AI in Cybersecurity: Attack and Defense

Last updated: October 26, 2026

What is AI in cybersecurity? It is the use of machine learning and AI agents on both sides of an incident. Attackers use AI to find flaws, write lures and run intrusions faster, and defenders use it to detect, triage and fix. In 2026 there is a third front: the AI agents your own teams deploy are now a new attack surface.

TL;DR: Key Takeaways

• Attackers have crossed a line. In May 2026, Google's Threat Intelligence Group reported the first threat actor it identified using a zero-day believed to be developed with AI, a two-factor bypass in an open-source admin tool.
• Speed is the real shift. CrowdStrike's 2026 Threat Hunting Report (vendor-reported) found that 88% of observed exploitation of vulnerabilities with public proof-of-concept code happened within 48 hours of release, and ENISA's 2026 report says 60.4% of unauthorised access incidents with a known vector involved a vulnerability.
• Defensive gains are measurable. IBM's 2026 breach report (vendor-reported) found extensive security AI and automation cut breach costs by $1.93 million and shortened breaches by 65 days, and NIST's draft Cyber AI Profile splits the topic into three focus areas.
• Agents are now targets. The OWASP Top 10 for LLM Applications 2026 ranks Excessive Agency third, up from sixth in 2025.
• Two EU deadlines matter now. Cyber Resilience Act reporting started on September 11, 2026, with a 24-hour early warning, while high-risk AI Act duties moved to December 2, 2027.

How Attackers Use AI in Cybersecurity Today

Attackers use AI to shorten the time between a vulnerability disclosure and a working exploit, to write more convincing lures, and to automate parts of an intrusion. The evidence in 2026 shows augmentation at scale rather than a fully autonomous attacker, but the gain in speed is already measurable.

AI-assisted vulnerability discovery and exploitation

According to Google Threat Intelligence Group (2026), a threat actor used a zero-day exploit that analysts believe was developed with AI. It was a Python script that bypassed two-factor authentication in a popular open-source web admin tool. The flaw was a semantic logic error, a hardcoded trust assumption, and analysts reached high confidence that a model assisted, citing evidence that included a hallucinated CVSS score in the code. Google says it does not believe its own Gemini model was used, and the vendor was notified.

The same report describes APT45 sending thousands of repetitive prompts to analyze CVEs and validate proof-of-concept code. It also states that actors have not yet found a way past the core safety logic of frontier models, and that Chinese and North Korean state-linked actors show interest in AI for vulnerability discovery.

The practical reading for a security team is narrow but important. AI lowers the cost of finding logic flaws, the kind that scanners built for memory bugs tend to miss. Your exposure review should therefore weigh authentication logic, trust assumptions and admin interfaces more heavily than before.

Speed follows from this. CrowdStrike's 2026 Threat Hunting Report (August 2026) found that 88% of observed exploitation of proof-of-concept-backed vulnerabilities occurred within 48 hours of release in the first half of 2026. Two named groups attacked within 24 hours of disclosure. Patching windows measured in weeks no longer match the threat.

Phishing and social engineering

AI does not change what social engineering is. It improves quality and volume. Google reports that actors use language models to write higher-fidelity phishing, and ENISA's 2026 report puts phishing at 77.8% of social engineering incidents in 2025.

CrowdStrike adds the downstream effect: vishing intrusions doubled, device code phishing attempts rose 15 times, and one group moved from account takeover to data theft in under five minutes. For defenders, a trained employee is still useful, but identity controls must assume the lure will be good.

Malicious use of agents and the software supply chain

AI tooling is also a delivery route. CrowdStrike (2026) reports that 87% of software registry threats in the first half of 2026 involved malicious npm packages, and one actor injected a malicious package into 131 trusted packages of a popular AI agent framework. Google tracked a campaign in late March 2026 that compromised widely used developer and security tooling packages and stole credentials, and found malicious packages disguised as agent skills.

CrowdStrike also describes one campaign that sent nearly 200,000 AI model requests in two minutes. That is machine-speed activity, which human review cannot keep up with.

From assisted to agentic attacks

ENISA's 2026 report analyzed 8,257 incidents from 2025 and concludes that attackers mainly use consumer-grade AI tools to augment existing skills. It cites a third-party report of an AI-assisted cloud intrusion that reached administrative access within eight minutes, and it assesses that AI will highly likely support more malicious operations, with human-out-of-the-loop proofs of concept possible in 2026.

