Agentic AI Attacks: What They Are and How a VPN Fits Into Your Defense

For a little while now, AI and Cybersecurity have been topics of conversation. The use of AI-powered chatbots by online scammers to create more sophisticated phishing emails was the first stage in the integration of AI and Cybersecurity. However, things are already moving on from this and complex cyberattacks are being planned, tools are being picked, and attacks are being adapted on the fly before being finally brought to a close without any form of supervision.

Security researchers call this agentic AI, and by late 2025, it was no longer a theory. A nation-state group used it to break into dozens of organizations with minimal human involvement, as Anthropic disclosed in its incident report. Malware started rewriting its own code mid-attack to dodge detection, according to Google’s Threat Intelligence Group. Entire hacking toolkits got wrapped around AI models so a single operator could do what used to take a full team, as The Hacker News reported on the Villager framework and SC Media reported on HexStrike AI.

This article breaks down what agentic AI actually is, how these attacks unfold in practice, and why habits that kept you safe a few years back are starting to show cracks. Then it gets practical, covering what a real defense strategy looks like today and where a VPN fits into that picture, whether you’re protecting a household or a distributed team.

What Is Agentic AI?

Agentic AI refers to systems built around a large language model that can set sub-goals, choose tools, take actions, and check the results before deciding what to do next. Instead of answering one prompt and stopping, it keeps working through the task on its own until it reaches the goal or hits a wall it can’t get past.

Agentic AI vs. Traditional AI vs. Generative AI

These three terms get used loosely, but they describe very different levels of independence. A quick side-by-side makes the distinction clearer.

Type	What It Actually Does	Decision Making
Traditional AI	Follows fixed rules or classifies data based on patterns it was trained on	None, output is predictable and bounded
Generative AI	Produces text, code, or images from a single prompt	Limited to that one response, no follow-through
Agentic AI	Plans a sequence of steps, uses tools and APIs, and adjusts along the way	Ongoing, the system decides its own next move

Core Components: Reasoning, Tools, Memory, Feedback Loops, Policies

Every agentic system, whether it’s helping a marketing team or running a cyberattack, tends to share the same basic architecture.

• Reasoning engine (LLM): the part that interprets the goal and figures out a plan of action.
• Tools and APIs: the hands of the system, letting it run scripts, query databases, or call external services.
• Memory: a record of what’s already been tried, so the agent doesn’t repeat failed steps or forget context.
• Feedback loops: a way to check whether an action worked so that the agent can course-correct.
• Policies: guardrails meant to keep the agent within approved boundaries, though these can be manipulated or bypassed.

How Agentic AI Makes Autonomous Decisions

To achieve a broad goal, an agent successively performs a set of tasks, for each of the tasks selects a set of tools, and for each tool it successively executes and reads the result of the tool execution. 

Hence, instead of stopping, calling a human for assistance with deciding what to do next, after a failed login attempt, the system decides what to do next on its own. This act, observe, and adjust to new information loop enables fast systems. However, in the wrong hands, these systems are dangerous.

What Are Agentic AI Attacks?

Definition: AI Systems That Plan, Execute, and Adapt Attacks With Minimal Human Input

An agentic AI attack happens when an AI system does most of the work on its own. It picks its targets, looks for vulnerabilities, creates or tweaks its own hacking code, navigates a network after breaking in, and extracts data, all while a human steps in only at a few key points rather than being involved in every single move.

Why They’re More Dangerous Than Traditional Cyberattacks

Three things separate these attacks from the kind of hacking most defenses were built around.

• Speed: an AI agent can make thousands of requests per second, compressing what used to take a team weeks into hours.
• Scale: a single operator can point the same agent at dozens of targets at once, something that used to require a much larger crew.
• Adaptability: When a script fails or a defense blocks it, the agent tries a new angle immediately instead of stalling until a human figures out what went wrong.

