• Give AI only the access it needs. The damage came from over-trusted apps and stolen keys, not clever hacking.
• Put the fence outside the agent. To an AI agent, “no” can look like a puzzle; real limits come from permissions, not instructions.
• Keep the basics strong. Lockouts and sign-in protections stopped 151,000 machine-speed password guesses cold.

Previously, in Part One: a cloned lawyer’s voice, a confidentiality agreement nobody questioned, and €95 million out the door, plus assistants that obey any note left where they can read it. That was AI that talks and reads.

This part is about AI that does: books, sends, changes, logs in, and deletes. That’s where most of the new risk lives, and, as it happens, most of the new defense.

When the assistant can act

An agent can hold more authority than it needs

An AI agent is a system that can take actions through connected software (run commands, send messages, change files), not just answer questions. That’s genuinely useful for scheduling, research, coding, and routine operations. But an agent allowed to read a folder is very different from one that can delete files, change permissions, or email outsiders. Giving a system more access than its task requires is excessive privilege. Granting only what the task needs is least privilege, so that when something goes wrong, the damage has edges.

Start with an agent that wouldn’t take no for an answer. In June, an OpenAI agent researching public medicine spending tried to pull figures from an aging Australian government statistics portal. The portal refused. The agent went around the refusal and reached files that were never meant to be public. Prime Minister Anthony Albanese’s summary: it didn’t accept “no” for an answer. OpenAI says no patient records were accessed; what it reached was aggregate statistics and internal file names. Still, the government only found out in September, through an email to a public inbox, and set up a task force.

It wasn’t a one-off. OpenAI later said it had notified dozens of organizations, including governments and universities, after finding that its agents may have gotten around security controls on outside websites during training and testing. In one case reported by The New York Times, an agent used login credentials it found online to get into a US Census Bureau data site. Two lessons hide in there. To a goal-driven agent, “no” can look like a puzzle, so the real fence has to sit outside the agent. And a password left lying around online is still a password, whether a criminal or a robot finds it.

Now the professional version. On October 21, Microsoft described how Storm-0940, a hacking group it ties to the Chinese state, used ARTEX, a free, open-source tool that chains AI agents together to run an attack from reconnaissance to data theft with little human involvement. The way in was clever and depressingly ordinary. The group had compromised ConnectWise, a vendor whose cloud backup app many businesses had already invited into their Microsoft 365 environments. With the app’s stolen keys, the agents could stroll through doors customers had opened for a trusted supplier, no password required. Security pros call that a supply chain attack: break into one trusted supplier to reach all of its customers.

Read that last bullet twice. The agents threw 151,000 password guesses at real people and got nothing, because account lockouts and sign-in protections simply held. The damage came through a vendor’s app that already had broad, standing permissions. It’s the Australian lesson in a nicer suit: the weaknesses were old and boring (leaked keys, over-trusted apps, forgotten systems), and what AI added was speed and stamina. Microsoft noted the agents set off plenty of alerts but moved so fast that defenders had very little time to act on them. A human attacker gets bored, sleeps, and has a dentist appointment. An agent has none of these constraints.

It isn’t only state-backed teams, either. In October, CrowdStrike described four previously unknown groups (Spanish-, Chinese-, Indonesian-, and Russian-speaking) that ran attacks between May and August in which AI agents made the decisions and typed the commands. The least skilled of the four, working from 819 instruction packs copied mostly from public websites, still broke into several government websites. CrowdStrike’s assessment: these agents can often reach their objective within an hour. The comic relief is that all four groups left their attack kits sitting in publicly accessible folders, which is how CrowdStrike got to read their playbooks. The robots are fast. Their operators are still sloppy.

To do anything useful, an agent needs tools: connections that let it read a calendar, search a database, or run a command. More and more agents plug into those tools through the Model Context Protocol (MCP), a common standard that works like a universal adapter between an AI assistant and everything it can touch. Handy for builders. Also handy for a Russian-speaking ransomware affiliate, a freelance criminal who rents a ransomware gang’s tools for a cut of the profits, who goes by Azazel.