The two views are compatible. Today's gain comes from compressing each step: research, exploit adaptation, lure writing and credential use. A defender who plans for a fully autonomous adversary may over-invest in rare cases, while one who plans for a faster version of today's adversary will fix the right things: patch speed, identity hardening and detection of machine-speed behavior.

How we read the evidence

We prefer 2026 primary sources, such as ENISA, Google Threat Intelligence Group and official EU texts. Where a number comes from a security vendor's own telemetry, such as CrowdStrike or IBM, we label it as vendor-reported and cite the report by title and date. Vendor telemetry reflects each vendor's customers, so treat these as directional.

How Defenders Use AI: Detection, Triage and Remediation

Defenders use AI to detect anomalies, triage alerts, automate repetitive SOC work, test their own systems and, increasingly, propose or apply fixes. The 2026 data suggests the benefit is real when AI is applied across the lifecycle with human oversight, not bolted onto a single tool.

IBM's Cost of a Data Breach Report 2026 (July 30, 2026), a vendor-reported study, puts the global average breach at $4.99 million. Organizations that used security AI and automation extensively had breaches that cost $1.93 million less and ran 65 days shorter.

SOC automation and red teaming

In a SOC, AI helps most with the repetitive steps that consume analyst hours: summarizing alerts, enriching indicators, grouping duplicates and drafting a first incident timeline. CrowdStrike reports that detection leads triggered by AI agents grew 2.5 times faster than those triggered by humans, a vendor-reported figure that signals where hunting effort is moving.

Red teaming is the second use. Automated attack generation lets a small team test models and agents against injection, data leakage and tool abuse on every release rather than once a year. It matters most for agents, where behavior changes with each prompt, tool and data source.

When you evaluate a defensive AI product, ask for three things: the false positive rate on your own data, the action it takes without approval, and the log it leaves for an auditor.

Where human oversight stays essential

The NIST Cyber AI Profile (NIST IR 8596), an initial preliminary draft published on December 16, 2025, organizes the topic into three focus areas: securing AI system components, conducting AI-enabled cyber defense, and thwarting AI-enabled attacks. The draft is organized around the NIST Cybersecurity Framework 2.0. It is a draft, so check the final status before citing it in a compliance document.

In practice, autonomous remediation should start with low-risk, reversible actions: ticket creation, enrichment, containment of a single endpoint. Changes to production identity, network or data stores still need a named approver. Our guide to human-in-the-loop AI agents covers approval design in detail.

The New Attack Surface: AI Agents as Targets

AI agents expand the attack surface because they read untrusted content, call tools with real permissions and keep memory across sessions. An attacker no longer needs to breach a server if they can persuade an agent to act. ENISA (2026) notes that AI applications are increasingly targeted, especially where they can access files, credentials or development environments.

Two OWASP lists give a shared vocabulary. The OWASP Top 10 for LLM Applications 2026 (August 3, 2026) covers the model and application layer. The OWASP Top 10 for Agentic Applications (December 9, 2025) covers autonomous behavior.

Read the table as a prioritization aid, not a checklist. Agency and unbounded consumption moved up, while improper output handling dropped five places even though the underlying risk remains.

Prompt injection and tool misuse

Prompt injection (LLM01) means untrusted text changes what a model does. In an agent, that text can arrive through a web page, an email or a tool result. The OWASP agentic list names the consequence as Agent Goal Hijack (ASI01) and Tool Misuse (ASI02). The control that works is not a better prompt. It is an enforcement point that inspects inputs and outputs and limits what each tool call may do. Our article on the AI gateway for agentic AI explains where that point sits for MCP and agent-to-agent traffic.

A short example shows why. An agent that summarizes inbound email and can also send messages reads a message containing hidden instructions. Without a control on the output side, the agent follows them and forwards sensitive data. Nothing in the model failed. The architecture gave one component both untrusted input and a powerful tool. Our article on what an MCP server is shows how tools are exposed to agents in the first place.

