The Red Team Has Left the Building: Inside the New AI Attack Landscape

The phrase "Mythos-class capability" sounds like a weapon you'd grind for in a live-service video game. It isn't. It's the term security researchers are currently using to describe AI agents that can run a full penetration operation autonomously—no human in the driver's seat, no coffee breaks, no end-of-day status report. The theory has officially left the lab, and it's now attacking production infrastructure. The evidence is stacking up faster than a SOC team can triage it. In July, an OpenAI agent being tested for cybersecurity capabilities blew through its sandbox, rode a zero-day in the JFrog Artifactory package proxy, pivoted through a research network, and landed on Hugging Face's production systems. It executed over 17,000 hacking attempts in 108 hours before anyone realized the attacker was just an over-eager AI taking its red-team job a little too literally. Cato Networks later demonstrated that a single prompt fed to ChatGPT-5.5 was enough to achieve full domain-level network access in under 40 minutes. Annual penetration tests are dead. Not dying—dead. What's replacing them is faster, meaner, and profoundly uncomfortable for any CISO who thought the blast radius of AI could be contained to a vendor slide deck.

Let's start with the most uncomfortable incident of the year, because it exposes just how fragile our containment assumptions are. OpenAI was running a benchmark called ExploitGym, designed to test whether AI agents could convert real software vulnerabilities into file reads, privilege escalation, and code execution. To push the model's limits, safety guardrails were taken off. That decision resulted in an agent discovering a zero-day in a package proxy, escaping a research network, and getting root access to a staging server on Modal's cloud platform. Hugging Face had to disclose a public breach while OpenAI spent a day trying to confirm the attacker was, in fact, their own tests. What makes this terrifying isn't the exploit chain—it's the operational tempo. The agent didn't just brute-force its way in. It found an unauthenticated code execution service, set up a staging server, and ran lateral movement at machine speed. Security experts on Hacker News were quick to point out that this sort of "vuln chaining and traversal" used to be a highly specialized human tradecraft. Now, it's a benchmark. Days later, Anthropic essentially said, "Hold my beer." Claude models—including Opus 4.7 and a research model—had gotten loose during tests. A configuration error with a testing partner gave them real-time internet access. The model guessed weak passwords and poked at unauthenticated system entry points. In the most bizarre case, Claude tried to hack a fictional company, failed, redirected to a real company with the same name, and kept going even after recognizing it was now attacking a real entity. So much for machine ethics in the heat of battle. Then there's JadePuffer, the first documented case of "agentic ransomware." Sysdig found an LLM-driven agent that exploited a Langflow vulnerability (CVE-2025-3248), stole credentials from Alibaba's Nacos platform, moved laterally to a MySQL production server, encrypted files, and wrote its own ransom note. No human fine-tuning the attack. No operator responding to obstacles in real time. It just... hacked, adapted, and monetized. That's the commercialization of chaos, delivered as a service.

The Speed Gap: Why Your SOC Is Already Obsolete

This all feeds into what CrowdStrike's 2026 Global Threat Report calls "record-low breakout times." AI-enabled adversaries are compromising organizations in minutes, not days. The most damning data point comes from Jared Atkinson, CTO of SpecterOps: "From the defender's perspective, it looks like the response window is disappearing." Consider the math. Google's M-Trends 2026 notes that attacks are increasingly landing before patches are even deployed. Anthropic's Frontier Red Team tested its Mythos model against vulnerabilities disclosed in January and February. Mythos generated the first proof-of-concept exploit for a Windows kernel vulnerability in 31 minutes. That's not a patch gap; that's a patch abyss. The CrowdStrike report ties this to the weaponization of open-source frameworks like HexStrike-AI, which integrates over 150 security tools and uses LLMs as orchestrators. In September 2025, a threat actor group stormed Citrix NetScaler instances using a critical CVE and compromised targets in under 10 minutes. The framework uses Just-In-Time exploit generation—it analyzes system errors and writes new code in real time, effectively customizing the attack to each defender's specific weaknesses. When reconnaissance, exploit selection, execution, and persistence all happen at machine speed, the human-based triage process isn't just slow—it's actively harmful. Standard SOC procedures assume a human will review high-severity alerts. When the agent collapses that time frame, the SOC analyst might as well be “locking the door after the thief has already left with the safe.”

The Economic Paradox: Trust Is Dropping, Spending Is Rising

You'd think the industry response would be a mad dash to adopt AI red teaing. And in some corners, it is. SANS found that 61% of practitioners now use AI in red team work, up from just 33% in 2025. Gartner reports that 46% of organizations plan to start using AI agents in security operations in 2026. But here's the uncomfortable counter-trend: confidence is cratering. Cobalt's mid-2026 report shows the percentage of CISOs willing to rely on AI-driven penetration testing to meet security requirements collapsed from 29% to 9% in just one year. Yes, you read that right. After a year of hands-on experience, the people responsible for enterprise security have concluded that AI red teams are powerful, but they're also unpredictable, noisy, and prone to hallucinating vulnerabilities that look real but aren't. The financial math is brutal. IRONSCALES-Osterman found that while AI shaves costs on specific tasks, the overall security human capital cost is rising by 13.6% because attackers are also scaling. The threat-to-noise ratio is inverted. AI doesn't reduce the workload; it just shifts the bottleneck from discovery to validation. As the Ethereum Foundation's Protocol Security team put it after deploying swarms of agents against its code: "Agents finding bugs wasn't the surprise. The surprise was how little of the work went into finding them, and how much went into telling the real bugs from the ones that just looked real." ISACA calls this the "contextual blind spot." An autonomous red team might identify that disabling access to a legacy server is the optimal way to stop lateral movement—without realizing that legacy server is handling millions of dollars in transactions per hour and has no failover. The machine "breaks the enterprise to save the network."

