One Prompt, Full Attack Chain: How Attacks Became Agentic
Attackers Have Gone Agentic
Over the past year, AI has given attackers three advantages: speed measured in seconds, scale measured in thousands, and a skills barrier that has functionally disappeared.
AI is now facilitating attacker tradecraft across the board: phishing, malicious tooling, social engineering, identity fraud, and initial access.
60 seconds
Shortest observed gap from AI-assisted web-shell upload to first reconnaissance command
30–40 domains
Device-code phishing domains spun up in parallel clusters simultaneously, with HTML containing AI-generation fingerprints
6–8 hosts
Identical AI-written web shells deployed within hours in a single campaign, with randomized filenames masking shared source code
Thousands
Phishing pages mass-produced in a single AI-assisted campaign, each paired with themed domains and tracking identifiers
How Did This Happen?
Defenders live in a different reality. Adopting new technology inside an enterprise means evaluation, integration, approval, and testing—for good reason. But that gap between when a capability becomes available and when a defender can safely put it to work is precisely the window attackers have spent the last two years exploiting. AI didn’t advantage the attacker because it was built for offense. It advantaged the attacker because the attacker could adopt it first.
The clearest evidence is in the numbers. A few years ago, the average breakout time, the gap between an attacker gaining initial access and beginning to move laterally through a network, was measured in hours. Today, with AI accelerating reconnaissance, credential harvesting, and lateral movement, that same breakout is happening in minutes. The execution speed changed, because the manual steps that used to take an operator hours of skilled effort are now automated, chained, and run at machine speed.
That’s the shift. Not a new kind of attack, but the same attacks, executed faster than human-paced defense was ever designed to answer. It happened for one simple reason: the technology was available to everyone, and the attacker had nothing standing between them and using it.
The Techniques AI Is Accelerating Right Now
As we detailed in a 2026 ReliaQuest report, we saw attackers using AI to accelerate the following techniques over the last year. Human-speed defense is no longer competitive against machine-speed offense. The tradecraft itself isn’t new, but the cost and speed behind it are.
Phishing at Industrial Scale
Thousands of pages, polished English, automated chat—from non-English-speaking operators
Malicious Tooling Faster
AI-written web shells deployed across SAP systems within hours
Social Engineering Polish
Scaled vishing, branded subdomains, AI-filled infrastructure
Identity Fabrication
Disposable DPRK persona packages—AI resumes, deepfake interviews
Initial-Access Acceleration
AI junk code defeating static analysis; 30–40 domain device-code phishing
AI as the Lure
Claude-themed malware exploiting the gap between demand and safe install paths
What It Costs to Become Agentic
Assembling an agentic attack capability no longer requires a research budget or a skilled team. Dark-web marketplaces sell AI-generated malware, phishing kits, jailbroken models, and modular attack skills ready to plug into agentic frameworks.
Dark-web priceWhat it buys
A complete criminal AI toolkit costs less than a mid-range laptop.
Fight AI with AIWhat Works for the Opponent Also Works for the Defense
One Prompt. Parallel Execution. 7 Minutes.
AI is not an offensive technology that defenders happen to be victims of. It’s a capability. When the same capability is pointed the other way, it produces the same speed, scale, and collapse of the skills barrier for the defense. None of the AI advantages belong to the attacker.
ReliaQuest has proven that on both sides of the line.
The ReliaQuest offensive security team, using open-weight components, built and tested an agentic attack system in a single afternoon. One natural language instruction triggered a cascade: the system spawned, scaled, and executed on its own, mirroring ShinyHunters’ documented tradecraft—vishing a target, harvesting credentials, accessing file shares, and delivering extortion. Roughly two weeks of manual human operation compressed into one autonomous workflow that finished in seven minutes.
Manual human operation
Roughly2Weeks
One autonomous workflow
7Minutes
That AI power was built into the GreyMatter platform so any security team can run it against themselves. It works the way the attacker’s system works, because that architecture produces the advantage. It decomposes any objective into single-purpose agents, with each task routed to the agent built for it. A detection engineering objective doesn’t go to one agent. One builds the logic, another deploys it, and another validates coverage. When the system hits a capability it doesn’t have mid-workflow, it spins up a new agent and replans around the obstacle. The speed and the scale come from the same place as the attacker’s.
Underneath it, an AI model brokerage layer selects the best model for every individual task based on speed, cost, and accuracy. Lightweight work runs on efficient models, and hard problems get premium reasoning. No single model handles everything. Instead, the right model handles each thing, making running AI at attacker volume sustainable instead of ruinous.
The advantage the defender gets that the attacker will never have is that they know their environment. Attackers probe a building they’ve never been inside, guessing where the doors are. Defenders have the blueprint. When you point the same frontier and open-source models at your own environment—including your context, asset knowledge, and history—you match their speed and see further than they can, because you’re not guessing.
Attackers Have Gone Agentic, but Defenders Can Do the Same.
Put the same AI accelerating the attacker into the hands of the defender, across detection, investigation, hunting, and response for an advantage over the opponent.