AI Agents Are Starting to Hack at Machine Speed — And Cybersecurity Teams Have Less Time to React

For years, “AI hacking” usually meant a human hacker using artificial intelligence to work faster. AI could help write a phishing email, generate a piece of code, search for vulnerabilities or speed up reconnaissance.

The human was still driving the attack.

That distinction is becoming much harder to make in 2026.

In July, an AI-driven cyberattack targeting Taiwan reportedly used multiple autonomous agents to map government systems, identify weaknesses, compromise accounts and collect personnel records over a period of four days.

Then came another case with a very different target. Palo Alto Networks’ Unit 42 investigated a ransomware intrusion in which a human attacker used frontier AI models and agentic frameworks to carry out much of the attack chain. The intrusion took less than 10 hours. Unit 42 estimated that similar work would normally take human operators about two weeks.

The individual hacking techniques weren’t necessarily new.

The speed and level of automation were.

What Happened in Taiwan?

The Taiwan incident is one of the clearest examples so far of what autonomous AI can look like when used against real government systems.

According to cybersecurity firm Dream, the campaign took place over four days in July 2026. Up to eight AI agents reportedly worked together during the operation.

They mapped 21 government systems, compromised at least 85 user accounts and extracted more than 2,500 personnel records.

Taiwan’s Ministry of Digital Affairs said its investigation found indications that the attacks originated overseas and involved a hybrid approach combining conventional hacking with AI agents. Experts suspected a link to China, although neither Taiwanese authorities nor Dream publicly confirmed who was responsible.

That distinction matters.

It is tempting to describe the incident as an AI simply deciding to attack Taiwan on its own. That’s not what the available evidence shows.

Humans were behind the operation.

What changed was how much work could be handed over once the agents were running.

Instead of waiting for a person to manually inspect each result and decide what to try next, the agents could search for weaknesses, change their approach when something failed and continue working through the target environment.

That starts to look very different from simply asking a chatbot to write malicious code.

Then a Ransomware Attack Took Less Than 10 Hours

The ransomware case documented by Unit 42 shows the same shift from another direction.

A human attacker used frontier AI models and an agentic attack framework during an intrusion into an enterprise network.

According to Unit 42’s account, AI agents performed reconnaissance and mapped internal services after access had been gained. Other agents searched code repositories and found hard-coded tokens and service passwords.

Those credentials helped the attackers reach more sensitive systems.

The operation eventually moved across cloud infrastructure, identity systems, CI/CD environments, containers and SaaS services.

All of that happened in less than 10 hours.

Unit 42 said comparable work would normally take human operators around two weeks.

And then came one of the stranger details.

The AI system generated an 80-page security audit for the victim, documenting dozens of weaknesses that had been exploited during the intrusion.

It sounds almost absurd: the same automated system helping compromise the company also produced something resembling a professional penetration-testing report.

But it says something important about these systems.

An AI agent doesn’t necessarily need a completely new hacking technique to change cybersecurity. It can become dangerous simply by performing familiar tasks much faster, continuously and across several parts of a network at once.

That’s the Part Security Teams Should Be Watching

Cybersecurity has always been a race against time.

A vulnerability becomes known. A company assesses the risk. A patch is tested. IT teams schedule deployment. Security tools watch for suspicious activity in the meantime.

That process assumes there is some time between discovering a weakness and seeing it used at scale.

AI can squeeze that window.

The Unit 42 attack didn’t depend on some previously unimaginable hacking technique. The agents performed recognizable tasks such as reconnaissance, credential discovery, cloud access and movement across the victim’s environment.

What changed was the pace.

A job that might have occupied human operators for days could be compressed into hours.

That leaves defenders with much less time to notice one stage of an intrusion before the attacker has already moved to the next.

The U.S. Government Is Already Shortening Some Patch Deadlines

This isn’t only an industry discussion.

In June, the U.S. Cybersecurity and Infrastructure Security Agency introduced a new approach for federal agencies that prioritizes vulnerabilities according to factors such as whether they are exposed to the internet, already being exploited or easy for attackers to automate.

