Autonomous Cyberattacks Are Here, but How Effective Are They?

AI agents can now break into systems, steal credentials and carry out cyberattacks with very little help from humans. But just because an AI agent can launch an attack doesn't mean it can successfully finish the job. Some autonomous cyberattacks have managed to break into multiple systems and steal valuable information. 

Others have spent days looking for weaknesses and trying different approaches without achieving what the attacker wanted. And for businesses trying to protect themselves, understanding the difference is becoming increasingly important. In November 2026, Check Point Research published an investigation into real cybercriminals using autonomous AI agents. 

The findings showed just how much these agents can do on their own, but also revealed some fairly serious limitations. So, how effective are autonomous cyberattacks really? And what do businesses need to know about the risks they pose?

What Makes a Cyberattack Autonomous?

An autonomous cyberattack is a cyberattack where AI agents can plan and carry out several steps without someone telling them exactly what to do at every stage. For example, an attacker might tell an AI agent to steal login details or break into a particular server. Instead of giving it instructions for every action, they leave the agent to figure out how to do it. 

This is different from simply using AI to write malicious code or find a security weakness. An autonomous agent can choose which tools to use, try different ways of breaking into a system, check what happened and change its approach if something doesn't work. Of course, that doesn't mean humans aren't involved at all. 

Attackers still decide what they want to achieve, choose targets and sometimes step in when the AI needs help. The difference is how much of the work the agent can do without them. In its October investigation into AI-powered hacking tools, Google Threat Intelligence Group and Mandiant reported seeing attackers use tools such as ARTEX, PentAGI and CAIRN in real cyberattacks. 

These tools allow AI agents to work through different parts of an attack, from finding weaknesses to gaining access and moving between systems. But being autonomous doesn't necessarily make an attack more advanced. Google and Mandiant found that many of these attacks still relied on familiar problems, such as stolen passwords and systems that weren't properly secured. 

The methods aren't always new. What's changing is how much of the work attackers can hand over to AI.

How Effective Are Autonomous Cyberattacks in Practice?

One of the clearest examples comes from Check Point Research's investigation into ARTEX cybercrime campaigns, published on 5 November 2026. ARTEX was originally developed as an AI-powered -testing platform. In other words, it's a tool designed to help security professionals find weaknesses in systems before criminals can take advantage of them. 

But cybercriminals have also started using it to launch attacks. Check Point found ten ARTEX installations that had accidentally left their databases exposed. This gave researchers access to the instructions attackers had given their agents, what those agents did and what happened during the attacks. 

The agents could carry out much of the work without constant human direction. But when researchers looked at the results, they found that some attacks were far more successful than others.

Where autonomous attacks succeeded

In one case, an attacker used ARTEX to target ten services that sold certificates used to sign iOS applications. These certificates help identify who created an app, and stolen ones can potentially be misused or sold. The attacker wanted the agents to steal the certificates and their passwords. 

Over roughly two weeks, the agents broke into systems and collected more than 300 certificates with their associated passwords. But there was a catch. When the attacker checked whether the certificates could actually be used, only three passed the necessary checks. 

So, while the agents had successfully stolen a large amount of information, very little of it turned out to be useful for what the attacker wanted. Another attacker used ARTEX to target services involved in trading stolen gaming accounts. Over five days, the agents collected more than 190,000 sets of login details linked to the mobile game Honor of Kings. 

However, testing suggested that only around 3.3 per cent were still valid. That worked out to an estimated 6,000 accounts that could potentially still be accessed. Both cases show that autonomous agents can do more than simply find possible security weaknesses. They can break into real systems and steal information without someone constantly guiding them.

Where AI agents failed

Other attacks were considerably less successful. In one campaign, an attacker told ARTEX agents to break into cryptocurrency services, steal money and redirect future payments into a wallet they controlled. The agents spent four days investigating different targets and trying ways to get what they wanted. 

Across 292 campaign objectives, they produced 230 findings and more than 400,000 messages. They found security weaknesses, accessed databases and even changed part of a system used to distribute software. But despite all that activity, Check Point couldn't find any cryptocurrency payments reaching the attacker's wallet. 

Some of the agents also claimed they'd succeeded when they hadn't. In certain cases, they received a response from a system that appeared to confirm an action had worked, and treated that as proof that the money had been transferred. They hadn't actually checked whether the attacker received anything. 

It's worth remembering, though, that failing to steal the money doesn't mean the attack was harmless. Some of the targeted systems had still been compromised, even if the attacker didn't get the result they wanted.

Why finding a weakness isn't the same as winning

These examples show why it's difficult to judge how effective autonomous cyberattacks are by simply counting how many weaknesses an AI agent finds or how many systems it manages to access. There are several different things an agent might achieve during an attack:

• Finding a weakness: The agent discovers a security flaw, exposed password or possible way into a system.
• Exploiting the weakness: It successfully uses that weakness to get access or do something it shouldn't be allowed to do.
• Compromising a system: It manages to access systems, steal information or gain some level of control.
• Achieving the attacker's objective: It actually gets what the attacker wanted, whether that's usable login details, stolen money or something else.

An agent might manage the first three without ever completing the fourth. It could also cause damage that the attacker hadn't originally planned. This is why claims about AI attack success rates need some context. What exactly counts as a successful attack? Check Point's research gives us real examples of what autonomous agents can and can't do. 

But the ten exposed databases don't represent every autonomous attack happening around the world, so we can't use them to calculate how often these attacks succeed overall. What we can see is that even agents that make mistakes can still cause serious security problems.

