You see a burst of automated probing against a login page and your brain files it under authorized testing. Maybe the MSSP. Maybe last quarter’s assessment. That reflex just failed a basic cybersecurity test. A Chinese-speaking operator pointed an AI pentest product at more than 1,200 sites, including properties tied to Deere, SharkNinja, and Cummins, and let the agents work with almost no babysitting.

Researchers watching the campaign didn’t need a leak or a lucky DNS hit. The attackers left their control panels on the public internet. You could see the queue. You could see which company properties the bots were chewing through. If you still treat autonomous offensive agents as a conference talking point, that open console is your counterexample.

Licensed Agents Already Run Other People’s Campaigns

The shrug this week is that AI-driven attacks were always coming. Fine. The operational insult is the stack they used. Dark Reading’s reporting describes a Chinese-speaking attacker abusing Cairn, an AI pentest tool, to automate a mass compromise run against hundreds of websites. The Hacker News account of the same activity puts the attempt count above 1,200 sites and more than 100 companies. Farm equipment. Appliances. Engines. The agent does not care about your sector narrative.

They did not need a bespoke zero-day for every hostname. The agents ran the junior-tester loop at machine speed: map the app, poke auth, retry, move on. Your threat detection is probably still tuned for noisy, human brute-force against SSH and RDP. Iterative, “professional” probing against a web login looks like a scanner you approved. If your firewall still treats security tooling as a friendly class, you’ve pre-cleared the adversary’s runtime.

The staffing model is the part your tabletop keeps skipping. The operator did not live in a terminal and drive every payload. They pointed autonomous agents at company websites and stepped back. Duration stretches. Coverage widens. One pass can touch a manufacturer you file under “industrial” and a consumer brand you file under “marketing’s problem,” because the bot never takes Friday off.

Leaving the control plane on the internet is sloppy tradecraft, and you should not count on sloppy forever. It also tells you how these crews work. They manage agents the way you manage tickets: a dashboard, a queue, a list of URLs. Your job is to assume that dashboard exists even when you cannot browse it.

Cybersecurity Programs Still Treat Agent Scans as Helpdesk Noise

NIST, CISA, and NSA picked this same news cycle to publish ten voluntary practices for rogue AI agent incidents. Prepare, detect, respond, recover, report. If you already have a grown-up incident response function and a living inventory of which agents can take actions, you’ll find useful language in there. Most of you will find a document that describes a shop you do not run.

You inventory laptops. You inventory SaaS. You do not inventory which pentest platforms, copilots, and browser agents hold tokens, can hit production URLs, or can spawn child tools. Vendors will happily sell you more threat-protection telemetry for the edge while the interesting console sits on a cheap VPS with a public IP and a password that has never seen SSO.

Agency text also frames the nightmare as an agent you own going off-script. The Cairn campaign is the other direction. Someone else’s licensed tester is doing its job against your login, your API, your forgotten staging host. A playbook titled “our model misbehaved” does not cover “a commercial pentest agent is iterating on password reset at 3 a.m. from a cloud ASN you’ve never contracted.”

There’s a volume problem sitting next to the agent problem. Cisco Talos flagged a vulnerability dump that turns human triage into theater. September’s Microsoft release carried 975 advisories. This month’s pile hit 1,415. The pre-June average sat near 100 a month. You cannot live in that queue. Agents, on both sides, will pick the reachable items. If your cyber security program is still a weekly CVE meeting with a color-coded spreadsheet, the uninvited pentest bot is already past the slide where you argued about severity.

This is a bad look for anyone who sold “AI-assisted testing” as a pure force multiplier and never treated the runtime as dual-use infrastructure. The real problem here is your exception list. Scanner user-agents, cloud ASNs used by “security vendors,” and after-hours probing all get a courtesy pass in too many SOCs. Courtesy is how 1,200 sites become a work queue.

Put Uninvited Pentest Traffic in the Incident Queue

Defense in depth, in this case, is a boring admission: scanning that looks professional can still be hostile. You need a rule for unscheduled agent activity. Hope that the annual pentest firm emails you first is not a control. Security hardening starts with killing the idea that “it looks like a tester” is a verdict.

Lock the assumptions before the next overnight window

1. Build a one-page authorized-testing register: vendor name, source IP or ASN, window, targets, and ticket number. Anything that probes authentication outside that register is an incident, including traffic that looks like Burp, like Nessus, or like an AI tester.
2. Pull a week of WAF, reverse-proxy, IdP, and application logs for clustered, iterative probing that chains recon into login abuse. Hunt sequences. A single CVE signature will miss an agent that is patiently failing password reset, MFA enroll, and API auth in a loop.
3. Search from outside your network for management consoles of scanners, ticketing tools, agent dashboards, and backup UIs. If you can reach an admin path without SSO and phishing-resistant MFA, treat it as already sitting in someone else’s screenshot folder.
4. Put rate limits and lockouts on every public auth surface, including staging, vendor portals, and password-reset endpoints. Brute-force still works when the agent is patient and your “non-prod” host reuses production credentials.
5. Revoke standing tokens held by pentest platforms, CI bots, and browser agents. Give testers time-boxed credentials that die with the engagement. Starve anything autonomous of a role that can change production data or identity.

Keep going after the first night. Add “uninvited autonomous scanning” to your severity matrix so the SOC cannot close it as scanner noise. Require every offensive tool in procurement to document where its console lives, who can launch agents, and how you revoke that launch path in minutes. Rotate the allowlists that currently bless entire cloud providers because a pentest firm sat there once. Those ASNs are for rent.

Tabletop the inverse of the federal rogue-agent memo. Your owned copilot going off-script is one scenario. A licensed pentest agent you never hired iterating on your customer login is the one that already happened to more than 100 companies. Walk that path from first WAF spike to credential revocation without waiting for a vendor blog to name the tool.

Frequently Asked Questions

How do I tell a paid pentest from an AI agent campaign?

You don’t start with the user-agent. You start with the register: who is authorized, from where, against which hosts, during which window. Traffic that matches a tester workflow and misses that register is an incident, even when it looks cleaner than yesterday’s botnet.

Should we stop using AI pentest tools internally?

Ban the ones you cannot inventory, constrain, and revoke. Keep tools whose consoles sit behind SSO, whose agents use time-boxed credentials, and whose launch path a human can kill. Dual-use software stays useful when you treat it like production access, not like a browser plugin.

Do the new NIST and CISA practices change Monday morning?

They give you language for prepare, detect, respond, recover, and report. They do not replace an IR plan that still files automated probing as scanner noise. Use the document to name owners and evidence. Use your logs to catch the agent you didn’t hire.

Sources

• Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree
• Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
• US Agencies Detail Incident Response Practices for Rogue AI Agents
• There’s only so much code: the rise in vulnerability numbers