Picture the guy who breached 14 companies this spring. Researchers at OALABS recovered over 1,000 agent sessions from a server he’d been working from, and the picture that emerged isn’t a hoodie-wearing prodigy. It’s someone who fumbled basic commands, copy-pasted his way through errors, and let Anthropic’s Claude Code and OpenAI’s Codex do the actual thinking. He bypassed the guardrails not with clever jailbreaks but by asking nicely and rephrasing when refused. That’s the new face of cybersecurity risk: not a genius, just a persistent amateur with two very capable assistants.

The uncomfortable part isn’t that AI agents can be misused. We’ve known that was coming. It’s how little the attacker brought to the table himself, and how that maps onto a credential supply that’s already overflowing.

The cybersecurity skill floor just fell out

For years the comforting story went like this: real attacks require real talent, so most of us are statistically safe behind the firewall because the truly dangerous people are busy hitting bigger targets. That story is dead. When an agent can read a recon output, suggest the next pivot, write the exploit code, and clean up the syntax errors it just made, the human in the chair only needs patience and a target list.

The OALABS sessions show exactly that. The operator asked his agents to enumerate, to escalate, to move laterally, and they obliged across nearly every step. Guardrails got in the way occasionally, but a determined low-skill user treats a refusal the way the rest of us treat a CAPTCHA. Annoying, not stopping.

Scale this thinking. The volume of people who can now run a credible intrusion just jumped by an order of magnitude, and none of them got smarter. The tooling did.

He didn’t need a zero-day. He had your password.

Here’s where it gets bleak. An AI agent is a force multiplier, but it still needs a foothold, and the foothold is sitting in a leak right now. The FortiBleed dump exposed what looks like Fortinet and FortiGate VPN credentials tied to roughly 73,932 firewall URLs worldwide. Dark Reading’s reporting on the same campaign puts it at 30,000-plus compromised devices across nearly 200 countries, with a working credential list already compiled.

Put the two stories side by side. One supplies the keys. The other supplies an operator who doesn’t need to know what to do with them, because the agent does. Brute-force isn’t even the hard part anymore when valid logins are handed out in a text file. The attacker pastes a credential, the agent figures out the rest.

VPN concentrators and firewalls are exactly the wrong place to be soft right now. They’re internet-facing by design, they sit in front of everything, and a leaked credential against one is a straight shot past your perimeter. If your edge devices are still running single-factor VPN auth in 2026, you’re the easy target the agent’s operator was hoping for.

What actually slows this down

You can’t patch the existence of capable AI. You can make a leaked credential and an automated operator hit a wall instead of an open door. The good news is that the controls haven’t changed; the urgency has. Defense in depth was always the answer, and now it’s the only one that scales against an attacker who never gets tired.

Start with the things you can do this week:

• Kill single-factor VPN access. Phishing-resistant MFA on every edge device, no exceptions for the CFO or the legacy site-to-site tunnel. A leaked password should buy the attacker a second prompt, not a session.
• Rotate against the leak now. Treat FortiBleed as confirmed exposure if you run Fortinet edge gear. Force password resets, invalidate active sessions, and check for logins from residential and hosting-provider ASNs you don’t recognize.
• Put real brute-force controls on every auth endpoint. Rate-limit, lock out, and alert on repeated failures against VPN, RDP, SSH, and web logins. An agent-driven attacker will hammer methodically; make that noise expensive.
• Tighten threat detection on lateral movement, not just the front door. The agent’s strength is moving fast once inside. Alert on new admin sessions, unusual internal SMB and WinRM, and credential dumping behavior. Threat-protection that only watches the perimeter misses the part where the agent earns its keep.
• Shrink session lifetimes and bind tokens. If a stolen credential gets in, a short, device-bound session limits how long the operator and his agent get to roam.
• Inventory and harden the edge. Know every internet-facing device, its firmware version, and its exposed management interfaces. Security hardening on the appliances themselves closes the doors before anyone knocks.

None of this is novel. That’s the point. The defenders who get hurt over the next year won’t be the ones who missed some exotic new control. They’ll be the ones who knew the basics and kept treating them as optional.

Stop grading attackers on a curve

Threat models built around adversary skill are obsolete. We used to triage risk partly by asking how good the attacker would have to be, and we quietly downgraded the threats that required serious chops. An AI agent erases that calculation. The relevant question now is whether the attacker is motivated and whether you left a door open, because the competence gap gets filled by a subscription.

This is the same trend Bruce Schneier flagged in the government’s own AI sprawl, thousands of automated decision processes standing up faster than anyone can audit them. Capability is racing ahead of oversight on both sides of the fight. The defensive lesson is to assume your incident response will face an opponent who operates at machine speed with mediocre human judgment behind it. Fast, relentless, occasionally sloppy, and absolutely tireless.

Rehearse for that. Tabletop an intrusion where the attacker has valid credentials on day one and moves through your environment in minutes, not days. If your incident response plan assumes a human attacker who needs to stop and think, it’s already a generation behind.

Sources

• Low-skilled attacker used Claude, Codex to breach 14 companies
• FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices
• Sweeping Credential-Harvesting Heist Compromises 30K+ Fortinet Devices
• AI Use by the US Government