Field Notes / Threat Intelligence
AI versus AI: autonomous agents now attack at machine speed, and your defences must keep pace
An autonomous AI agent breached McKinsey’s Lilli platform in two hours. Attackers now run reconnaissance, vulnerability discovery and exploitation without a human at the keyboard. Here is what that changes, and what you get from a defence built to match it.
01 The attack you cannot outrun
n autonomous offensive agent joins a large language model to a set of tools and a goal, then runs the whole attack chain by itself. It reasons, it adapts, and it does not stop to sleep. The McKinsey breach is the clearest proof so far that this is operational, not theoretical.
The attack moves through four stages, and each one used to buy defenders time. That time is gone. In reconnaissance, an agent maps your entire attack surface in minutes. It enumerates subdomains, API endpoints, technology stacks and entry points, work that would take a human penetration tester days. The McKinsey agent walked more than 200 documented API endpoints and picked out the 22 that were left unauthenticated.
In vulnerability discovery, the agent reads context rather than matching signatures. It spots logical flaws, authentication bypasses and business logic weaknesses that a scanner never flags. The McKinsey SQL injection sat in JSON field names, where the values were parameterised but the field names were concatenated straight into the query. A signature tool has no rule for that. A reasoning agent worked it out.
In exploitation, the agent chains small findings into a full compromise. A minor information leak, an authentication weakness and a misconfigured endpoint add up to the keys of the building, and the agent reasons about how the pieces fit. In the final stage it extracts and sorts data, plants persistence, and covers its tracks without a human in the loop. At McKinsey the agent reached write access to the platform’s system prompts, which means it could have left a permanent, invisible backdoor inside the AI itself.
02 Why yearly testing no longer protects you
A yearly penetration test tells you whether the locks were sound on the day the tester visited. Against an agent that regenerates its attack on every run, that snapshot ages the moment it is signed. The gap shows up first in raw speed. What takes a skilled human days, an agent finishes before your shift handover.
| Attack phase | Human attacker | AI agent | Speed multiplier |
|---|---|---|---|
| Reconnaissance | 2 to 5 days | 15 to 30 minutes | 200 to 500x |
| Vulnerability identification | 3 to 7 days | 30 to 60 minutes | 100 to 300x |
| Exploitation | 1 to 3 days | 5 to 30 minutes | 50 to 200x |
| Full compromise | 1 to 4 weeks | 1 to 4 hours | 40 to 170x |
| Data classification | Days to weeks | Minutes to hours | 100x and above |
Speed is only the first problem. Your pattern-matching defences lose their grip too. Firewalls and intrusion detection rely on known signatures, and an agent writes payloads that mean the same thing while looking different every time, so signature detection misses them on every pass. Volume finishes the job. An agent probes thousands of endpoints at once, and the alert flood buries the one probe that mattered in the noise of the rest.
The last gap is adaptation. When a technique fails, a human attacker gets frustrated and a person eventually stops. An agent tries another route, rewrites the payload, shifts its timing and learns from the miss, without fatigue. Set that against a median dwell time of ten days for a human intruder CrowdStrike 2025 and the mismatch is plain. By the time an analyst opens the ticket, the agent has finished.
03 Match their speed, or lose the window
You beat a machine-speed attacker by fighting at machine speed and by giving the agent less to find. Start with detection and response that run without a human bottleneck. Behavioural analysis, anomaly detection and real-time threat assessment have to be automated, so the system reacts while the attack is live rather than after the report. For high-confidence detections, wire in automated containment. When an agent is probing your APIs faster than a person can read a dashboard, human-in-the-loop approval is the slow path that loses.
Test your defences with the same autonomous tools the attacker uses, so you find the chain before a real agent does. This is what RTP Robin gives your team: it re-runs autonomous attacks against your live systems on demand, so the picture stays current between formal assessments instead of ageing the moment a yearly test ends. You walk away knowing the exact route an agent would take, and you close it on your own schedule rather than the attacker’s.
Then shrink the target. McKinsey ran more than 200 API endpoints with 22 left unauthenticated, and every open endpoint is a door an agent will try. Cut your API surface to what the business actually needs. Treat every AI interaction as potentially hostile, including calls from internal tools, and verify each request while limiting each permission. Isolate AI systems from the databases, payment rails and identity providers behind them, so a compromised model cannot walk sideways into the systems that hold the money.
04 Turn the assessment into your evidence
Regulators have already named autonomous attacks as in scope, so the work you do to defend also produces the paperwork they will ask for. The EU AI Act requires risk management against reasonably foreseeable misuse, and an autonomous agent attack is foreseeable by any honest reading, with the high-risk obligations enforceable from 2 August 2026. The NIST AI Risk Management Framework builds adversarial AI risk into its Govern and Manage functions NIST AI RMF . The UK NCSC has published guidance on defending against AI-augmented attacks NCSC 2025 . For financial services, DORA demands threat-led penetration testing that now has to account for agent capabilities.
The shift this asks of you is concrete. Move from periodic testing to continuous validation, because an annual test cannot keep pace with an agent. Move from human-paced response to automated containment, because playbooks that budget hours of analysis are already obsolete. Move from signature detection to behavioural analysis, because novel payloads defeat pattern matching. And plan on the assumption that the perimeter will be breached, so your effort goes into limiting the blast radius rather than trusting the wall.
None of this needs a blank cheque. It needs the right work in the right order, and each step leaves an artefact a regulator can read. An AI security assessment that includes autonomous agent testing gives you the findings, the severity, the fix list and the evidence in one pass. Close the gaps, then let RTP Robin keep testing as the system changes. Enterprise-grade defence against machine-speed attackers, within reach.
- Catalogue every AI system and every exposed API endpoint, then close or authenticate the ones the business does not need
- Commission an AI security assessment that includes autonomous agent testing, not a signature scan
- Deploy behavioural detection and automated containment sized for a minutes-long response window
- Segment AI platforms from databases, payment systems and identity providers to block lateral movement
- Set a recurring re-test cycle with RTP Robin so assurance holds as the system changes
References
Sources
- Red Team Partners. The McKinsey Lilli breach: what an autonomous agent reached in two hours. Field Notes, 2026. redteampartner.com
- Check Point Research. AI-Augmented Cyber Attacks: 2025–2026 Trend Report. Check Point Software Technologies, 2026. research.checkpoint.com
- SANS Institute. AI in Offensive Security: Capabilities and Countermeasures. SANS Institute, 2026. sans.org
- CrowdStrike. Global Threat Report. CrowdStrike, 2025. crowdstrike.com
- UK National Cyber Security Centre. Guidance on AI and cyber security. NCSC, 2025. ncsc.gov.uk
- NIST. Artificial Intelligence Risk Management Framework (AI RMF 1.0). National Institute of Standards and Technology, 2023. nist.gov