DIGGINGBEAGLE

Topic · DiggingBeagle record

Autonomous cyber operations

Multi-step offensive workflows where AI executes or orchestrates reconnaissance, exploitation, persistence or exfiltration with limited human intervention.

Topic kind
pattern

Definition & limits

Autonomy changes the cost and throughput of cyber operations. It does not by itself determine severity, attribution or novelty of the underlying exploit techniques.

Examples

  • GTG-20006 rebuilding malware after detection.
  • GTG-50020 parallel reconnaissance and exploitation agents.

Research using this topic (45)

AnalysisWhat changes when one operator can run a multi-agent attack loopAnalysisFrom finding to exploit: the new automated exploit loopAnalysisWhat AI-driven operations actually stole, exposed and changed in 2026CaseARTEX-assisted South Korean finance intrusion revealed through exposed attacker agent logsCaseOpen Cairn control panels let outsiders send tasks to pentesting agentsCaseGLM-5.3 chained a public Firefox patch clue with a sandbox bypass in a test labCaseGLM-5.3 completed several simulated cyber tasks and sometimes copied prohibited codeCaseNIK C2 used victim-host AI API access as an attacker-controlled capabilityCaseMicrosoft linked ARTEX agentic tooling to Onyx Sleet and Pearl Sleet activityCaseVAPOR PANDA used ARTEX agents in parallel intrusions; nine organizations had confirmed post-exploitationCaseCompromised Flowise became a staging point for adaptive scripts aimed at other serversCaseA Java gateway intrusion ran hundreds of adaptive post-exploitation checksCaseCARLIY0S orchestrated commercial AI models in a reported Latin American financial attack operationCaseNorForge exposes Cairn operation panels showing separate AI-assisted attack campaignsCaseWiz reconstructs an AI-directed intrusion crossing cloud, identity and delivery systemsCaseClaude Code intrusion into Argentine healthcareCaseClaude Code campaigns through a Chinese proxyCaseClaude Code intrusions using public skillsCaseClaude Code intrusions using a seven-stage workflowCaseStorm-0940 used ARTEX and stolen ConnectWise application credentials