AI agents are hackers' latest shiny new object, and rogue agents are popping up across safety labs.

• Researchers at Google and Anthropic detailed several new cases last week of nation-state and financially motivated hackers using agentic swarms to automate their attacks (⬇️ read more about those below!).

Why it matters: Anthropic CEO Dario Amodei's weekend warning that a swarm of AI agents could take over "the entire internet with a persistent botnet (potentially causing hundreds of billions of dollars in damage)" in the next six to 12 months set off a new wave of panic — and criticism — across the AI security industry.

Yes, but: The idea of an agentic swarm taking over the whole internet caught immediate flak from seasoned security pros.

Why Dario could be right

Hackers are already playing around with AI agents to build surveillance operations, extort companies, and find zero-day vulnerabilities.

• In a number of cases, Anthropic saw malicious actors switch to open-source models after encountering safeguards while using Claude, according to Jacob Klein, Anthropic's head of threat intelligence.

Case in point: Researchers at Calif used AI models to help build a worm that could hijack people's WeChat accounts, access their private messages, and automatically spread to their contacts without victims clicking on anything, according to the New York Times.

The big picture: Agentic swarms are a growing fear among cybersecurity professionals.

• "Persistent swarms can actually cause many billions in damage today," Rahul Madduluri, co-founder and CTO at Doppel, told me, adding that agents would only need to compromise a few widely used software providers to have global impact.
• A swarm "does not need to be perfect to be dangerous," Jack Nelson, CISO and deputy general counsel at Ivanti, told me. "Thousands of agents making 'good enough' decisions at machine speed could create meaningful disruption."

What Dario's prediction misses

Taking over the entire internet is a nearly impossible and expensive task, even for AI agents, Numa Dhamani, head of machine learning at iVerify, told me.

• The internet runs across disparate networks and technologies, making the idea of a singular takeover difficult to envision.
• "The more useful question is what 'take over' means operationally," Dhamani added.

Zoom in: Amodei didn't provide many specifics about how he sees this playing out.

• His prediction appeared to extrapolate from METR and Redwood Research's evaluations of OpenAI agents that hacked Hugging Face.
• But those agents went rogue during a pre-deployment hacking test where their safety classifiers had been turned off.

Between the lines: An AI botnet would also need significant resources to operate at that scale.

• Traditional botnets can hijack vulnerable devices at little ongoing cost, while an AI swarm needs models and compute, Rob T. Lee, chief AI officer and chief of research at SANS Institute, told me.
• Commercial models provide a chokepoint where activity can be monitored and cut off, while open-source models remove that constraint but leave attackers paying for compute.
• "Either way it's a clear leash we've never had on a botnet," Lee said.

Reality check: Greg Notch, CTO at Expel, called the idea of a malicious swarm "far-fetched."

• "You can invent and assert an endless amount of science-fiction plots if you don't have to show your predicates or the rest of your work in how you go from the concept to reality," Notch said.

The bottom line: Everyone agrees AI is making cyberattacks faster, cheaper and more capable — but it's not reinventing the tactics defenders already know well.

Hackers are already building armies of AI agents to hack government agencies, critical infrastructure and major companies, according to reports from two major AI labs in the last week.

Driving the news: State-sponsored hackers and cybercriminals are deploying groups of AI agents that divide up tasks and work simultaneously across different stages of an attack, according to reports from Anthropic and Google's Threat Intelligence Group.

• In one case, a financially motivated hacker used a multi-agent system to plan and execute a mass credential-harvesting campaign in less than six hours.
• The agents scanned for vulnerabilities, troubleshot problems, rotated IP addresses and stole thousands of third-party credentials.

Zoom in: Anthropic identified a Chinese-speaking espionage group using agents in a campaign targeting about 50 organizations.

• A lead agent assigned tasks including target research and malware development to sub-agents working in parallel.
• Other agents combed appliance firmware for vulnerabilities and tested potential exploits in a lab before they were used in the wild.
• A group of about 13 agents continuously scraped U.S. military and government websites for intelligence.
• In another workflow, agents found more than 12 possible zero-days within a month.

Between the lines: The agents weren't operating entirely on their own, but they were increasingly able to carry out large portions of attacks without constant human direction.

• They could divide up work, react to roadblocks and keep operations moving once hackers set the broader objective.
• That's a shift from earlier AI-enabled attacks, where hackers largely used chatbots to write malware, research targets or troubleshoot code.

The big picture: "I would argue that type of campaign is no longer novel," Anthropic's Jacob Klein told me. "It's more of the norm."

Cybersecurity CEOs are facing their own personal reckonings as the speed of AI upends their market.

Why it matters: AI labs are creeping into parts of the security market just as their models are making cyberattacks faster and more scalable.

Driving the news: Leaders of Rubrik, SentinelOne and Palo Alto Networks offered starkly different visions of where the industry is headed at last week's Goldman Sachs Communacopia + Technology Conference.

• "I never used to have sleepless nights; now I think about this before I go to sleep," Palo Alto Networks CEO Nikesh Arora told a room filled with analysts and journalists. "Every morning when I wake up, there's new shit."
• However, Arora argued that frontier models are unlikely to simply replace cybersecurity vendors, noting that customers are still likely to retain companies like his own to stop attacks.

