What is an agentic threat actor (ATA)?

An agentic threat actor (ATA) is a fully automated attacker whose operations are driven by a large language model (LLM) harness rather than a human at a keyboard. A human only sets an objective and tasks an LLM, then an ATA plans, adapts, and executes an attack with no human in the loop.

Published Date: Sep 23, 2026

Table of contents

Text Link

This is the block containing the component that will be injected inside the Rich Text. You can hide this block if you want.

What is an agentic threat actor, and how is it different from other attackers?

The Sysdig Threat Research Team (TRT) uses the term agentic threat actor (ATA) to describe a fully automated attacker whose operations are driven by a large language model (LLM) harness, rather than a human at a keyboard. Unlike AI-assisted attacks, an ATA plans, adapts, and executes an attack with no human in the loop beyond setting the original objective.

This is important because ATAs greatly increase the speed at which attacks can occur and evolve, as well as lowering the skill floor for cyberattacks. Defenders need to make sure their security policies and programs are prepared to safeguard their organizations against this new kind of threat, in addition to traditional human-operated and AI-assisted attacks.

How does an agentic threat actor behave?

ATAs don’t run a single, fixed script, but in monitoring ATA threats, Sysdig’s TRT has found that they typically move through the same recognizable stages. Let’s take a look at the similarities between two cases of ATAs documented by the Threat Research Team — an ATA accessing an internal database and an ATA conducting container escape — both targeting the same marimo notebook vulnerability (CVE-2026-39987).

1. Initial access

Agentic threat actors exploit the same vulnerability classes as any other attacker. Here, both documented cases entered through the same pre-authentication RCE in marimo's unauthenticated /terminal/ws WebSocket endpoint.

2. Autonomous reconnaissance and enumeration

Once they’ve made it inside, ATAs generally enumerate broadly before acting narrowly. Where a human actor is more likely to conduct narrower, hypothesis-driven probing, an ATA will probe everything available, structure the output for reuse, and then decide on a course of action.

This can be seen in the container escape intrusion, where the attacking agent ran a battery of probes mapping its container context and every available breakout primitive before attempting any escape.

3. Privilege escalation

Once the ATA has conducted a full sweep of viable escalation paths, it will select one, adapt if its first choice fails, and move immediately to the next possible vector. ATAs will often also combine functionally different escalation types within a single attack.

In the container escape case, the agent found an exposed Docker socket and used it to spin up privileged containers with the host filesystem and namespaces bound in, reading command output back from container logs. When a specific bind-mount path was unavailable, it fell back to a second primitive (nsenter into the host's PID 1 namespace) without missing a beat.

Essentially, the individual techniques used by an ATA are generally well-known and common among human operators. What makes an ATA different is how quickly it completes tasks and switches between techniques.

4. Lateral movement

Like human operators, ATAs go from privilege escalation to lateral movement, stealing successive credentials to extend their reach through multiple systems and infrastructure layers. But without a human in the loop, ATAs move much faster, adapting midchain without needing to take time to plan a new approach if a credential doesn’t work or a login fails.

In the internal database access case, the agent moved from harvested cloud credentials to a Secrets Manager lookup to a bastion host to a full database dump, all in under an hour. The ATA ran eight simultaneous SSH sessions from six different egress IPs during its bastion phase, which both sped up the pivot chain and defeated detection built around correlating activity to a single source.

In the container escape case, lateral movement looked different: Rather than hopping across hosts, the ATA replayed a single stolen Kubernetes service-account token to reach the entire Secret store, collapsing what would normally take several steps into a single move.

In both cases, we can observe that without a human in the loop to make decisions and reassess approaches, adaptation and pivoting occur continuously and without pause throughout this stage.

5. Objective execution

Human threat actors tend to perform extraction cautiously and incrementally. By contrast, once an ATA reaches the data it’s targeting, it typically conducts extraction in a single, comprehensive pass. In the database pivot case, the ATA bundled six separate table queries into a single batched command to retrieve everything in one round trip. In the container escape case, the ATA listed and dumped every Secret from a Kubernetes namespace into one token replay, including database credentials, AWS keys, an OpenAI API key, a Slack webhook, and SSH keys. In both cases, rather than trying to minimize its footprint, the ATA aimed to grab the maximum available data in one pass.

How can you tell an agentic threat actor apart from a human actor?

Generally speaking, ATAs aren’t inventing new techniques. Their behavior differs from human threat actors in how they rapidly and easily choose and adapt known techniques in response to live results. Beyond this, however, there are several key indicators that separate an ATA from a human actor, or even an AI-assisted attack. These include:

A leaked internal monologue. ATA payloads are often self-narrating, containing natural language reasoning, target prioritization, and the kind of detailed annotations that human operators don’t usually write but LLM-generated code produces reflexively.
Commands shaped for consumption by machines instead of humans. Too much formatting that’s clearly intended for a downstream parser rather than a human eye, such as echo '---', bounded output caps (head -30, head -40) that keep a context window clean, batched multi-query HEREDOC calls designed to return everything in one round trip, disabled pagers, and suppressed error noise (2>/dev/null), are a clear tell of an ATA. This is not a pre-built playbook for a known target, but commands for a consumer that has to read the output and decide what to do next: in other words, an LLM agent in a tool-use loop.
A chain that reuses its own output. An ATA will tend to lift values directly out of earlier command results when convenient, while making use of generic guesswork elsewhere. That asymmetry is not how a playbook author would behave, but it’s entirely consistent with how agents handle context.
An attacker that validates its own delivery mechanism. An ATA will often unit-test before trusting a channel with live code, writing and sending throwaway payloads through its own delivery channel. Probes are issued with high retry multipliers and adapt to prior results between turns. Only when the staging harness is proven to work will the ATA deliver its real attack payloads. Again, this is not the behavior of a human at an interactive shell, but an entirely agentic threat actor.

