This article examines recent threat-intelligence reporting from Google, Microsoft, and Anthropic on the malicious use of AI. The central question is not simply which new threats have emerged, but how AI is changing the organization and tempo of attacker operations.
One development is particularly significant. Alongside advances in AI agents, open-weight models are becoming better at coding and other multi-step tasks, while improvements in quantization and inference tooling are making private deployment more practical.
Z.ai’s GLM-5.3 illustrates this trend. The company positions the model for complex coding and long-horizon agentic workloads and reports substantial gains in vulnerability discovery and exploitation benchmarks. Z.ai has also released GLM-5.3-Flash, a more computationally efficient variant that retains strong coding and agentic capabilities while supporting local deployment. Models of this scale still require substantial compute, but the direction is clear: capable AI systems are becoming more practical to run on privately controlled infrastructure, beyond provider-managed APIs.[1]
Local deployment does not make a model inherently dangerous. It does, however, remove an important control point. Once a capable system runs on private infrastructure, it no longer has to operate through a commercial provider’s API, where rate limits, abuse monitoring, account controls, and provider-side intervention remain possible.
From Assistance to Execution
This broader shift makes one incident described by Google Threat Intelligence Group particularly relevant.
In the second quarter of 2026, attackers compromised a cloud resource and, in less than six hours, planned, built, and launched agent-enabled infrastructure for large-scale credential harvesting. Google reports that the operation used agentic workflows to scan for vulnerabilities, resolve operational errors, rotate IP addresses, and collect credentials, substantially reducing human-in-the-loop latency.[2]
Traditional incident analysis might focus first on the exploit involved. In this case, a different question is at least as important: how much human effort was required between initial access and the final operational outcome?
The reports from Google, Microsoft, and Anthropic examine different populations of activity, including provider telemetry, incident-response observations, and misuse detected within specific AI platforms. They should not be treated as a representative sample of cybercrime as a whole, and their findings are necessarily shaped by what each organization is able to observe. Read together, however, they indicate a consistent change in the role AI is beginning to play within attacker workflows.
The use of LLMs by attackers is no longer novel. Reconnaissance, phishing translation, code generation, debugging, vulnerability analysis, and the processing of stolen data have appeared in threat-intelligence reporting for several years.
In March 2026, Microsoft described AI primarily as a force multiplier: a technology that reduces technical friction and accelerates existing tradecraft while leaving objectives, targeting decisions, and deployment under human control. Microsoft also reported early experimentation with agentic systems, although it had not yet observed their large-scale use by threat actors.[3]
The more consequential development may therefore lie not in individual AI-assisted tasks, but in the coordination between them.
Fewer Handoffs, Shorter Latency
AI is beginning to reduce not only the time required to perform individual tasks, but also the number of points at which an operation must stop and wait for another person.
A conventional operation may depend on several distinct areas of expertise. Someone conducts reconnaissance. Someone evaluates a vulnerability. Tooling must be written or adapted. Infrastructure has to be deployed and tested. Once access has been obtained, the internal environment must be understood, relevant data identified, and the next action selected.
A sufficiently capable operator may perform several of these functions alone. Even then, the work involves repeated context switching, manual interpretation, troubleshooting, and the transfer of information from one stage to the next. Agentic workflows can absorb part of this intermediate work.
An agent can take reconnaissance results, test several approaches, modify a script after an error, retry an operation, retain discovered credentials, and proceed to the next task. The human operator may no longer need to intervene after every technical step. Human involvement can instead move toward defining objectives, evaluating results, and making higher-level decisions.
This does not mean that AI has replaced attack teams or that autonomous systems are independently conducting end-to-end attacks. Microsoft emphasizes that human operators continue to control objectives, targeting, and deployment.[3]
There is, however, a large operational space between a conventional copilot and a fully autonomous attacker. Much of the current change appears to be taking place within that space.
Anthropic’s September report provides several examples. The company describes operations in which AI systems were used across reconnaissance, exploitation, credential harvesting, malware development, and post-compromise analysis. At the more autonomous end of the spectrum, Anthropic observed multi-agent systems operating across multiple victims while humans retained control over decisions such as target selection, monetization, and review of results.[4]
The underlying techniques remain familiar. Credentials are stolen, known classes of vulnerabilities are exploited, and established forms of web attack continue to appear. What is changing is the amount of human coordination required to move from one stage to the next.
