Indonesian cybersecurity firm ITSEC Asia has published a threat intelligence report warning that autonomous AI agents are increasingly being used to automate key stages of cyberattacks, potentially lowering the technical skill and time required to conduct intrusions.
The whitepaper, titled AI-Powered Cyberattacks in the Global Threat Landscape, argues that attackers are using AI agents to identify targets, exploit vulnerabilities, and steal or destroy data, with systems able to adapt when an attack fails and operate with limited human involvement.
“AI is changing the economics of cybercrime. Attackers can now carry out activities that previously required considerable technical expertise, time and resources at a much lower cost,” Patrick Dannacher, President Director of ITSEC Asia, said. “For businesses, this creates a different level of exposure.”
ITSEC Asia said its findings, based on reported cyber campaigns and global threat intelligence, indicate AI is reducing the manual effort required across the attack chain, including reconnaissance, exploitation, credential collection, and data extraction or destruction.
The report highlights several cases in which AI and automation were reported to have been used in cyber operations. One example cited is “JadePuffer”, which ITSEC Asia said involved an AI agent adapting its actions during a database extortion operation. It also referenced cloud activity tracked by Microsoft as Storm-3168, describing the use of compromised cloud application credentials to access and delete resources.
Another case, “Scarlet Loop”, is described as using AI to support large-scale scanning and selection of targets. ITSEC Asia said attackers reportedly scanned more than 84,000 URLs across 107 countries and 47 sectors, using AI to help identify sites with accounts holding funds or rewards such as digital wallets and loyalty programs.
The paper also discusses ARTEX, described as a framework coordinating multiple AI agents to conduct reconnaissance, vulnerability scanning and exploitation. In a separate campaign linked to the CAIRN framework, the report notes Reuters reporting that more than 1,200 websites were targeted and more than 100 companies were breached.
Looking ahead, ITSEC Asia said it expects increased ransomware activity using AI agents to target cloud and database services over the next six to 12 months, alongside broader abuse of cloud credentials and more attacks on enterprise AI infrastructure. The report also forecasts increased use of AI-generated audio and video for impersonation and fraud.
ITSEC Asia identified compromised cloud identities as a high-priority risk, warning that attackers can exploit stolen credentials and excessive permissions to access cloud resources and move across systems, sometimes without deploying traditional malware.
The report recommends four areas of preparation: improved monitoring of unusual account activity using tools such as XDR and UEBA; applying Zero Trust principles to strengthen identity verification and restrict lateral movement; increasing automation in incident response through SOAR; and introducing dedicated security practices for AI models, training data and the systems used to develop and deploy them.
“Ultimately, cybersecurity is a business responsibility,” Dannacher said. “As organizations adopt AI across their operations, security considerations need to be part of every strategic decision.”
The full whitepaper was issued in November 2026 and is available via the whitepapers section of ITSEC Asia’s investor relations page.
You can read the full report here.
