Kill Chain on Autopilot

Kill Chain on Autopilot:

How Four Threat Actors Delegated Intrusion Operations to AI Agents

CrowdStrike Intelligence recovered conversation histories, agent configurations, playbooks, and tooling from four previously unreported threat actors who independently weaponized agentic AI to conduct autonomous intrusion campaigns against government, healthcare, and private-sector targets across nine countries. These actors delegated entire kill chains to AI agents that autonomously performed reconnaissance, exploitation, lateral movement, and exfiltration with minimal to no human input. Eric Loui’s talk compares actors’ harness architectures and safety bypasses, walks through specific steps taken by agents during intrusions, and addresses what this shift means for defenders.