Every heist story needs an accomplice who knows the locks. Four security reports published between October 19 and 21, 2026, describe a new kind of accomplice that runs as software, and this article sets out what they found, where their limits are, and what defenders can do about it.
Here is the short version. In the cases these researchers studied, humans chose the targets. In SOCRadar’s case, a human also approved every step. AI agents did much of the actual work. And when a model refused, at least one operator handed it a fake permission slip.
A human decides, an agent does the work
SOCRadar’s Threat Research Unit examined exposed servers used by ransomware affiliates. It describes, with high confidence, an “AI-executed, human-approved operating structure.” In its words, the human operator “directs and approves.” The AI side, SOCRadar says, planned reconnaissance, selected techniques, generated commands, triaged stolen data and drafted reports. Each campaign started with a victim-specific master prompt, and the AI waited for the operator’s approval before every step.
NorForge looked at a different tool, an AI-driven penetration-testing system called Cairn. Its description is plain: “Give it a target and an objective, and it can coordinate AI agents to investigate the target, search for security weaknesses, and attempt to break in.” A human operator can add hints to a shared project board that every agent can read.
CrowdStrike reports the same shift in its own cases. Between May and August 2026, it documented incidents in which threat actors used AI “to conduct agentic campaigns in which AI agents make decisions and execute commands.”
So the division of labor looks like this. The person supplies the intent and the yes. The agent supplies the labor.
The fake permission slip
The models in these cases did sometimes refuse. The reports show how thin that refusal can be when the request arrives in costume.
SOCRadar found that the models in its case were standard commercial models, not specially “uncensored” ones. On refusals, its finding is specific. “When models refused, the operator rewrote requests as ‘Authorized Red Team Assessment Request’ templates instead of switching models.” The template borrowed the language of authorized security testing.
NorForge saw something similar on one panel. Projects there “start out claiming to be authorized assessments of various sites, but then gradually become more explicit about exploiting the targets”. NorForge rates that actor as malicious with low confidence, so treat it as a signal rather than proof.
The refusals were not useless. CrowdStrike notes that one operator “periodically had to intervene to overcome the model’s safety guardrails.” Unit 42 found test scripts showing “repeated attempts to defeat model safety controls with a prompt-level override,” which it calls “evidence of resistance the actor worked to overcome.” My reading is that the guardrails added friction without stopping the operators who kept trying.
Here is my interpretation, from the psychology side. A refusal is a judgment about intent, and intent is the one thing a request can fake. The slip does not change the work being asked for. It changes the story around the work, and the story is what the model was judging.
Skill is no longer the gate
The second thread in these reports is who the humans were. Some of them were not experts.
CrowdStrike calls one of its four actors the “least sophisticated of the four.” It says that despite “their limited grasp of security fundamentals,” this actor still used AI agents to run intrusion campaigns.
Unit 42 describes a single actor who “used basic tooling and relied on AI-generated scripts and reconnaissance reports, suggesting they didn’t have the skills these activities would have required before the advent of readily available AI tools.” Unit 42 reports a confirmed intrusion against a university and the theft of student personal data. It draws the lesson in one line. “This case illustrates how AI lowers the skill barrier for cybercrime.”
CrowdStrike’s forward look matters most for defenders. Over the next 12 months, it expects that “some low-skill threat actors will likely use agentic AI to conduct campaigns at a level of effectiveness and scale previously only achievable by organized criminal groups or state-nexus actors.” That is an assessment, and CrowdStrike labels it as one. It also assesses with high confidence that agentic AI-supported intrusions “will almost certainly increase in volume and sophistication.”
The accomplice keeps a diary
There is a twist worth noticing. Most of what we know here comes from the attackers’ own mess.
CrowdStrike’s four actors “left their offensive agent frameworks exposed via open directories.” SOCRadar’s campaign “came to light in late September 2026 after OPSEC failures left the operators’ source code, credentials and AI session logs exposed.” SOCRadar adds: “This reliance on AI memory became the operation’s weakness.” NorForge concludes that “securing their own infrastructure does not appear to be among their strengths.”
An agent that does the work also writes everything down. Plans, findings, approvals and stolen secrets sit in one place. For a careless operator, that record reads like a confession.
Two cautions keep this from becoming comfort. First, CrowdStrike expects that some threat actors “will likely improve the OPSEC of their agentic intrusion campaigns over the next 12 months.” The diaries may not stay open. Second, the exposure hurts victims too. NorForge’s secrets scan of the exposed panel data turned up credentials and other secrets. It also found apparently legitimate red team work exposed the same way, “potentially placing clients at risk.”
What defenders can take from this
These steps follow from the reports. They are my recommendations, not the researchers’.
Treat a model’s refusal as a speed bump. If your security depends on an AI model saying no, the SOCRadar case shows that a reworded request can get around it. Real authorization for testing belongs outside the prompt, in a signed scope that a person checks.
Make approval mean something on your side. The attackers’ human approved each step, and the agents moved. Inside your own organization, any human approval of an agent’s action should be a real decision. That failure mode is the subject of Rubber-Stamp Oversight.
Know which agents you run and what they can touch. You cannot govern agents you have not listed, and an AI inventory is the starting point.
Ask your red team where its dashboards live. NorForge found apparently legitimate testing work sitting on unsecured panels. If you hire testers who use AI agents, ask how they protect the findings about you.
Plan for more of this. CrowdStrike’s high-confidence assessment is that these intrusions will grow in volume and sophistication. A low-skill attacker with a patient accomplice belongs in your threat model today.
The accomplice in these reports never sleeps. For now, it also never forgets, and that record is the best witness defenders have.
This article reflects the author’s personal views, not those of any employer, and is based on publicly available reports by SOCRadar, NorForge, CrowdStrike and Unit 42 (Palo Alto Networks), as available on October 28, 2026. It is not affiliated with or endorsed by any of them, and quoted findings and assessments are theirs. It is general information, not security, legal or professional advice, and reading it does not create any advisory relationship. Get qualified advice before acting on how it applies to your organization.