The relevant compression is therefore not necessarily in the number of attack stages, but in the number of human pauses between them.
Every manual handoff, context switch, troubleshooting cycle, or wait for a specialist introduces latency. Agentic systems can absorb part of that delay by carrying context forward and handling intermediate decisions without requiring a person to intervene at every stage.
Google describes this as a reduction in human-in-the-loop latency, compressing the response window available to defenders.[2] A single operator can define the direction of an operation while an AI system performs a growing number of intermediate actions between major decisions.
The human operator has not disappeared. The distance between human intent and technical execution has become shorter.
Operational Sophistication and Team Size
One implication is that operational sophistication may become a less reliable proxy for organizational capacity.
Custom tooling, rapid adaptation to a target environment, parallel activity across multiple systems, and the ability to process large volumes of data once provided at least some indication of the resources available to an attacker. Some of the functions that previously required organizational capacity can now be performed with compute, capable models, and agentic tooling.
This may prove more consequential than isolated improvements in phishing quality or malware generation. Attack techniques do not have to become radically more advanced if the labor and coordination required to combine them decline substantially.
A technically competent individual does not become equivalent to an experienced red team or a well-resourced threat group. Reliability, operational security, strategic judgment, and specialized knowledge remain important constraints. The gap between what one person can coordinate and what previously required several specialized roles may nevertheless be narrowing.
The result is a change in operational economics even when the techniques themselves remain largely unchanged.
Local Deployment and Provider Visibility
Local deployment adds another dimension to this shift.
Cloud-hosted AI retains a centralized control point. A provider may detect certain forms of misuse, restrict access, suspend accounts, update safeguards, or investigate suspicious activity. Provider visibility is also one reason companies such as Google, Microsoft, OpenAI, and Anthropic can publish detailed threat-intelligence reports.
The situation changes when an open-weight model runs on private infrastructure.
Once model weights have been downloaded and inference occurs locally, the original provider is no longer necessarily part of the execution path. There may be no account to suspend, no centralized API through which requests must pass, and no provider-side record from which an operation can later be reconstructed.
Private deployment of highly capable models remains constrained by hardware requirements, inference costs, model quality, and the engineering difficulty of building reliable agentic systems. Those constraints are weakening, although not uniformly. Improvements in open-weight models, quantization, inference frameworks, and agentic tooling are gradually reducing the cost and complexity of private operation.
Available reporting does not establish that autonomous AI systems are replacing human attackers. The more defensible near-term conclusion is narrower: the gap between the capabilities of a technically competent individual and those of a small specialized team appears to be narrowing. At the same time, the effectiveness of provider-level controls increasingly depends on whether attackers use hosted or privately deployed models.
The Security Boundary Moves Outward
The evidence reviewed here does not support the conclusion that autonomous systems are independently conducting the full range of attacker operations. It points instead to a more specific change: AI is reducing the labor, coordination, and time required to translate an operator’s intent into technical action.
Local deployment matters because it removes a control layer on which many current safety measures depend. Provider-side controls remain valuable, but their coverage is architectural rather than universal. They operate when a model is accessed through an observable service. When model weights run on private infrastructure, the provider may have no visibility into prompts, tool calls, or downstream actions.
Model-level governance should therefore be understood as one layer of security rather than a complete security boundary.
An AI-enabled operation still depends on external resources: infrastructure, identities, credentials, compute, network connectivity, persistence mechanisms, and channels for monetization or other operational effects. These dependencies produce observable signals outside the model. The assumptions used to interpret those signals may, however, become less reliable as automation compresses timelines and allows individual operators to coordinate more activity in parallel. Detection and response processes that assume slow escalation, repeated human interaction, or a stable relationship between operational complexity and team size may therefore need to be reconsidered.
This suggests a more useful research agenda than asking whether an “autonomous hacker” has arrived. Future analysis should measure how AI changes operational tempo and capacity: the number of tasks delegated to agents, the frequency of human intervention, the time from initial access to objective, the number of targets handled concurrently, and the human and computational resources required per campaign.
These measures would help distinguish ordinary automation from a substantive change in attacker capacity. They would also make it possible to compare incidents across different models and deployment architectures without relying solely on provider-visible prompts or benchmark performance.
The central question is therefore not whether every capable model can be controlled after release. It is whether defenders can still attribute, assess, and disrupt attacks when models run privately, operations require fewer people, and human decisions are translated into action more quickly.