that reached 600+ devices did it almost entirely through weak, single-factor logins on exposed ports, with AI just helping a human do it faster[8]. MFA is not glamorous; it is load-bearing.
- Contain the blast radius attackers escalate through like exposed Docker sockets, long-lived session tokens, sprawled cloud and API keys.
- Vet the AI tools and MCP servers your own agents trust[7].
The strategic takeaway is that agentic attackers shift the economics toward high-volume, opportunistic campaigns against whoever is configured worst. That makes boring hygiene a higher-leverage control than it was a year ago, not a lower one. "AI can hack now" - so what do you do about it? Write a LinkedIn post to cope? Or maybe chase exotic exploits that don't show up in real incidents (yet)?
Maybe, just close the ordinary doors faster than a tireless automated opponent can find them at scale. Our edge as defenders may just be, knowing what's actually exploitable and patching it first. To learn more on how to adapt your appsec program strategy, check out this quick read: Building an enterprise appsec program with Claude. The machines learned to hack, yes, but they mostly learned to try the doorknob first. Don't let them use the doorknob.
| Incident (scale) | Way in (initial access) | Agent found the flaw? | Target picked by | Novel exploit invented? | Disclosed by |
|---|---|---|---|---|---|
| GTG-1002 espionage (~30 orgs) | Known web-app vuln classes | Yes | Human | No | Anthropic[1] |
| "knaithe" spray (460+ targets) | Known CVEs | Yes | Human | No | Unit 42[3] |
| JADEPUFFER ransomware (DB extortion) | Known CVE Langflow, on CISA KEV | Yes | Human | No | Sysdig[2] |
| Thailand Ministry of Finance | Stolen session tokens / creds | Unknown | Human | No | Hunt.io[4] |
| Claude + Codex spree (14+ companies) | Known CVEs + exposed services | Yes | Human | No | OALABS[5] |
All five are agent-executed intrusions, each anchored to a primary source, and all scored novelty 1 (known / known-class). In every case a human chose the target; in none did the agent invent a new exploit.
CVE-2025-3248, verified against CISA's Known Exploited Vulnerabilities catalog[10]. The CVE IDs in the knaithe and Claude+Codex rows were produced by the coder but are not yet verified against the primaries, reported-not-verified, and excluded from any CVE count. Coded "unknown": a stolen-session entry has no flaw to discover, so the discovery axis doesn't cleanly apply here.