AI Agents Have Accelerated Intrusion Speeds, and Defense Time Has Shrunk Too

According to AI TIMES, Google and Mandiant said on October 31 that AI agents have automated internal reconnaissance, privilege analysis, and follow-on intrusion based on compromised accounts in real-world breach incidents, with deep internal access achieved in as little as about 15 minutes after account compromise. They said these attacks are evolving beyond the level of merely assisting individual tasks and are instead linking multiple stages of intrusion at once. In particular, they said they had observed open-source penetration testing frameworks being abused in attacks, with legitimate administrative functions and cloud APIs also being used as intrusion tools. However, they analyzed that the attacks observed so far, while fast, still leave many logs and error traces, and therefore cannot yet be considered fully stealthy automation. Even so, they pointed out that because an agent can continue with path discovery, privilege verification, and error correction once the attacker provides the target and credentials, the risk of spread before defenders can respond is growing. Accordingly, they recommended reducing exposure of core administrative functions, applying short-lived credentials and least privilege, and operating behavior-based anomaly detection more strictly.