AI agents have demonstrated hacking capabilities, enabling attackers to exploit vulnerabilities rapidly and introduce new data integration channels that can be abused, and they create non-human identities that bypass static security policies.

Matt Hartman, former acting head of the US Cybersecurity and Infrastructure Security Agency, said agentic AI poses significant risk and that organizations should treat each agent as a privileged identity. He noted increasing AI‑amplified identity and social engineering attacks, including personalized phishing and automated reconnaissance, which undermine traditional trust indicators.

Defense recommendations include strong identity management, phishing‑resistant authentication, behavioral monitoring and zero‑trust principles.

Rob Joyce, former NSA cyber chief, said that if organizations do not use AI agents to test their own systems, adversaries will. Hartman added that a growing market exists for continuous, AI‑native automated red‑team and pen‑testing solutions.

Armadin, a startup founded by former Mandiant executive Evan Peña, has built autonomous attacker swarms that operate continuously to simulate adversaries. In a three‑day controlled exercise with Tenex.ai, the swarm performed 17 million offensive actions, identified 38 validated attack paths and produced 238 security findings, tasks that would have required roughly 2,400 hours for a five‑person analyst team.

Peña said AI agents can operate without rest, providing continuous coverage and expertise that exceeds human‑only assessments. The agents are pre‑trained on coding, source‑code review, application security and network configuration, and then refined with human expertise. This approach allows coverage of all external systems within hours instead of months.

Armadin has discovered over 50 high‑impact zero‑day vulnerabilities that enable remote code execution on target systems.

Analysts note that annual or quarterly manual penetration tests are insufficient given AI‑driven speed and scope. Jay Bavisi of EC‑Council said large organizations typically conduct pen‑tests once a year for compliance, while more mature firms run them quarterly; both are limited by human speed and scope. AI automates reconnaissance, vulnerability identification and exploitation, addressing speed and breadth concerns.

Bavisi added that pen‑testers will not disappear but will evolve, requiring reskilling to assess business impact and to test large language models and agent behavior. Offensive AI security professionals will be needed to evaluate AI system robustness and guardrails.