How Autonomous Attacks Change Enterprise Exposure

An AI agent doesn't have to get everything right to be dangerous. It can keep trying different approaches, investigate several targets and carry on working while the person behind the attack does something else. For businesses, that means dealing with attacks that can happen faster and involve far more attempts than a person could easily manage alone.

Attacks can move faster than defenders respond

In November 2026, Microsoft Threat Intelligence reported on attackers using AI agents to abuse exposed credentials. The attackers used AI agents to search public GitHub repositories for passwords, application credentials and other sensitive information that developers had accidentally included in their code. 

Once the agents found those details, they could try using them to access the company's cloud services. In one case, an agent went from searching GitHub for exposed credentials to stealing information from Azure Key Vault in just five minutes. Azure Key Vault is a Microsoft service businesses use to store sensitive information, including passwords, encryption keys and application credentials. 

If attackers get access to those details, they may be able to use them to break into other connected systems. Microsoft also saw agents changing their requests when something went wrong. Rather than waiting for a human to work out why an attempt had failed, they tried different settings and managed to access resources within seconds or minutes. 

That gives security teams very little time to notice what's happening and stop it.

Automation changes the cost of trying again

Speed is only part of the problem. AI agents can also make it easier for attackers to keep trying, even when most of their attempts don't work. Check Point estimated that the two-week certificate theft campaign cost the attacker between $700 and $1,500 in AI model API charges. The five-day gaming account campaign cost an estimated $180 to $360.

 These figures only cover the estimated cost of using the AI models. They don't include everything else an attacker might need, and they don't tell us what an average cyberattack costs. Still, they show how much work an attacker can get an AI system to do without having to personally manage every step. 

Google Threat Intelligence Group also reported on an AI-assisted credential-stealing campaign that attackers planned, built and carried out in under six hours during the second quarter of 2026. And when attackers can keep testing different ways into a system without spending hours doing the work themselves, even approaches that usually fail become easier to try. 

For security teams, this could mean more attacks to deal with, attackers changing their methods more quickly and less time to respond when something does work.

What Should Enterprises Change in Response?

The good news is that autonomous cyberattacks don't suddenly make existing security measures useless. Many of the attacks researchers have observed still take advantage of familiar weaknesses that businesses already know how to fix. 

The challenge is making sure those protections are actually working, and that security teams can respond quickly enough when something goes wrong.

Reduce the access an agent can exploit

Microsoft's research shows how much trouble a single exposed application credential can cause. Applications use credentials to prove who they are when connecting to other services. If an attacker steals those details, they may be able to access the same services and information as the legitimate application. 

And if that application has permission to access several different systems, one stolen credential could give the attacker several ways to get further into the business. Companies need to know where their application credentials are stored, which systems they can access and whether they've been given more permissions than they actually need. 

That includes checking software code for accidentally exposed credentials, replacing any that have been compromised and limiting what each application is allowed to do. It's also important to remember that deleting an exposed password from a public repository doesn't make it safe again. 

Someone may already have copied it, so the credential needs to be changed or disabled.

Detect attack behaviour, not just known tools

Security teams often look for signs of an attack, such as suspicious IP addresses or software that's known to be malicious. Those warning signs are still useful, but they won't always be enough when AI agents can change how they behave. Microsoft saw agents retrying requests with different settings after something failed. 

It also warned that attackers can change the network addresses and other details used to identify their tools. This is where behavioural threat detection becomes particularly useful. Rather than only looking for a specific hacking tool, security systems can watch for unusual activity that suggests someone is trying to break in. For example:

• Large numbers of requests being made in a short time.
• Several failed attempts followed by successful access.
• Applications signing into services they don't normally use.
• Unexpected attempts to access passwords or other sensitive information.

Of course, unusual activity doesn't automatically mean an attack is happening. Legitimate systems can behave unexpectedly too, so security teams still need to understand what's normal for their environment. But looking at what an attacker is doing, rather than just which tool they're using, can make suspicious activity easier to spot.

Test whether controls can interrupt an attack

Spotting an attack is one thing. Stopping it before serious damage is done is another. For example, imagine an AI agent manages to steal an application's login details.

• Can it immediately use those details to access sensitive information?
• Could it get into other connected services?
• And how quickly could the security team block that access?

These are questions businesses can answer by testing their security systems in controlled, authorised exercises. The results can show whether access permissions are too broad, whether suspicious behaviour is being picked up and how quickly the organisation can respond. Response times are particularly important. 

If an attacker can move from finding a password to stealing sensitive information in minutes, waiting for several people to approve an action before blocking access could leave the door open for too long. Automated security responses can help, but they need sensible limits. Accidentally blocking a legitimate business application could cause problems of its own. 

The aim isn't to let security software make every decision. It's to work out which actions can happen safely and immediately, which need human approval and whether those processes are fast enough to stop an attack before it spreads.

Final Thoughts: Autonomous Doesn't Mean Unstoppable

Autonomous cyberattacks can already break into real systems, steal credentials and carry out attacks with very little help from humans. But the research also shows that AI agents make mistakes, misunderstand results and sometimes fail to get what their operators wanted.

 For businesses, those weaknesses are useful to understand because they show where attacks can still be stopped. There's no need to imagine a future where AI hackers never make mistakes when today's agents can already take advantage of security problems that haven't been fixed. 

And as these tools improve, the bigger question may not be whether an attacker can get into a system, but how much they can do before anyone notices. With that time getting shorter in some attacks, understanding how cyber threats are changing is becoming an important part of deciding where to focus security efforts. 

EM360Tech continues to look at those changes and what they mean for the people responsible for keeping enterprise systems and data safe.