An AI agent just robbed a company. No human touched the keyboard.
It broke into an internet-facing server, moved through the network, stole credentials, encrypted 1,342 database records, and left a ransom note demanding Bitcoin payment. When its first attack attempt failed, it diagnosed its own error, rewrote its code, and completed the full attack in 31 seconds.
What made this possible was not sophisticated zero-day research or nation-state resources. It was mundane.
The vulnerabilities it exploited were years old. A 2021 authentication bypass. A default signing key publicly documented since 2020, still shipping unchanged in thousands of deployments today. The agent automated what a skilled human attacker would have done manually, but faster and at zero marginal cost.
This changes the math on defense
Traditional security thinking is built around human-paced threats. An attacker gets in, moves laterally over hours or days, and defenders have time to detect unusual behavior, escalate to the right people, and contain the damage before it spreads.
That model does not hold when the entire kill chain completes in under a minute.
When attacks run autonomously, two things happen simultaneously. Volume goes up, because the cost per attack drops to near zero. And speed goes up, because there is no human bottleneck on the offensive side. Security teams end up defending against more campaigns running in parallel, each one adapting in real time based on what it encounters.
The vulnerabilities were not exotic
This is the part that should concern most organizations. The attack did not require novel techniques. It required patience to find an unpatched server and the automation to exploit it faster than any human could respond.
Unpatched authentication vulnerabilities. Default credentials left in place. Publicly documented misconfigurations that vendors have known about for years and organizations have simply not gotten around to fixing.
These are not edge cases. They are the current state of most small and mid-sized business infrastructure. The difference between now and two years ago is that exploiting them no longer requires a skilled attacker with time to spare. It requires an AI agent and a target list.
Speed of response becomes the deciding factor
Organizations that come out ahead will not necessarily be the ones with the most tools or the largest security budgets. They will be the ones that can detect, triage, and respond at machine speed.
That starts with knowing what you have. Asset visibility, patch status, credential hygiene, and network segmentation are not exciting problems. They are the baseline that determines whether an autonomous attack finds easy footing or hits a wall.
The 2021 vulnerability that enabled this attack was not a secret. It was documented, known, and unpatched. That is the gap that matters.