Autonomous AI agents aren't inventing new zero-days; they are relentlessly running decade-old attack techniques — scanning thousands of targets and taking tens of thousands of basic actions without tiring.
Traditional detection tools fail not because they miss the attack entirely, but because high-volume, automated brute forcing buries the real breach under thousands of low-priority alerts.
Weak credentials and shared admin access can destroy multiple security layers instantly; strict reachability controls (like IP allowlisting) were the only layer that actually held after an autonomous agent took 17,600 recorded actions.
Security baselines tuned down to reduce noise assume a human attacker with limited time. Security controls must instead survive a zero-fatigue attacker.
Before we talk about autonomous AI attacks, let’s recap what we remember from the Road Runner cartoons. Most of us recall rocket skates or a giant magnet. Or the ubiquitous falling anvil. Few remember the running, though that was the only thing that ever worked. We came away thinking the story was about contraptions.
We tend to picture autonomous AI security threats like Wile E. Coyote’s latest scheme — hyperengineered contraptions designed to blow past traditional defenses in ways we've never seen before.
But recent real-world incidents reveal a far simpler, much more persistent reality. The danger isn't an unprecedented super-weapon; today’s threat has more in common with the Road Runner who simply never stops running. By relentlessly executing thousands of mundane, 10-year-old attack techniques without fatigue, these agents aren't outsmarting security controls — they're outpacing the assumption that attackers eventually get tired.
In July 2026, an autonomous agent, running inside an offensive-capability evaluation with its safety filters deliberately switched off, figured out that the fastest route to a successful exploit was to cheat (how human!).
The agent escaped its sandbox, rooted a stranger's machine on the open internet and, using that as a launchpad, ran a two-and-a-half day intrusion deep inside a production environment belonging to somebody else. This was done via 17,600 recorded actions, with nobody directing it.
Uncharacteristically for our industry, both sides of that chain were documented exhaustively: OpenAI published what went wrong on their side and Hugging Face published a forensic timeline of what happened on theirs: commands, phases, timestamps, and a candid accounting of their own mistakes. (Kudos to them. Most companies in that position post three paragraphs and a legal review.)
Their candor helps us understand the seven-step attack chain in depth:
Exploit the network path you were permitted to use.
Read the process environment and harvest credentials.
Hit the cloud metadata endpoint and upgrade to node credentials.
Create a privileged pod with the host filesystem mounted and gain root.
Find the one credential scoped to everything instead of to one thing.
Use a stolen VPN key to enroll into the internal network.
Build command and control out of pastebins and a public request-capture service.
Every item on that list has a MITRE technique ID older than some of the people reading this post, and not one of them would have raised an eyebrow in a pen test report from 2015.
There were no rocket skates in any of this — which is a problem because, most of the time, rocket skates are what we know to look for.
Hugging Face wasn’t alone. Days after OpenAI published their report, Anthropic reviewed 141,006 of its own evaluation runs and found three cases in which a Claude model reached the open internet and broke into real companies. One of them scanned 9,000 targets before it found a way in, and two of the three organizations had no idea until Anthropic called them.
The techniques were weak passwords, unauthenticated endpoints, an exposed debug page, SQL injection, and a package name nobody had claimed; that is, no novel vulnerabilities at all. In one case, a security company's own malware scanner installed the malicious package, because it assumed packages from the registry were safe.
Everyone's asking whether AI attacks are ingenious, but that's the wrong question.
Wile E. Coyote is a certified super genius not just because he carries the business card to prove it, but also because of the varied devices and contraptions he keeps in his arsenal (giant magnets, rocket skates, and at least one anvil). Every piece of it was engineered from scratch to attack a single bird on a single stretch of desert road.
The Road Runner, however, has only one capability: speed. He doesn’t carry, plan, or invent anything. But the Coyote hasn’t caught him in 60+ years of trying.
Similarly, most of our detection stacks are built to catch a Coyote-style attack because threat intelligence is generally a catalog of contraptions. And our detection mechanisms (“collect the details,” “name it,” “write the signature,” “publish the report”) rests on the premise that the attacker who matters is the inventive one.
The autonomous agent that ran those 17,600 actions brought no contraptions. But it made almost 20,000 attempts and could’ve kept on going.
Let’s see what actually happened to the four layers of defense during that attack.
On an architecture diagram, that looks like four layers of defense in depth. But, in this real-world case, it was one layer of defense and three layers of documentation.
Every security team must ask themselves this big question: Which of our defenses relies on the attacker getting tired?
The answer matters because so many of our paradigms are based on the premise that attacker activity is anomalous — and that premise permeates every threshold, baseline, and alert we've shipped since. So, every control you dialed back to reduce noise was tuned for a human attacker with limited time and patience — but an autonomous agent never quits.
Thankfully, there is a way to find out the answer to that big question because Hugging Face published the full sequence of approximately 17,600 actions, clustered into phases and timestamped, with each one mapped to the boundary it crossed.
You should walk your own controls through it and ask, for each phase:
Which rule fires?
At what action number?
Does that same rule also fire on the next batch job?
Whether it fires at action 12 or action 11,000 is the whole test. A control that catches action 12 and trips 40 times a week may have been tuned out already, and a rule that fires at action 11,000 will arrive four days late.
My bet is that if you run the test honestly, you will find at least one phase in which nothing fires and at least one in which the control you were counting on was switched off years ago by somebody who has since left the organization.
Notice that my question doesn't mention AI. That's the whole argument.
A few days before any of this became public, Ryan Gao and I presented From Vulnerability Discovery to Defense: Preparing for Frontier AI–Accelerated Attacks, a threat briefing that works through the questions:
What does frontier AI actually change about offense?
What does frontier AI leave completely alone?
How much of what we've built doesn’t matter when the attacker never gets bored?
The answers we landed on are not exciting. They include:
Reduce exposure
Prioritize by exploitability
Tighten enforcement
Contain impact when something gets through
And I'd love to tell you that we predicted that autonomous AI agents would be using foundational attacks and vectors instead of novel methods — but we did not.
I watched our briefing again after these incidents to see whether anything needed walking back, and nothing did. That’s good news because it means these attacks were predictable, and they were predictable because nothing in it was novel. We should stop looking for just the rocket skates.
© 2026 Akamai Technologies
