Defaulting on tech debt: When the bill comes due, AI is the collector

There is no question that agentic AI has radically altered discussions around cybersecurity. In November 2025, Anthropic disclosed that hackers had used Claude to automate a malicious campaign. In July 2026, the Sysdig Threat Research Team (TRT) exposed JADEPUFFER, the first fully autonomous ransomware campaign run end-to-end by an AI agent. And most recently, OpenAI shared that one of their frontier models was responsible for an attack against Hugging Face that ran 17,000 events in a single weekend. 

These agentic threats are at the forefront of every security leader’s mind. In fact, almost every attendee at a recent Sysdig event marked AI as being a “high” or “very high” priority for their security teams. Clearly defenders are looking for practical advice on how to think about this evolution. 

The Sysdig TRT has established a record of exposing new trends in the threat landscape. Now, halfway through 2026, an interesting throughline has emerged: almost none of these agentic threats include new kinds of failure. Instead, these failures can be characterized as different types of debts that AI has exacerbated — tradeoffs made in favor of speed and efficiency that have created undue risk and exposure in an increasingly agentic world. What is new, however, is that the debts teams have deferred have now come due.

To follow the metaphor, AI is both the one opening new lines of credit for organizations — helping organizations automate otherwise manual tasks, improve the speed of scale of what teams can deliver, and so on — and AI is also the collector in this new cost/benefit landscape, as threat actors have access to the same benefits as other users, often with far fewer guardrails. 

To that end, there are five main debts AI is making businesses pay for:

1. The code that was never fixed.
2. The infrastructure that didn’t scale properly. 
3. The oversight teams didn’t build.
4. The skilled workforce bench they haven’t been staffing.
5. The AI attack surface they created the moment they deployed the tools. 

Every one of these debts is payable — if you pay deliberately, instead of at default rates. Put simply, AI has made it easier for threat actors to exploit organizations’ technical debt. Security teams must use this moment, with AI-assisted attacks and agentic threat actors (ATAs) on the rise, to pay down that debt before they default.   

What recent attacks teach us

The Sysdig TRT ran a meta-analysis of eight publicly documented AI-enabled operations, from nation-state espionage through experimental malware to the first agentic ransomware, mapping each to MITRE ATT&CK (the victim-side tradecraft) and MITRE ATLAS (the AI operator layer). 

The corpus includes: 

• GTG-1002 (the China-nexus multi-agent intrusion disrupted by Anthropic, run largely autonomously across ~30 targets).
• PROMPTSTEAL (APT28, deployed in Ukraine).
• QUIETVAULT (credential stealer using on-host AI to hunt GitHub and npm tokens).
• PROMPTFLUX (dropper calling Gemini to rewrite its own code).
• FRUITSHELL (reverse shell shipping prompts built to defeat LLM-based code review).
• HONESTCUE (just-in-time obfuscation via Gemini).
• Two Sysdig TRT cases, the marimo intrusion (CVE-2026-39987) and JADEPUFFER, both detailed below.

Three findings structure everything that follows:

• AI contributed nothing new to initial access in any of the eight cases. Where an entry vector is documented, it was conventional — a server-side request forgery (SSRF), a known CVE, stolen credentials. The documented evidence says the model takes over after the door is open: orchestration, post-exploitation, evasion. Your initial-access controls are defending against the same attacks they always were.
• There were no new MITRE attack techniques. Seven of eight operations ran T1059, Command & Scripting Interpreter, the single most ordinary technique in the framework. Below it: credentials in files, data from local system, exfiltration over C2, routine discovery and lateral movement. The victim-side picture is a decade old.
• All of the novelty is in who's running the attack. Jailbreaks and guardrail bypasses, models generating commands at runtime, autonomous orchestration across targets. The attack didn't change, the operator did. That’s where it becomes a matter of speed and scale.

With the evidence on the table, the ledger begins: five debts, one collector.

Debt 01 — Code: Decades of "we'll fix it later" is now machine-readable at scale

The backlog was always there. Every organization carries years of known-but-unprioritized vulnerabilities, unpatched dependencies, and "accepted risk" tickets that were accepted mostly because exploitation was expensive. The economics held because finding and weaponizing a bug took a lot of human attention and hard-to-acquire technical skills, both scarce inputs.

Those inputs are no longer scarce. The marimo case is the clean demonstration: an ATA gained entry through an ordinary CVE, then composed the entire post-exploitation chain live — credential harvesting, an AWS Secrets Manager call, an SSH pivot, a full PostgreSQL exfiltration — in under 10 hours, adapting to the environment's responses as it went. Nothing about the target's exposure was new. What was new was that the cost of collecting on that exposure dropped to approximately the price of tokens.

