Agentic hacking explained: anatomy of an AI-driven attack lifecycle

In November 2025, Anthropic disclosed GTG-1002, an espionage campaign in which an AI system carried out most of the intrusion work itself: running reconnaissance, harvesting credentials, and moving between systems, with a human operator stepping in only at a few decision points. The reconnaissance-to-target sequence that once took a red team days compressed into a near-continuous, machine-speed workflow. That is what separates agentic hacking from earlier automation. Rather than executing a fixed script, an AI agent continuously evaluates what it finds, adapts its strategy, and chains reconnaissance, credential abuse, and lateral movement into a single adaptive attack.

At a glance

• Agentic hacking chains multiple MITRE ATT&CK techniques into a single adaptive workflow, spanning reconnaissance (TA0043), credential access (TA0006), lateral movement (TA0008), and privilege escalation (TA0004).
• Unlike scripted automation, AI agents continuously evaluate results and choose the next attack path based on what they discover.
• Traditional SIEM and EDR platforms excel at detecting individual techniques, but machine-speed attack chains can complete before correlated alerts provide sufficient context.
• Deception technology interrupts agentic attack chains by exposing malicious intent whenever an AI agent interacts with assets that legitimate users and systems should never access.
• 360 Deception disrupts approximately 20 MITRE ATT&CK techniques commonly used throughout agentic attack lifecycles.

For years, cyberattack automation has accelerated repetitive tasks such as password spraying, vulnerability scanning, and malware deployment. Those tools follow predefined instructions. When conditions change, they fail or require human intervention. Agentic hacking changes that model by giving AI agents the ability to evaluate outcomes, adapt their approach, and pursue objectives with minimal oversight.

The difference is not simply automation versus AI. It is continuous decision-making. Rather than following a fixed sequence of actions, an AI agent observes its environment, selects the most promising attack path, executes the next step, and reassesses the results. If a credential fails, it tries another. If one route for lateral movement is blocked, it finds an alternative. This ability to adapt transforms isolated attack techniques into a coordinated attack chain that progresses faster than traditional scripted automation.

An agentic AI combines passive and active reconnaissance into a continuous discovery process. It collects information from public sources and breach databases while probing exposed infrastructure for internet-facing services and misconfigurations. It reconstructs organizational hierarchies, identifies privileged users, correlates leaked credentials with active accounts, and prioritizes the most promising attack paths.

Adaptive reconnaissance accelerates the attack

Unlike scripted reconnaissance tools, an AI agent continuously reprioritizes its attack plan as new information emerges. An exposed VPN gateway may shift its focus toward credential attacks, while a weakly secured development environment may become the preferred entry point. Once promising attack paths are identified, the agent moves directly into credential acquisition and initial access. Past worm-scale ransomware campaigns showed how quickly propagation can follow discovery of reachable systems. Agentic hacking compresses that same pattern into an adaptive loop, where rapid reconnaissance determines which paths the agent tests next.

With the environment mapped, the next objective is obtaining valid credentials. In the MITRE ATT&CK Credential Access tactic (TA0006), agentic AI shifts from discovery to exploitation.

AI agents orchestrate credential stuffing, password spraying, phishing, MFA fatigue attacks, and token harvesting simultaneously. As results come in, they abandon unsuccessful techniques and redirect their efforts toward more promising targets.

Why valid credentials are difficult to detect

Because these attacks rely on legitimate identities rather than malware, successful authentication events are difficult for identity and access management (IAM) and privileged access management (PAM) platforms to distinguish from normal user activity. Even with risk-based authentication, attackers using valid credentials may remain below alert thresholds until they begin abusing those privileges.

Honeytokens expose credential misuse early

Deception provides a different layer of visibility. Honeytokens placed in credential stores, configuration files, CI/CD pipelines, password vaults, or cloud environments should never be accessed during legitimate operations. This is the intent principle at work: why did anything touch an asset no legitimate process should need? Any authentication attempt against them produces a high-confidence signal of intent before an attacker establishes a meaningful foothold. Unlike hand-built, hand-fed decoys that cannot keep pace at machine speed, these are deployed and refreshed autonomously, which is the entry requirement for defending against agentic attacks.