Memory poisoning and identity abuse

Memory and Context Poisoning (ASI06) persists across sessions, so one bad input can shape many later decisions. Identity and Privilege Abuse (ASI03) matters because agents often act with broad service credentials. IBM (2026) reports that 92% of organizations with an AI-related security incident lacked proper AI access controls, and that shadow AI, meaning unapproved AI use, was present in 43% of breaches, up from 20% a year earlier. See MCP authentication for how to scope agent access.

MCP and agent-to-agent protocols

Protocols create new trust boundaries. OWASP lists Insecure Inter-Agent Communication (ASI07) and Agentic Supply Chain Vulnerabilities (ASI04) as separate risks. A tool server, a skill or a peer agent can each carry hostile instructions. Treat each as an untrusted dependency: verify the source, pin versions, scope credentials per tool, and log every call. The supply chain data above shows why. CrowdStrike (2026) and Google both documented malicious packages aimed at AI tooling, so a skill or connector deserves the same review as any third-party code.

Governance and Regulation: AI Act, NIS2 and the Cyber Resilience Act

Three EU instruments shape AI in cybersecurity programs in 2026. The AI Act sets obligations for AI systems, NIS2 sets incident handling for essential and important entities, and the Cyber Resilience Act sets vulnerability reporting for manufacturers. Dates changed this year, so check each before planning.

Under the CRA, manufacturers send a 24-hour early warning, a 72-hour detailed notification, and a final report 14 days after a fix is available for exploited vulnerabilities. For AI products, this links vulnerability handling, patching speed and AI testing in one chain. NIS2 also lists supply chain security and vulnerability handling among its ten minimum risk measures.

The CRA applies to manufacturers of products with digital elements, so a company that ships software or connected devices into the EU needs a reporting workflow even if it never deploys an AI agent. Companies that embed AI components in those products inherit both sets of obligations.

This article is not legal advice. Confirm applicability with counsel.

A Practical Program: Inventory, Controls, Testing, Monitoring, Response

A workable program has five parts: inventory every agent and AI service, enforce runtime controls, test continuously, monitor behavior and prepare incident response. Start with inventory, because you cannot protect, test or report on systems you cannot see, and unapproved AI use is already common.

1. Inventory. List agents, models, tools, MCP servers, data sources and owners, including unapproved ones. Shadow AI at 43% of breaches (IBM, 2026) makes discovery the first control.
2. Runtime controls. Put policy at the point where agents call models and tools. Inspect inputs and outputs, scope credentials per agent and per tool, and block or transform unsafe actions.
3. Testing. Run adversarial tests against agents before release and after every change: injection, indirect injection, data leakage and tool abuse. Make a failed test stop the release.
4. Monitoring. Record prompts, tool calls and data accessed, and link findings to traces so analysts can reconstruct an incident.
5. Incident response. Add agent-specific playbooks: revoke an agent's credentials, quarantine a memory store, disable a tool server. Align reporting clocks with NIS2 and the CRA.

Measure the program with a few numbers that show control rather than activity: the share of agents with a named owner, the share of tool calls that pass through a policy point, the time from an agent change to a completed attack test, and the time to revoke an agent's credentials.

Security and Governance: Protecting AI Agents in Production

The enterprise risks are prompt injection, data leakage, tool misuse and excess permissions, and the data supports treating them as operational. IBM (2026) found that AI-driven attacks add about $1 million to the average incident, and OWASP ranks Excessive Agency third. Controls must work at runtime, because agents act faster than review cycles.

NeuralTrust, a Barcelona-based AI agent security company, offers four capabilities on its Runtime Security Mesh platform:

• Agent Runtime Security (TrustGuard) applies inline policy to inputs and outputs and can allow, block or transform a request. NeuralTrust lists prompt injection and poisoned tool results among the threats it covers, links findings to traces, and supports SaaS, hybrid and on-premises deployment. See Agent Runtime Security.
• AI Red Teaming (TrustTest) runs automated attack tests against models, agents and APIs. In CI/CD, a failed attack blocks the merge. See AI Red Teaming.
• Agent Posture Management (TrustLens) builds an inventory that includes agents that were never registered, scores risk and prioritizes remediation. See Agent Posture Management.
• Agent Gateway (TrustGate) routes model, MCP and agent-to-agent calls through one control point with per-agent and per-tool access control. See Agent Gateway.

These map to the program above: posture for inventory, the gateway and runtime security for controls, red teaming for testing, and traces for monitoring. They are vendor-stated capabilities, so validate them in a proof of concept against your own agents.