That's the thesis in one sentence: zero-days are old types of failures, found and exploited faster. The vulnerability categories haven't changed since before some of the people reading this entered the field. The exploitation rate did.

Debt 02 — Infrastructure: The load is the debt

The same acceleration that finds bugs faster is also crushing the platforms everything runs on, but no adversary collects this debt. AI adoption itself does. That distinction is important, but the outcome can be identical: An outage caused by agent-driven load produces the same line items on the board's ledger as an adversary-caused incident. Work stops. Customers lose trust. Brand takes a hit. Revenue is lost. The cause differs, but the impact column does not.

For example, in March 2026, Cloudflare's CEO predicted automated traffic would overtake human traffic by 2027. He was wrong — it happened in June 2026, when Cloudflare's own measurements showed automated systems generating 57.5% of HTTP requests. The asymmetry driving it is structural: a human completing a task might visit five sites; the agent doing it on their behalf might visit 5,000. This exponential increase in internet traffic has downstream implications for every web-hosted service, and all organizations should ask themselves one question: Are our teams prepared to handle the increased load from AI agents?

The platforms many have built on and the pipes through which everything runs were sized for a slower world. Load curves are outrunning the forecasts of the very people whose job is forecasting them. If your capacity plan — or your dependency on someone else's plan — was written before agents started committing code, it's already stale. The load is the debt, and adoption is compounding the interest.

Debt 03 — Governance: Capability shipped, oversight didn't

AI adoption is compounding another kind of interest, too. In May 2026, six national cyber agencies — CISA, NSA, Australia's ASD ACSC, the Canadian Cyber Centre, NCSC-NZ, and NCSC-UK — published the first coordinated multigovernment security guidance for agentic AI, titled “Careful Adoption of Agentic AI Services.” The core concern is permission aggregation: Agents accumulate authority across systems, so a single compromise grants reach that no individual credential would.

That concern is no longer hypothetical, and the demonstration came from the Sysdig TRT’s own research: JADEPUFFER, the newest case in the corpus above, is the first known ransomware operation managed end to end by an AI agent. That includes reconnaissance, credential theft, lateral movement, persistence, encryption, destruction, and the ransom note itself. A human provisioned the infrastructure and picked the victim, and the agent ran the operation, at one point going from a failed login to a working fix in 31 seconds.

Read as a governance case, JADEPUFFER is the poster child. The permission-aggregation risk the Five Eyes guidance warns about is exactly what the agent exploited on its way in: It harvested credentials for four separate AI providers plus cloud accounts from a single compromised host, then pivoted to a production database with root credentials. And every debt it collected was a governance debt, not a technical novelty. The entry point was an internet-facing Langflow instance unpatched for over a year, the pivot rode a 2021 authentication bypass and an unchanged default signing key, and the destroyed configurations were unrecoverable even with payment because the agent never saved its own encryption key. An unpatched internet-facing instance nobody patched is, functionally, an unmanaged asset nobody was tracking. The controls that would have stopped this at three separate points are the ones the guidance prescribes: least privilege, fail-safe defaults, inventory, and logging.

But this is not an isolated failure. The Cloud Security Alliance's April 2026 survey of 418 IT and security professionals found 65% of organizations had experienced at least one AI-agent-related incident in the past twelve months, 82% had discovered previously unknown agents running in their environments in the past year, and only 21% maintain a formal process for decommissioning an agent at all. The gap between deployed capability and functioning oversight is not a projection but a measured baseline.

Here's the kicker: The recommended controls already exist, in the form of least privilege, fail-safe defaults that limit blast radius, comprehensive logging, humans in the loop for consequential actions, and so on. Nothing in the guidance required inventing new security science, just six governments to say, jointly, that the existing science applies to agents before they're trusted in production. 

The debt isn't a missing control catalog; it's the gap between the catalog and what's actually funded and enforced. And there's a detection dividend for whoever closes it. JADEPUFFER's agent, for instance, narrated its own objectives in plain-language comments across more than 600 payloads. That’s a tell that human operators rarely (if ever) leave, and one that only helps you if you can see what's executing at runtime. A control you can't observe is a control you can't enforce.

Debt 04 — Skill: The bench is being cut from the bottom

For security, having humans in the loop is a control. This raises the question of whether we're still producing humans who are up to the task. There are two halves to this debt, and the first is structural.