Under the directive, the most serious vulnerabilities can carry remediation deadlines as short as three days, while lower-priority issues can have deadlines of up to 60 days.

CISA specifically pointed to a threat environment in which AI services can help attackers find and exploit vulnerabilities faster.

That doesn’t mean every software flaw suddenly needs to be fixed within 72 hours.

It does mean the old habit of treating patching as a predictable monthly exercise is becoming harder to defend for systems facing serious, actively exploitable vulnerabilities.

Attackers aren’t necessarily working on the same timetable.

A Recent JFrog Flaw Shows How Quickly Things Can Move

There is already a good example of that pressure.

JFrog disclosed a critical authentication weakness in Artifactory on August 28. The vulnerability, tracked as CVE-2026-82329, could allow an unauthenticated attacker with network access to obtain administrative privileges under affected configurations.

By September 1, watchTowr researchers were observing attackers exploiting vulnerable internet-facing systems.

That’s roughly four days between public disclosure and observed exploitation.

This attack wasn’t necessarily driven by autonomous AI.

That’s important not to imply.

But it shows the environment AI agents are entering: newly disclosed vulnerabilities can already move into real-world exploitation very quickly. Giving attackers better automated reconnaissance and decision-making tools could make those windows even tighter.

Defenders Are Turning to AI Too

The obvious response to machine-speed attacks is to give defenders more automation of their own.

Google launched its Fairwind Program in September, giving selected government agencies, Google Cloud customers and cybersecurity partners access to advanced AI capabilities designed to autonomously find and help fix vulnerabilities.

The company has also been developing broader AI-powered security systems intended to prioritize risks and accelerate remediation.

Anthropic is approaching the problem from another side.

Its Enterprise Frontier Safeguards, announced on September 1, combines zero-data-retention options with automated systems designed to detect misuse of frontier AI models. The system is being developed with customers across industries including finance, healthcare, manufacturing, telecom and the public sector.

None of this means AI defense automatically solves AI-enabled hacking.

It does suggest where cybersecurity is heading.

Attackers automate reconnaissance and exploitation.

Defenders automate detection and containment.

The gap between those two systems may increasingly matter more than how quickly a human analyst can manually respond.

Businesses Don’t Need to Wait for a Science-Fiction Attack

For most companies, the useful lesson here isn’t to start preparing for an AI superintelligence breaking into the network.

The immediate risks are much more ordinary.

Weak credentials are still weak credentials.

Exposed APIs are still dangerous.

Secrets left inside code repositories can still be stolen.

Unpatched software can still provide an entry point.

Overprivileged accounts can still turn a small breach into a much larger one.

AI agents simply make it possible to search for some of those weaknesses faster and keep working through them without needing a person to make every small decision.

That changes what “fast enough” means for defenders.

A critical internet-facing vulnerability that once sat in a patch queue for a week may deserve a very different response when automated systems can discover and test it continuously.

The same applies after an intrusion begins. If an attacker can move across identity, cloud and development infrastructure in hours, manually responding to each compromised system one at a time may be too slow.

Unit 42’s advice reflects that problem: organizations should consider automated playbooks capable of revoking credentials, terminating sessions, freezing compromised development pipelines and isolating cloud accounts at the same time.

We Haven’t Seen the Final Form of AI Hacking Yet

There are still relatively few publicly documented cases at this level.

That matters.

Two high-profile incidents don’t prove that every cybercriminal has suddenly replaced a hacking team with autonomous agents. Nor do they mean humans have disappeared from cyberattacks.

In the Unit 42 ransomware case, there was clearly a human attacker.

Even the Taiwan incident involved a broader operation in which people remained responsible for initiating the campaign.

But humans no longer have to perform every step themselves.

That’s the change worth paying attention to.

Cybersecurity teams have spent years preparing for attackers who can work faster with AI.

Now they also have to prepare for software that can keep investigating, testing, deciding and moving while the person behind the attack steps further away from the keyboard.

The biggest change may not be that AI knows some completely new way to hack a network.

It’s that the same attack can happen before the defenders have had enough time to catch up.