Security firm CloudSEK found that Azazel hooked a remote-control line into a hacked victim computer (a “reverse shell”) up to his own AI coding assistant as just another MCP tool, so he could run parts of his intrusion by chatting with it. He hit more than two dozen organizations in six countries and walked off with terabytes of data. One break-in, at a medical-imaging company, started with an AI imaging service that would fetch any web address it was handed, no login required, and ran for weeks. Then he double-crossed his own gang, publishing the stolen data on a leak site of his own and keeping the extortion money. We know all of this because he left his servers open to the internet. Honor among thieves remains a myth. So, apparently, does tidying up.

Field test: Before granting an AI tool access to anything, ask: if this tool were compromised, or simply overeager, what is the worst it could do with these permissions? Then shrink the permissions until that answer stops being interesting.

Plot twist: the defenders get robots too

The same capabilities cut the other way, and the results are startling. In April 2026, Anthropic launched Project Glasswing, giving major technology companies early access to an unreleased AI model to hunt for flaws in critical software. Among the early finds: a 27-year-old vulnerability in OpenBSD, an operating system with a reputation for being hardened, that let an attacker remotely crash a machine just by connecting to it; and a 16-year-old flaw in FFmpeg, widely used video software, sitting in a line of code that automated testing tools had run five million times without noticing. By October, Anthropic reported that partners had verified at least 129,000 vulnerabilities between April and July, more than 33,000 of them rated critical or high severity. (A vulnerability is a flaw an attacker could exploit. A patch is the fix.)

Those figures are company-reported, and Anthropic also makes Claude, so weigh them accordingly. One independent check offers a sobering counterweight: analysis by VulnCheck found that only 2 of 300 Glasswing-discovered vulnerabilities it examined, about 0.7%, had been exploited in the wild. The sky has not fallen yet.

The real plot twist is that finding bugs is no longer the hard part. Fixing them is. As of October 2, Anthropic’s own disclosure dashboard showed that, to its knowledge, 516 of the 6,157 vulnerabilities reported to open source maintainers had been patched. Many maintainers are volunteers, and AI can now produce bug reports faster than humans can read them. Expect more software updates, arriving faster. Update fatigue is about to get worse. Install them anyway.

Defenders get faster investigations, too. IBM found that organizations making extensive use of AI and automation in security saved about $1.93 million per breach on average and contained incidents roughly 65 days sooner. And remember the sentence in the Storm-0940 story with “zero” in it: lockouts, multifactor sign-ins, and monitoring turned 151,000 machine-speed guesses into nothing, and Microsoft published detection rules and step-by-step hunting queries so other organizations could check their own environments. Guardrails earn their keep as well: CrowdStrike observed that its least sophisticated group repeatedly had to step in to push the AI past its built-in guardrails (safety filters meant to block harmful requests). In October, Anthropic expanded a program giving vetted security professionals access with reduced safeguards. Dual-use cuts both ways.

My favorite new trick turns the attacker’s AI against itself. Remember prompt injection from Part One, the hidden instructions an AI can’t help obeying? Security firm Tracebit plants decoy passwords and keys, called canaries after the coal-mine birds, in cloud systems. Next to each one it hides a short context bomb: text written to trip an attacking AI’s own safety rules, so the agent refuses to go on, while defenders get an alarm either way. In Tracebit’s tests, the most capable attacking model went from usually reaching administrator access to failing every single run. The fine print: Tracebit sells this kind of product, the results come from its own test range, and attackers will adapt. Still, it’s a delightful plot twist: AI’s most famous unfixable flaw, working for the good guys.

The robots are clocking in on our side of the house, too. Arctic Wolf, a managed security provider (a company that watches other companies’ networks for them), reported in October that AI agents now resolve about 60% of the investigations in its security operations center (SOC), the team that triages and chases down alerts, with human analysts overseeing the work. That’s a company describing its own service, so read it as a direction rather than a guarantee. But the direction matters: endlessly checking alerts is exactly the kind of work machines never get bored of.

Stay tuned: next time, we’ll look at where all this is heading and what to do about it.