The SANS/GIAC 2026 Workforce Research Report, which surveyed 947 security leaders, found that 60% of CISOs now name skills, not headcount, as their gap. This is a spread that jumped from four points to 20 in a single year. The hiring response is senior and top-down. And the cuts are landing on the entry rungs: SOC analyst roles down 32%, threat intel down 26%, incident response down 22%. Cutting the entry rungs doesn't just cost the industry tomorrow's senior security practitioners, it strands today's. Advancement stalls, and the experienced people you fought to hire leave for somewhere they can actually move. 

And there is a second cost that gets less attention than it deserves: AI has an inherent accountability challenge. A model is not a person. It cannot own a decision, sign off on a risk, or answer for a mistake. Here, where AI becomes the operator, and humans become orchestrators, is where oversight and accountability again become critical. This is an industry-wide challenge that has driven much discussion with no clear answer.

There's also the question of knowledge degradation. Security practitioners across the industry have expressed concern that growing reliance on AI could erode the judgment and critical thinking needed to evaluate AI-generated decisions over time. The defining challenge for organizations will be using AI to improve productivity while also ensuring they continue to develop the expertise required to operate securely, particularly during situations where AI may be unavailable, such as a major outage.

Now connect the parts. AI is absorbing exactly the work that used to build judgment — the first scripts, the first triage, the first reviews, the places where mistakes were cheap — at the same moment the entry-level roles built around that work are increasingly being delegated to AI. Recall GTG-1002: The model frequently overstated and sometimes fabricated its findings, and the operation depended on humans competent enough to catch it. Skill is a resource that can only be renewed through experience and practice.

Debt 05 — AI attack surface: The AI you deployed is now a target

Here’s a debt that didn't exist five years ago. Every copilot, customer-facing assistant, and agent with production access is one more thing to attack and one more thing to secure. Google's Threat Intelligence Group now describes AI as "both an engine for adversary operations and a high-value target," and the operator layer from the meta-analysis isn't just the attacker's tooling anymore. It's yours.

Three facts locate the exposure: 

• Your own AI is in scope: If it can read your data or act on your systems, it's a part of your attack surface. 
• Attackers are already there: Prompt injection is listed as #1 in the OWASP Top 10 Vulnerabilities for AI applications, holding the top slot across two consecutive editions. 
• The keys are everywhere: Agents run on machine identities, which — per the Sysdig 2026 Cloud-Native Security & Usage Report — make up over 97% of identities in cloud environments and are 7.5 times riskier, with roughly 40% of breaches beginning with credential exploitation. That sprawl is the keyring an attacked agent inherits; it's the same keyring JADEPUFFER walked away with.

One asymmetry is worth naming, because it's why this debt gets its own line instead of folding into the others: This is the only debt that also opens new lines of credit. The same capability that expands your attack surface is available for your defense, if it's governed like the production asset it is.

Every debt on this sheet is payable

None of this is a bankruptcy filing. The payment is the same every time: deliberate investment in people and process, not just tools. And for each debt listed, there is something you can implement starting tomorrow:

1. Code: Point the same AI inward and find your own backlog first. Monday version: Pick the ten oldest "accepted risk" tickets in your register and re-price them against a world where exploitation costs tokens, not analyst-weeks. Most were previously accepted under economics that no longer exist today.
2. Infrastructure: Fund capacity and containment ahead of the curve. Monday version: Ask whoever owns your capacity plan one question — What assumptions does this make about the ratio of automated to human traffic, and when were they written? If the answer predates agentic workloads, the plan is stale.
3. Governance: Adopt the Five Eyes playbook rather than drafting your own from scratch. Monday version: Inventory every agent with production access and write down, for each one, its effective permissions and where its actions are logged. The inventory will be shorter than the permission list. That gap is the work.
4. Skill: Structure the pipeline deliberately. Monday version: Identify one category of entry-level work you're about to automate away and redesign it as supervised judgment-building instead of eliminating it — triage with review, first-pass analysis with a senior signing off. The output was never the point of that work; the judgment was.
5. AI attack surface: Treat your AI infrastructure like any production asset. Monday version: Add your copilots, assistants, and agents to the same asset inventory as your servers, with an owner, a scope, and monitoring. Build AI bills of material (AIBOMs). If it isn't in the inventory, it isn't being defended.

Runtime is where the payment lands, because runtime is where the collector shows up. The tooling and the playbook mostly already exist. What's left is the investment.

Three questions to take to your team today

1. Which of the five debts — code, infrastructure, governance, skill, AI attack surface — is most underfunded for you right now? Could you produce a current inventory list of agents with production access?
2. Where are you already seeing time-to-exploit collapse in your own environment?
3. If AI absorbs the entry-level work, how are you planning to train your next generation?

‍