AI attack agents leave fingerprints defenders can read
Reviewing The Rise of Agentic Attacks: What They Look Like, and Where They're Headed · Avigayil Mechtinger
Researchers studying real intrusions find that attacks run by AI agents share four recurring traits: machine-paced but irregular activity, plans written in plain language, self-correcting tools and methodical breadth-first coverage. The speed that makes these agents dangerous also makes them noisy, which gives defenders something to hunt for, at least until attackers adapt.
In one intrusion the researchers investigated, the attacker produced 99 distinct scripts in roughly a day. No human writes that fast. No fixed scanner varies its output that much. Something was reading the results and writing the next tool.
That is the pattern this research tracks: attacks where an AI agent does the hands-on work while a human sets the goals and limits. The researchers draw on incident investigations and threat reports. These include campaigns run on off-the-shelf agent frameworks, ready-made toolkits that let an AI drive the attack, such as Hermes and ARTEX, the latter used against financial institutions and in a supply-chain compromise. They also include custom harnesses and at least one case where the tooling was never identified. One reported campaign tried sign-ins against more than 2,250 tenants and reached privileged cloud access in under three hours.
The mechanism is simple to describe. The agent runs a step, reads the response, decides what to try next and writes the code to do it. Reconnaissance, credential theft, lateral movement and exfiltration become one loop rather than a series of skilled human sessions. What used to need an experienced operator now needs someone to state an objective.
The speed is also the tell
The part I find most interesting is what that loop leaves behind. From three detailed case studies, the researchers distil four fingerprints. The cadence is machine-paced but irregular, unlike a person typing or a scanner on a timer. The tooling carries natural-language reasoning, with human-readable plans and captions sitting inside the scripts. Tools arrive in versioned ladders, each revising the last after a failure. And the coverage is breadth-first, working methodically through techniques instead of heading straight for the prize.
The second fingerprint is the gift. An agent that explains itself in comments leaves its plan on the disk. Defenders rarely get the attacker's reasoning in writing. Here it arrives with the payload.
These are detection heuristics, not a tested defence. The researchers say agentic attacks tend to be noisy, but telling them apart from legitimate automation means correlating several signals. Build pipelines and admin scripts also iterate quickly and adapt. The evidence varies too: the degree of autonomy and the strength of attribution differ between incidents, and some initial access vectors remain unknown.
Nobody tested these fingerprints against an attacker who knows about them. Stripping comments from generated code is one instruction. Adding jitter to the cadence is another. The structural signs are harder to hide, because breadth-first coverage and self-correcting ladders are how the agent works rather than how it writes. I would weight those more heavily.
If you hunt, look for bursts of fresh, slightly different scripts on one host, not just known tooling. For now the agents are fast, thorough and talkative. The talkative part is the easiest to fix.
