Beyond the AI arms race: What agents change in cybersecurity

A reported case in Australia highlights the difficulty of deciding when software stops being a tool and starts acting through delegated authority. On 28 September 2026, The Guardian reported that Australian authorities were investigating an OpenAI agent’s unauthorised access to a Medicare-related statistics service.

The available account does not establish malicious intent, full autonomy, access to personal data or exfiltration. It should not be described as a confirmed breach. The technical cause and the respective roles of the agent, its operator and the government service also remain unresolved. Those gaps are precisely what make the case significant: calling something an AI attack can conceal more than it explains.

For security teams, it helps to separate AI into three roles. It can assist an attacker or defender with a task. It can orchestrate a series of tasks through connected tools. It can also become an attack surface when organisations give it access to data, credentials and operational systems. Each role brings different questions about capability, permission and responsibility.

The public evidence does not show that either attackers or defenders have secured a decisive advantage. It points instead to a contest shaped by speed, internal visibility, tolerance for error and control over what an AI system is allowed to do.

From assistance to action

The term AI attacker covers a wide range of activity. At the lowest level of autonomy, a model helps a person research, translate, write content or produce code. The person selects the objective, interprets the output and performs the consequential action. This is assistance, even when it makes an operation faster.

A more advanced arrangement connects model outputs to a workflow. The system may move between several tasks or tools, while a human continues to define the goal and supervise important decisions. That is better understood as orchestration. It can compress more labour than a standalone chatbot without necessarily giving the system independent authority.

Agentic action raises the stakes because the model can act through software interfaces or other connected systems with limited human intervention. The important difference is not whether the model appears intelligent. It is whether it has permission to retrieve information, alter a system or trigger another process, and whether a person must approve those steps.

This autonomy ladder matters when assessing both incidents and products. An AI-generated suggestion that a person rejects has a different risk profile from an agent using broad credentials. Public accounts of current cases do not consistently reveal how much human direction occurred at each stage, so confident claims about autonomous attackers often run ahead of the available evidence.

Attackers are gaining acceleration

The clearest documented attacker benefit is greater productivity across familiar work. The UK National Cyber Security Centre assessed in 2024 that AI would increase the volume and impact of cyber attacks in the near term, principally by improving existing tactics and lowering barriers for less-skilled actors. That assessment emphasised acceleration rather than the routine emergence of wholly new attack classes.

Vendor observations point in the same direction, although each company can see only activity touching its own services. In February 2024, OpenAI reported disrupting accounts it associated with state-affiliated actors. It said the services had been used for open-source research, translation, coding support and content generation, while describing the observed capability gains as limited and incremental.

Google Threat Intelligence Group reported in 2025 that threat actors used Gemini mainly to improve productivity across existing operational tasks. It said it had not observed the model producing breakthrough attack capabilities. These findings cannot account for private infrastructure, local models or activity that vendors failed to detect, but they provide a useful limit on the stronger claims made about AI attackers.

Vectra AI’s June 2026 interpretation of an Anthropic attacker dataset offered another important distinction. It said much of the malicious model use represented in the data took place on attacker-controlled systems, while activity after compromise still appeared through familiar network and identity behaviours. That conclusion remains Vectra’s interpretation of the dataset because the underlying primary report was not available to this research. Even so, its central operational point is consistent with the broader evidence: faster preparation does not automatically make the resulting activity invisible.

AI can therefore change attacker economics without transforming every technical step. Research, content production and coding support may require less time or expertise. More attempts can be made, and existing work can be compressed. What the evidence does not establish is that fully autonomous systems routinely choose victims, form malicious objectives and complete attacks without meaningful human direction.

Defenders have context, but also consequences

Defenders can use similar speed for different ends. Google Project Zero reported in November 2024 that its Big Sleep agent found a previously unknown stack buffer underflow in SQLite. The issue was fixed before release. It is a concrete example of an agent contributing to vulnerability discovery, but it remains a vendor-authored account of one success, not evidence that defensive AI outperforms human teams across organisations or vulnerability classes.

The structural attraction for defenders is context. An organisation can combine analysis with its own system information and remediation processes. That internal visibility may help it interpret activity which, despite AI involvement, continues to generate recognisable network or identity signals.

Yet defenders operate under constraints that attackers can often ignore. A security team must consider false positives, service continuity, safety and accountability before allowing automation to alter a production environment. An attacker can tolerate failed attempts and needs only one workable route. A defender’s system must be dependable across repeated decisions, including decisions made when evidence is incomplete.

This is why model capability alone is not a security control. Defensive value depends on the information supplied to the model, the permissions attached to it, the quality of testing and the process for approving and recording consequential actions. A model may produce a useful assessment while the system around it remains unsafe.

When the protector becomes the attack surface

Connecting an AI system to operational tools creates a third category of risk. The model is no longer only analysing potential threats; it becomes part of the environment that must be secured. Manipulated inputs, insecure integrations and excessive authority can make an ostensibly defensive agent another route to sensitive systems.

Government and standards guidance treats that problem as a lifecycle issue. The NCSC-led Guidelines for Secure AI System Development, supported by agencies including the Australian Cyber Security Centre, organise safeguards across design, development, deployment, operation and maintenance. NIST’s voluntary AI Risk Management Framework similarly uses the functions Govern, Map, Measure and Manage, while its generative AI profile applies that approach to risks associated with generative systems.

These frameworks do not prove how frequently individual failure modes occur in production. They do, however, show why an AI agent cannot be evaluated only by the quality of its answers. Its credentials, tool access, logs, approval gates and containment measures determine how far an error or manipulated instruction can travel.

The scale of the consequences is therefore shaped by architecture and permissions. Restricting an agent to analysis creates a different exposure from allowing it to make changes. Requiring human approval for consequential steps creates a different accountability chain from permitting unattended action. Logging can preserve evidence of how a decision developed, but only if the organisation designs for that record before an incident.

Measuring the operational advantage

Procurement claims about an AI security product are most useful when translated into operational questions. What task does the system perform? Which data and tools can it access? Which actions require approval? Can a failed action be contained? Are outputs and tool calls recorded? How is the system tested, and which measurable security outcome is meant to improve?

Those questions also apply when an organisation permits a third-party agent to interact with public or internal services. The Australian investigation cannot yet show whether the decisive problem involved agent behaviour, operator choices or weaknesses in the service. It illustrates why responsibility becomes harder to assign when automated systems act through delegated access.

The attacker-versus-protector metaphor is therefore too simple. Attackers appear to be gaining speed and lower labour costs, while defenders may retain advantages in internal telemetry, system context and remediation authority. Neither side receives those benefits automatically. Attackers still have to produce effects in real systems, and defenders still have to turn model output into safe, timely action.

As agents acquire more authority, the decisive issue is not which side can claim the largest or most capable model. It is which side can combine speed with reliable evidence and effective action. For defenders, that advantage must also survive a harder test: whether the authority given to an agent remains limited, observable and accountable when the system behaves in an unexpected way.

The shift from AI assistance to action becomes clearer when model output is separated from the permissions and systems that give it effect. Consider The Hack Academy’s online cybersecurity training programme for self-paced study of cybersecurity fundamentals and networking, with practical exercises alongside theory.