Real-World Examples of Agentic AI Attacks

The Anthropic/Claude Espionage Case

In mid-September 2025, Anthropic detected a Chinese state-sponsored group, later designated GTG-1002, using its Claude Code tool to run a large-scale espionage campaign. The attackers posed as employees of a legitimate cybersecurity firm and broke their attack into small, harmless-looking tasks to slip past Claude’s safety guardrails. 

Once inside that environment, the AI conducted reconnaissance, identified vulnerabilities, harvested credentials, moved laterally, and exfiltrated data from roughly 30 organizations across the tech, finance, chemicals, and government sectors. Anthropic reported that AI handled 80 to 90 percent of the operation, with a human stepping in for only four to six critical decisions per campaign, a detail also confirmed by SecurityWeek’s coverage of the disclosure. It’s considered the first documented case of a cyberattack executed largely without human involvement.

FortiGate Firewall Reconnaissance Attack

Between January and February 2026, a financially motivated, Russian-speaking actor compromised more than 600 FortiGate firewall appliances across 55 countries. What made this one notable is that no new vulnerability was involved. 

The attacker scanned for exposed management interfaces, brute-forced weak single-factor logins, and let AI models generate reconnaissance scripts and step-by-step exploitation plans. A custom framework, later named ARXON, connected the scan results straight to commercial AI services to keep the plan updated as new information came in. 

BleepingComputer’s investigation found the attacker’s own server had been left exposed online, which is how the operation was uncovered in the first place. It’s a good reminder that agentic AI doesn’t need a fresh exploit to be dangerous. Old-fashioned weak credentials and open management ports are still doing most of the damage, just faster now.

Self-Mutating Malware: PROMPTFLUX and LAMEHUG

Google’s Threat Intelligence Group flagged a new category of malware in late 2025 that queries an AI model while it’s actively running, rather than relying on code that was written once and left alone. 

PROMPTFLUX is a VBScript dropper that calls Gemini’s API to rewrite its own obfuscation code, aiming to regenerate itself hourly so antivirus signatures never quite catch up. It’s still considered experimental with no confirmed victims, but the direction is clear. 

PROMPTSTEAL, also known as LAMEHUG and linked to the Russian group APT28, takes a similar approach, querying an open-source code model via Hugging Face to generate file-collection commands on the fly during live operations against targets in Ukraine.

Automation Frameworks: Villager and HexStrike AI

Two open-source projects show how quickly AI-native offensive tooling has spread. Villager, built by a group called Cyberspike, pairs thousands of AI prompts with automated Kali Linux containers to run reconnaissance, exploitation, and lateral movement in a single pipeline, and it racked up roughly 11,000 downloads within two months of its release. 

HexStrike AI takes a different angle, acting as an orchestration layer that lets AI agents like Claude, GPT, or Copilot autonomously invoke over 150 security tools. Researchers at Check Point, as reported by SC Media, observed it being used to exploit recently disclosed Citrix vulnerabilities within days of them going public, well before most organizations had patched.

Common Attack Techniques Used by Agentic AI

Prompt Injection and Agent Hijacking

Attackers hide their instructions in content that an AI agent is likely to process, such as a webpage, document, or email. They hope the agent will treat these hidden instructions as real commands. Once they take control, the attackers can make the agent leak data, install malware, or give access it should not grant.

Memory Poisoning and Data Poisoning

Since agentic systems utilize memory to maintain context through multiple phases, injecting manipulated or fraudulent data into that memory can covertly influence subsequent choices to benefit an adversary. Data poisoning operates further up the chain, corrupting training sets or reference material so the underlying model’s reasoning is compromised before it even takes its first action.

Autonomous Reconnaissance and Exploitation

Rather than relying on human-led iterative scanning, autonomous agents can now traverse extensive IP blocks, identifying services and launching exploits against vulnerabilities without requiring manual intervention. This rapid cycle was central to the FortiGate incident, where reconnaissance and credential-based attacks operated in a continuous feedback loop with minimal human supervision.

