The difficult part begins when an AI system is allowed to change production.

Over the last few weeks, I have had the same discussion several times. Public reports increasingly describe AI being used across large parts of an intrusion. The obvious question is: Where is the defensive equivalent? Why are we not deploying AI agents that watch an attack unfold and react at the same speed?

An agent here means a model running in a loop with tools and feedback. It executes an action, inspects the result and decides what to try next.

The response window is getting smaller

Recent cases show AI being used for much more than generating phishing emails or scripts. Anthropic described an espionage campaign in which attackers used an agent to execute substantial parts of the operation. Google has reported AI use in vulnerability research, exploit development, evasion and autonomous command generation.

During the July 2026 OpenAI and Hugging Face incident, models in an internal cyber evaluation chained vulnerabilities across both organizations’ environments to obtain test data. It was not a normal criminal intrusion, but it demonstrated the ability to pursue a goal across several systems and continue through obstacles.

The important change is not that every command is brilliant. Many are not. An agent can work continuously, run several paths in parallel and treat a blocked action as feedback. It can change a command, choose another tool or attempt a different route toward the same objective.

EDR products are already in the best technical position to see this activity. They observe behavior as it happens and can block many individual attack steps. Modern EDR and XDR platforms also use behavior-based detection, machine learning and cross-signal correlation.

The problem appears after the block. An adaptive operator can ask why the action failed and try another way.

In the past, that operator was usually a human. Human-operated intrusions often left enough time between an alert and the next major step for a SOC to investigate, isolate a host or disable an account. Agent-driven operations can compress that window until the manual response process becomes the slowest part of the defense.

The asymmetry in the cost of being wrong

The central problem is an asymmetry in the cost of being wrong.

An offensive agent can select the wrong exploit, misunderstand a service or generate a broken command and still remain useful. It can inspect the result, change its approach and try again. The attacker only needs one path to succeed.

A defensive agent operates under very different conditions. Once it is allowed to isolate systems, terminate processes, disable accounts or block network connections, every wrong assessment can become a production incident. It may disable a legitimate administrator, terminate a critical application process or disconnect an important server even when no attacker is present.

The acceptable error rate therefore depends heavily on the action. Collecting more evidence or searching other systems for the same artifact has a relatively low operational cost. Disabling a privileged account or isolating a critical server belongs to a completely different risk category.

Existing defensive products already reflect this problem. Microsoft says its automatic attack disruption uses incident-level correlation and maintains at least 99 percent precision for containment actions. Even then, the actions are reversible and organizations can exclude critical users, devices and IP ranges.

Google similarly combines adaptive agents with deterministic playbook steps in SecOps so that critical actions remain under explicit control.

Attackers can tolerate repeated failure because they only need one successful route. Defenders need much stronger guarantees before allowing an AI system to change production.

Where defensive AI can move quickly

Defensive agents can act much more freely when the possible damage is small. They can correlate telemetry, reconstruct timelines and attack paths, search other systems for related artifacts, collect forensic evidence, test hypotheses and prepare a containment plan.

A wrong hypothesis in this part of the workflow may trigger an unnecessary query or scan. That is inconvenient, but it normally does not interrupt a business process. Investigation, threat hunting and evidence collection are much better targets for broad autonomy than direct enforcement.

The company used LLM-based triage and analysis to work through more than 17,000 recorded events, reconstruct the attack timeline, extract indicators and map affected credentials. According to Hugging Face, this reduced work that would normally take days to a matter of hours – and, incidentally, collecting the forensic artifacts needed for that analysis is one of the areas where THOR earns its keep.

This is where defensive AI can remove a lot of human latency. An agent could start collecting volatile data as soon as a high-confidence alert appears, search for related persistence and show the analyst what changed since the previous scan. Much of the basic investigation could be complete before a person opens the incident.

Separate reasoning from enforcement

A sensible architecture separates the agent that reasons about the incident from the component allowed to change the environment.

The agent proposes an action and provides the supporting evidence. A policy layer checks the action type, confidence, asset criticality, scope, reversibility and available independent signals.

This allows evidence collection and wider threat hunting to run automatically. Temporary containment of a normal workstation may be allowed when several independent signals agree. Actions affecting critical servers, identity infrastructure or privileged accounts can require additional confirmation or human approval.

Human control does not have to mean approving every command during an attack. Much of the decision can happen in advance through policy. Organizations define which actions are safe enough to run automatically and where the agent must stop.

Every action also needs a complete audit trail:

• what the agent observed,
• which assumptions it made,
• which evidence supported the decision,
• what it changed and how the action can be reversed

The agent should receive narrow, temporary capabilities for a specific task instead of broad standing privileges.

Why investigation still matters

At Nextron, we focus on detection, compromise assessment and forensic reconstruction.

Blocking one process or isolating one host does not show whether the attacker moved elsewhere, stole credentials or left behind hidden accounts, web shells, configuration backdoors or custom malware.

THOR, THOR Cloud and the Analysis Cockpit help collect and review these traces across many systems. AI can support this work by prioritizing findings, connecting related evidence and triggering targeted follow-up scans.

This is where defensive AI can operate with relatively low risk: investigate faster, reduce uncertainty and help analysts understand the full scope of an intrusion. Actions that change production systems require much tighter control.

Selected references

Hugging Face. “Security incident disclosure – July 2026.”
https://huggingface.co/blog/security-incident-july-2026

Hugging Face. “Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident.”
https://huggingface.co/blog/agent-intrusion-technical-timeline

OpenAI. “OpenAI and Hugging Face partner to address security incident during model evaluation.”
https://openai.com/index/hugging-face-model-evaluation-security-incident/

Anthropic. “Disrupting the first reported AI-orchestrated cyber espionage campaign.”
https://www.anthropic.com/news/disrupting-AI-espionage

Google Threat Intelligence Group. “GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access.”
https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access

Microsoft. “Behavioral blocking and containment.”
https://learn.microsoft.com/en-us/defender-endpoint/behavioral-blocking-containment

Microsoft. “Automatic attack disruption in Microsoft Defender.”
https://learn.microsoft.com/en-us/defender-xdr/automatic-attack-disruption

Microsoft. “Exclude assets from automated response in attack disruption.”
https://learn.microsoft.com/en-us/defender-xdr/automatic-attack-disruption-exclusions

Google Security Operations. “Embed AI agents in playbooks.”
https://docs.cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/agentic-automation