What they're saying: SentinelOne CEO Tomer Weingarten pushed back on the security industry's rush to market AI as a cure-all for AI-enabled threats.

• "The problem is not AI getting better, it's the state of cybersecurity itself," Weingarten said. "They're introducing more complexity into the mix."

The intrigue: Rubrik CEO Bipul Sinha struck a more measured tone, viewing AI as an accelerant for the company's expansion beyond data protection into identity and AI agent security.

• "Folks are realizing that agents and AI are making their world more dangerous," Sinha said. "Now they are looking at a world where you have 100 times more opportunities, but it can also do 10 times more damage in one-tenth of the time."

Yes, but: Despite their differing points of view, the CEOs agreed that AI is increasing the speed of cyber operations so quickly that human defenders cannot keep up.

What to watch: Cybersecurity was one of the few market winners after last week's warnings about increasingly powerful and potentially dangerous AI.

A hacker used AI-written malware distributed through open-source software packages to compromise companies and hunt for bugs that he then submitted for legitimate bug bounty payments, according to CrowdStrike research shared first with Axios.

Why it matters: The findings offer a striking example of how AI is lowering the technical barriers to cybercrime and allowing relatively unsophisticated hackers to build their own malware.

Driving the news: CrowdStrike researchers say they have high confidence that the financially motivated hacker used a large language model to write the malware behind his attack based on the comments, placeholder code and token-analysis patterns left inside the script.

• The hacker also posted about collecting bounties from at least nine companies across the technology, retail and hospitality sectors; however, it's unclear whether the malware, called PhantomRaven, was used to compromise those particular companies or identify the issues behind those bounties.
• CrowdStrike remediated and responded to multiple incidents involving this malware.

How it works: The hacker published malicious open-source npm packages that delivered the PhantomRaven malware.

• When developers installed the malicious packages, PhantomRaven executed on their systems and collected information, including credentials and other sensitive development data.
• CrowdStrike assesses that the hacker used PhantomRaven to compromise company assets and hunt for vulnerabilities.
• The hacker then used those compromises as leverage to submit bugs to legitimate bug bounty programs and seek payouts.

Between the lines: Turning to bug bounty programs allowed the hacker to establish credibility in the broader hacker community, Adam Meyers, CrowdStrike's senior vice president of counter adversary operations, told me.

• The researchers also said in the report that they haven't seen stolen data from this campaign being sold on criminal marketplaces.

The big picture: The case is just the latest example of growing AI adoption among malicious actors, including less-sophisticated actors eager to scale their operations.

• "We're seeing it all over the place," Meyers said. "We have adversaries that are using AI to develop their tooling; we're seeing it across the spectrum of nation-states and criminal hacktivists."

Yes, but: The malware used in this campaign is relatively simple, and the attack relied solely on well-known supply-chain techniques.

• The notable part is that AI appears to have helped a relatively inexperienced hacker build his own functioning malware rather than relying on off-the-shelf tools.

@ D.C.

🏛️ After AI CEOs called for a slowdown, President Trump said the only "guardrail" the industry needs is a smart president (Axios), and House Speaker Mike Johnson said Congress won't lead the charge on regulating AI. (Axios)

🔀 The National Security Agency is pursuing a major internal restructuring to reflect its current priorities, including cyber operations and AI. (Washington Post)

👥 CISA has roughly 250 prospective new employees awaiting clearance as the agency looks to rebuild after massive staff reductions in recent years. (Nextgov)

@ Industry

🎭 Moonshot AI covertly routed thousands of user requests through Claude and passed the responses off as their own, Anthropic said in its recent threat report. (Bloomberg)

🔒 Nvidia and Booz Allen Hamilton have both limited access to Anthropic's Fable model over concerns about how the AI lab is storing customer data. (The Information)

🛠️ Nearly three years after Microsoft launched its Secure Future Initiative, company execs say Microsoft has radically transformed how employees approach security. (Cybersecurity Dive)

@ Hackers and hacks

💎 OpenAI's agents were behind a campaign that flooded public software repository RubyGems with thousands of malicious software packages. (CyberScoop)

🖱️A new wave of ClickFix attacks is tricking people into hacking themselves. (TechCrunch)

A lot of you wrote me after my pleas on social media asking for your takes on Dario's essay and AI CEOs' calls for a slowdown this weekend.

• ✍🏻 Here's what y'all said:

"I don't worry about the machine waking up and deciding to end us. What I worry about is a system with too much access doing exactly what it was told without the necessary adversarial testing." — Bugcrowd CEO Dave Gerry

"Dario makes a compelling case, but a coordinated industry slowdown is a pipe dream with open-weight models already in the wild." — Sonatype CEO Bhagwat Swaroop

"This is a big deal. Companies simply don't ask to be regulated. We've all heard AI safety warnings before, even from industry leaders. This is different, and it's serious." — Dana Simberkoff, chief risk, privacy, and information security officer, AvePoint

"Companies should use this time to build the architecture needed for the AI already here and the more capable systems coming next." — Shlomo Kramer, CEO and co-founder, Cato Networks

"The call is coming from inside the house. I think Anthropic is looking for cover with their investors to allow for a slowdown and insert constraints, even if it means decreased token volume and slower revenue growth." — Meghan Gaffney, founder and CEO, The Progress Lab