Industry research indicates that approximately 60% of intrusions involve lateral movement before detection. In the MITRE ATT&CK Lateral Movement tactic (TA0008), AI agents continuously evaluate the network, identifying trust relationships, shared credentials, administrative privileges, and accessible systems to reach higher-value assets. If one route is blocked, they immediately recalculate and pivot using trusted administrative tools.

Why lateral movement often outpaces detection

An AI agent can complete multiple pivots before correlation engines connect isolated authentication events, administrative logins, and remote management activity into a single attack. While defenders investigate individual techniques, the attack continues toward higher-value systems.

HoneyPaths show movement between systems

HoneyPaths place deceptive systems, credentials, shares, and network artifacts along likely traversal routes. Any interaction generates a high-confidence signal, helping defenders interrupt lateral movement before critical systems are reached.

In the MITRE ATT&CK Privilege Escalation tactic (TA0004), agentic AI evaluates multiple paths to administrative access. It may impersonate authentication tokens, perform Kerberoasting attacks, abuse excessive cloud permissions, or exploit overprivileged service accounts. This focus on identities reflects a broader shift in enterprise security. Identity has become the primary path attackers automate against, which is why privilege escalation so often runs through tokens, Kerberos tickets, and overprivileged service accounts rather than software exploits.

The shrinking response window

By this stage, defenders have little time to react. AI agents can rapidly identify privileged accounts, validate access, and begin executing their objective before security teams correlate the events leading to compromise.

Layered deception creates multiple detection opportunities

Honeytokens expose credential theft, HoneyPaths reveal lateral movement, and deceptive systems and identities continue generating high-confidence signals as attackers search for administrative control. By the time an AI agent attempts privilege escalation, defenders have multiple opportunities to investigate and disrupt the attack.

Agentic attacks succeed because each decision builds on the last. Reconnaissance informs credential theft, valid credentials enable lateral movement, and lateral movement creates opportunities for privilege escalation. Breaking any link in that chain forces the AI agent to reassess its strategy, slowing the attack and increasing the likelihood of detection before objectives are achieved.

Rather than waiting for behavioral patterns to emerge, 360 Deception, the mechanism inside the ShadowPlex Preemptive Cybersecurity Platform, introduces uncertainty into the attacker’s decision-making process through three complementary deception strategies. 

Table 2: The three pillars of 360 Deception

Each strategy targets a different phase of the attack: deceptive systems and identities distort reconnaissance, honeytokens expose credential theft, and HoneyPaths reveal lateral movement. Instead of one alert at privilege escalation, defenders get a high-confidence signal of intent at every phase of the chain, adding fidelity to the stack rather than replacing it.

This layered approach complements existing SIEM, EDR, IAM, and XDR investments by providing earlier evidence of malicious intent rather than replacing established security controls. In the U.S. Navy ANTX FY25 exercise, 360 Deception delivered 100% true positive alerts and 80% denial of attacker objectives against automated, credential-driven techniques in the exercise.

Agentic hacking does not introduce new techniques. It compresses reconnaissance, credential abuse, lateral movement, and privilege escalation into a continuous attack chain. Traditional security controls remain essential, but deception strengthens those defenses by exposing malicious interactions before attackers achieve their objectives. Instead of reacting after privilege escalation or ransomware deployment, security teams gain earlier opportunities to investigate, contain, and disrupt adaptive attacks. The goal is to stop asking analysts to infer intent from weak evidence when the environment can produce a stronger signal.

Are you ready to see where agentic attacks could reach critical assets before detection? Request a 360 Deception Attack Path Assessment to identify hidden attack paths, validate existing security controls, and find where deception can provide earlier, high-confidence detection across the AI-driven attack lifecycle.