AI-Driven Social Engineering, Deepfake Phishing, and Fraud

Agentic systems can now research a target’s public presence, draft a convincing pretext, and generate a voice or video clone to back it up, then adjust the script in real time if the target hesitates or asks a follow-up question. That kind of responsiveness used to require a skilled human scammer on the phone.

Full Lifecycle Ransomware Automation

From initial access through encryption to the ransom note itself, agentic tooling can now chain the entire ransomware playbook together, adapting to whatever defenses it encounters along the way rather than following a rigid script that stalls at the first sign of something unexpected.

Why Traditional Defenses Fall Short Against Agentic AI

Multi-Step, Continuous Attacks vs. One-Time Exploits

Most security tools are designed to catch one bad thing at a time, like a bad file or a suspicious login. But attacks these days are different. They happen in a series of small steps that don’t look dangerous on their own, but when you connect the dots, they can be really harmful. The problem is, traditional security defenses often miss these patterns because they’re looking for obvious signs of trouble, not a chain of small, seemingly harmless actions.

Legacy VPN and Perimeter Security Limitations in the AI Era

A simple VPN that only hides your traffic without using strong encryption or making it hard for others to detect, doesn’t really help when someone is checking lots of IP addresses to see what responds. And the usual way of keeping a network safe, by treating everything inside as trusted and everything outside as untrusted, starts to break down when an AI system is already inside and moving around quickly, faster than a human can keep up with in real time. 

This is because the AI can move from one part of the network to another, finding weaknesses and exploiting them before anyone can stop it. The old way of thinking about network security, with a clear inside and outside, just doesn’t work when the threat is already inside and can move so quickly.

Building a Defense Strategy Against Agentic AI Attacks

Zero Trust and Strong Identity Control

• Verify every request, whether it comes from a person or an automated agent, rather than assuming anything within the network is safe by default.
• Use short-lived credentials and enforce multi-factor authentication everywhere, especially on management interfaces exposed to the internet.

Network Segmentation

• Break the network into smaller zones so a compromised device or account can’t reach everything at once.
• Limit which systems can talk to which, cutting off the lateral movement paths that agentic attacks depend on.

Behavior-Based and Anomaly Detection

• Watch for unusual patterns like sudden bursts of requests, off-hours scanning, or access from odd locations rather than relying only on known malware signatures.
• Flag machine-speed activity that no human operator could realistically produce.

Human-in-the-Loop Checkpoints for High-Impact Actions

• Require manual approval before any AI agent, yours or an attacker’s, can take irreversible actions like deleting backups or changing firewall rules.
• Build in a pause for anything touching sensitive data or financial systems.

Limiting Outbound Traffic to Public LLMs

• Restrict which endpoints within your network can access commercial AI APIs, since that’s exactly the channel malware like PROMPTFLUX and PROMPTSTEAL depends on.
• Monitor and log any outbound calls to AI services made by systems that have no legitimate reason to do so.

How a VPN Fits Into Your Defense Against Agentic AI

Encrypting Data in Transit to Block Autonomous Reconnaissance

A major way these attacks begin is through automated scanning of vulnerable traffic and endpoints. Having strong end-to-end encryption on every connection is crucial, as it means that even if an AI-driven scanner detects your traffic, it won’t be able to read anything. 

This alone may not be enough to stop a determined nation-state actor, but it does block the simple, easy targets that most scanning tools are designed to find. By doing so, it makes it much harder for attackers to get a foothold.

Masking Network Entry Points from AI-Driven Scanning Tools

When it comes to protecting yourself online, using a VPN can be a really good idea. There are these frameworks like Villager and HexStrike AI that scan huge chunks of IP addresses to find active devices. But if you route your connection through a VPN, your real IP address is hidden behind the provider’s, so you won’t show up in those initial scans. 