Human Threat Actors vs. Agentic Threat Actors (ATAs)

Human threat actors vs. agentic threat actors (ATAs)

	Human threat actor	Agentic threat actor (ATA)
Human involvement during execution	Continuous at every decision point	Minimal to none once launched
Techniques used	Established tradecraft: credential harvesting, privilege escalation, lateral movement, exfiltration, etc.	Same established tradecraft; no novel techniques have been documented
Command authorship	Hand-typed and iterated live. Can include human errors	Mechanically staged, with payloads written in chunks, base64-encoded, decoded, and executed via a repeatable harness
Validation of tooling	Tests informally by running scripts and watching results	Multiple disposable payloads are sent through the delivery channel before committing to the real payload
Structuring output for reuse	Reads output visually, with no need to add delimiters	Delimits every probe with explicit markers so a later step can programmatically parse results out of a combined blob
Response to planted directives	Notices and ignores them	Reliably parses and acts on them, treating response bodies or shell streams as literal instructions
Handling failures and building contingency plans	Either plans backups in advance (i.e., has two attack path options) or otherwise aborts or falls to a hard-coded fallback when something new or unexpected comes up	Enumerates all viable options up front and adapts immediately when one fails, selecting a different path or technique without a visible pause; no contingency planning
Session parallelism	Generally sequential, paced by a single operator	Can run many sessions simultaneously across different sources specifically to defeat single-source-IP detection
Escalation approach	Typically pursues one identified path	May mix multiple, functionally different escalation types within a single operation
Known failure modes	Typical human mistakes, such as typos, logic errors, oversights, etc.	Can overstate findings or fabricate results during autonomous operation

What are some real world examples of agentic threat actors?

Agentic threat actors are increasing in number, and there have already been a range of high-profile cases, including:

JADEPUFFER, the first documented case of agentic ransomware. This is a complete extortion operation driven end-to-end by a large language model (LLM), which has rapidly evolved since its initial discovery to target AI models.
An autonomous cyberattack against the Taiwanese government, documented by Israeli AI company Dream. This is the first known case of an ATA targeting government agencies.
The two cases of ATAs exploiting the marimo notebook CVE-2026-39987; the LLM using a CVE to access an internal database and the AI agent-driven container escape.
The Open AI-Hugging Face incident. While this was not technically a malicious cyber attack, it’s still a clear illustration of how agentic AI can plan and execute an intrusion entirely autonomously, even generating instructions for other models to use.

Why do agentic threat actors matter for security?

Agentic threat actors are already active in the wild, and will only continue to increase in number and severity. This has several important implications for security.

First, ATAs collapse the skill floor for conducting a cyberattack. Where ransomware was once a craft for the highly skilled and business-savvy, we have seen now with JADEPUFFER that an LLM agent can chain reconnaissance, credential theft, lateral movement, persistence, and destruction without the operator possessing deep expertise in any one step. These ATAs also evolve incredibly fast both during and between campaigns, as seen in how rapidly JADEPUFFER upgraded its capabilities.

Secondly, security teams need to start adapting their methods and governance policies to take this new kind of threat into account. Detection programs based on analyses of human threat actors will miss the tells left by ATAs, as mechanically staged payloads and machine-speed chains don’t match the patterns security programs have historically looked out for.

How can you detect and defend against agentic threat actors?

So how can security teams ensure they’re ready to defend against ATAs? As discussed above, ATAs have yet to be seen using any novel techniques, so all the normal principles of good security apply, such as:

Prioritize runtime visibility across the host, container, and orchestration layers. Runtime visibility is the control point that matters most; the host, container, and orchestration layers are where the real damage occurred in each documented case. And with how quickly ATAs operate, runtime detections that enable fast, automated responses are more crucial than ever.
Make use of stateful detections. Traditional detection engines built for human-paced threats can’t keep up with the speed of ATAs, whereas stateful detections are not only faster but provide higher-quality detections.
Take care of your technical debt. Risks that organizations could safely categorize as acceptable or low priority in the past, due to being difficult or expensive for human actors to exploit, are now easy targets for ATAs. Almost every documented ATA has exploited known, often years-old vulnerabilities or misconfigurations.

But there are also newer best practices teams should strive to follow:

Plant and monitor for canary or prompt injection directives. These are traps set specifically to catch agentic behavior. A human will identify the instruction and ignore it. If it fires, you know you’re dealing with an ATA.
Correlate sessions across sources, not just source IP. ATAs fan out across multiple egress points to defeat detections built around a single source. Correlate by behavior and timing, not just origin.
Look for machine-shaped commands. Delimited output for parsing, bounded results, suppressed error noise, and disposable rest payloads are tells of an LLM reading its own output. Detecting these commands will trigger on an ATA earlier than detections keyed in on malicious commands.