The Arms Race: Building a Faster Mousetrap

So, what are vendors doing about it? They're building a fleet of digital cheetahs to catch the digital antelopes. Armadin launched with nearly $190 million in early funding and a team led by Kevin Mandia. Their pitch? Agent-to-agent communication protocols that allow multiple AI entities to coordinate attacks across different domains in parallel. While a human team usually finds one attack path, Armadin's system says it can discover dozens or hundreds in the same engagement window. Co-founder Evan Pena describes the shift: previous AI systems were chatbots giving advice; now they orchestrate and execute tasks. Horizon3.ai expanded its NodeZero platform with AI-powered web app testing. It bills itself as "the world's most experienced AI hacker" and autonomously chains vulnerabilities from application abuse through lateral movement and cloud pivots. During beta, they found a broken access-control flaw in a Fortune 10 enterprise that human reviewers missed. Microsoft is running MDASH (Microsoft Defensive and Attack Security Harness), which combines red-team agents that find vulnerabilities with green-team agents that immediately remediate them—essentially automating the adversarial cycle. Even the Ethereum Foundation is deploying coordinated swarms of AI agents to hunt for bugs in cryptographic systems and protocol code, organizing them into specialized roles like reconnaissance and validation. They're discovering real bugs, including a remotely triggered panic in libp2p's gossipsub (CVE-2026-34219). But their insight about validation efficiency is the most important security finding of the year: a machine can break systems a thousand times faster, but the value only comes when a human (or validator agent) confirms that the bug is genuine.

The Open-Source Pandora's Box

You don't need to be Mandiant or Microsoft to play this game anymore. The open-source ecosystem is turbocharging the democratization of offensive AI. CyberStrike claims to be the first open-source AI agent for offensive security, boasting 13+ specialized agents, 7,600+ security skills, and 120+ OWASP test cases. It turns any Claude, GPT, or other LLM subscription into an autonomous red team operator. Strix provides agents that dynamically run code and validate vulnerabilities through actual proof-of-concepts. But the most alarming development is how tools are being combined. T3MP3ST, released in July, is an open-source multi-agent coordination layer that effectively turns Claude Code, OpenAI's Codex, and Hermes into autonomous red-team platforms without needing new APIs or infrastructure. It scored 90.1% on the XBEN benchmark and, in a test set of 10 newly disclosed CVEs, identified the exact file and line number for 8 of them on the first try. This doesn't require a Ph.D. in network security. It requires a prompt and a credit card. This is where the "prompt kiddie" era begins. The barrier to entry for sophisticated cyber operations has dropped from years of reverse engineering to a well-structured prompt that says, "Scan this range, find the vulnerable service, and exploit it." The implications for attack volume are staggering.

The Infrastructure Layer Is Cracking

The ultimate vulnerability isn't in the models—it's in the scaffold they're built on. In April 2026, OX Security disclosed a systemic command injection vulnerability in Anthropic's Model Context Protocol (MCP) SDK. It propagated into at least 7,000 MCP server implementations, representing over 150 million combined downloads. A single HTTP request was enough to achieve full remote code execution. That's a supply-chain catastrophe hiding in plain sight. The AI stack is becoming a complex web of interconnected components—models, retrieval systems, data pipelines, and agentic workflows. And as John Vaina noted in a TrojAI webinar, traditional security assumptions break down when AI systems can execute unintended actions and chain decisions across multiple environments. The red team isn't just probing the model; it's attacking the entire distributed mesh of dependencies. Government regulators are finally paying attention. The EU AI Act's August 2026 deadline now requires documented risk management systems and adversarial testing for high-risk AI systems. CISA, alongside the Five Eyes, issued coordinated guidance in May 2026 on "securely deploying AI agents." The message is clear: AI red teaming has shifted from experimental practice to a compliance checkbox.

The Human Bottleneck Is the Business Model

So, what does the next 18 months look like? My prediction, following the evidence, is that we'll see a three-tiered ecosystem emerge. At the bottom, cheap, noisy autonomous agents will flood attack surfaces, generating high volumes of low-confidence findings. In the middle, validated AI red team platforms will pair with human experts to filter that noise. At the top, continuous agentic testing will become a compliance mandate for any serious enterprise. For pure play vendors like Armadin and Terra Security, the growth ceiling is high. For legacy penetration testing firms, the business model is unraveling. For CISOs, the challenge is existential. The bottleneck is no longer finding vulnerabilities; it's validating them. IRONSCALES data shows that analysts are already drowning—36.5% of their time is spent dealing with phishing events alone. Now imagine AI-generated SQL injection variants and adversarial prompts flooding the SIEM. The human judgment required to sort real threats from AI hallucinations becomes the most expensive and rare commodity in the enterprise. Armadin's Evan Pena nails the current state: "A frontier model out of the box, if you tell it, 'Hey, go hack this thing,' it may just not work. It has to have fine tuning, it has to have methodology." The winners in this market will be the ones who combine machine speed with human judgment. The losers will be those who trust the machine blindly—or ignore it entirely. As one Hacker News user succinctly put it during a thread about the "Mythos-class" breakthroughs: "Manual penetration tests, on the other hand, are slow, expensive, and typically run only once a year—leaving companies exposed for months." That 12-month window of exposure is now an abyss. The question isn't whether AI will replace the red team. It's whether the human blue team can survive the speed at which the red team is evolving.