This is important for individuals, not just big companies. For example, if you buy or sell stuff on peer-to-peer marketplaces like Depop, there are AI-powered tools that can scrape your seller data, location, and account patterns from public listings. By keeping your IP address masked while browsing or listing items, you can limit how much of your activity can be traced back to you. 

It’s like adding an extra layer of protection to your online presence. Plus, with a VPN, you can browse and list items without worrying about your IP address being tied to your activities. So, whether you’re a casual online shopper or a frequent seller, using a VPN can help keep your online activities more private.

Secure Remote Access for Distributed and Hybrid Teams

When people work together from different cities or countries, it makes the company’s system more vulnerable to attacks. Every network at home, public wifi, and personal device can be a way for hackers to get in. That’s why a good VPN is so important for people working remotely. It creates a secure connection back to the company’s system, no matter where they are working from. This is especially crucial now that some tools can quickly scan many remote connections, which used to take a lot of time to do manually.

Why Modern VPN Protocols Matter More Than Ever in the AI Threat Era

Not all VPN protocols hold up equally well against automated, high-volume scanning. Older protocols can be fingerprinted fairly easily by tools designed to detect VPN traffic patterns, which undermines part of their purpose. Modern, obfuscated protocols are designed to blend in with regular traffic and resist automated detection.

Factor	Legacy VPN Setup	Modern VPN Protocols
Encryption strength	Often outdated ciphers, sometimes optional	Strong, current encryption is enabled by default
Detectability by scanners	Traffic patterns are easy to fingerprint	Obfuscated tunnels that blend in with normal traffic
Speed under load	Struggles with multiple devices or heavy use	Optimized for stable performance across devices
Fit for hybrid teams	Limited, often just a basic tunnel	Built for consistent, secure access from anywhere

Where Astrill VPN Fits: Advanced Protocols, Encrypted Tunnels, and Consistent Protection Layers

AstrillVPN was built around exactly this gap. Its protocol suite, including StealthVPN for environments where regular VPN traffic is blocked or flagged, pairs strong encryption with traffic that’s much harder for automated detection tools to detect. 

That combination gives individuals a real layer of privacy against AI-powered scraping and scanning, and provides distributed teams with a stable, encrypted way to connect back to core systems regardless of which network they’re on. It’s not a replacement for zero trust, segmentation, or endpoint monitoring, but it closes one of the easiest paths these AI-driven tools rely on to get in.

Practical Steps to Prepare Your Business Today

Audit Your Current Security Stack

• List every internet-facing management interface, VPN, and remote access point, and confirm none of them are running on default or reused credentials.
• Check whether your current tools can detect behavior patterns, not just known malware signatures.
• Review outbound traffic rules to see who can reach public AI APIs and why.

Combine VPN Protection With Zero Trust and MFA

• Treat your VPN as one layer, not the whole strategy, and pair it with identity verification on every login.
• Require MFA on every account with administrative access, especially anything reachable from outside the office.

Build an Incident Response Plan for AI-Speed Attacks

• Assume an intrusion could unfold in hours rather than days, and set alert thresholds accordingly.
• Define who can approve emergency actions like isolating a device or revoking credentials without waiting for a full committee.
• Run tabletop exercises that simulate an AI-paced attack, not just the slower, manual intrusions most response plans were written around.

Key Takeaways

• Agentic AI can plan, execute, and adapt cyberattacks with only occasional human input, and real campaigns already prove it works at scale.
• Recent cases, from the Claude espionage campaign to the FortiGate firewall breach, show these attacks often succeed through old weaknesses like weak credentials, just executed far faster.
• Self-mutating malware and open automation frameworks like Villager and HexStrike AI are lowering the skill needed to launch sophisticated attacks.
• Zero trust, segmentation, and behavior-based monitoring matter more than ever, since agentic attacks rarely trip a single, obvious alarm.
• A modern VPN with strong, obfuscated protocols won’t stop every threat on its own, but it closes off the easy entry points that AI-driven scanning tools are built to exploit, for businesses and individual users alike.

Was this article helpful?

Yes No