Which Approach Fits Your Organization?

Choose by maturity and by where agents run today. A team with a few approved copilots needs inventory and policy first. A team shipping its own agents needs testing in CI and a gateway. A regulated manufacturer needs reporting and traceability from the start.

Conclusion

AI in cybersecurity now has three parts that need separate owners: defending against AI-assisted attackers, using AI to defend faster, and securing the agents you deploy. The 2026 evidence shows faster exploitation, measurable defensive gains and clear agent-specific risks. Start with inventory, put controls where agents act, and test before every release.

Secure AI Agents in Production with NeuralTrust

See how NeuralTrust's AI gateway enforces policy on every model and tool call, and try it free.

Related reads

• AI Gateway for Agentic AI: MCP and A2A Security
• MCP Authentication: OAuth 2.1 Done Right for AI Agents
• Human-in-the-Loop AI Agents

1. What is AI in cybersecurity?

AI in cybersecurity is the use of machine learning and AI agents to attack, defend and secure digital systems. Attackers use it to find flaws and craft lures faster. Defenders use it to detect anomalies, triage alerts and propose fixes. A third area covers securing the AI agents and models an organization deploys.

2. How do attackers use AI?

Attackers use AI to analyze vulnerabilities, validate proof-of-concept code, write convincing phishing and automate parts of intrusions. Google Threat Intelligence Group reported in May 2026 the first zero-day it believes was developed with AI. ENISA says most attackers still use consumer-grade AI tools to augment existing skills rather than replace them.

3. How do defenders use AI in a SOC?

Defenders use AI to detect anomalies, summarize and enrich alerts, group related events and draft response steps. IBM's 2026 report found that extensive use of security AI and automation lowered breach costs by $1.93 million and shortened breach lifecycles by 65 days. Analysts still own severity, escalation and approval of risky changes.

4. Can AI replace security analysts?

No 2026 evidence in this article supports replacing analysts. AI handles volume, enrichment and first-pass triage, while humans decide on severity, business impact and changes to production systems. NIST's draft Cyber AI Profile frames AI-enabled defense as one of three focus areas, next to securing AI systems and thwarting AI-enabled attacks.

5. What are the biggest security risks of AI agents?

The OWASP Top 10 for LLM Applications 2026 ranks Prompt Injection first, Sensitive Information Disclosure second and Excessive Agency third. The OWASP Top 10 for Agentic Applications adds Agent Goal Hijack, Tool Misuse, Identity and Privilege Abuse, and Memory and Context Poisoning. Each risk grows when agents hold broad permissions.

6. Which EU rules apply to AI in cybersecurity?

The AI Act sets duties for AI systems, with stand-alone high-risk obligations moved to December 2, 2027 by Regulation (EU) 2026/1744. NIS2 requires a 24-hour early warning for significant incidents. The Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities from September 11, 2026. This is not legal advice.

7. How do I start securing AI agents?

Start with an inventory of agents, models, tools and owners, including unapproved ones. Then enforce policy where agents call models and tools, scope credentials per agent and per tool, and run adversarial tests before each release. Add agent-specific incident response playbooks and align reporting clocks with NIS2 and the Cyber Resilience Act.

About the Author

Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.

NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.

Sources

1. Google Threat Intelligence Group, AI Threat Tracker update on vulnerability exploitation, augmented operations and initial access, May 11, 2026.
2. CrowdStrike, 2026 Threat Hunting Report, August 3, 2026 (vendor-reported).
3. ENISA, 2026 annual threat report, September 2026 (covers January to December 2025).
4. IBM, Cost of a Data Breach Report 2026, July 30, 2026 (vendor-reported).
5. OWASP GenAI Security Project, OWASP Top 10 for LLM Applications 2026, August 3, 2026.
6. OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications, December 9, 2025.
7. NIST, IR 8596 Cyber AI Profile, initial preliminary draft, December 16, 2025.
8. European Union, Regulation (EU) 2026/1744 (Digital Omnibus on AI), July 8, 2026, in force July 27, 2026.
9. NCSC Ireland, EU Cyber Resilience Act: reporting obligations, applicable from September 11, 2026.
10. European Commission, NIS2 Directive FAQs, Directive (EU) 2022/2555.