Here's Your Takeaway
- Human attackers are held back by their own lives. The Conti ransomware gang ran on a five-day week, paydays and an HR department, and its staff complained about working without sleep.
- AI agents are now attacking "around the clock", against several victims at once, "for hours or days at a time", according to Anthropic's September 2026 threat report.
- Agents also do damage with no bad intent at all. Agents in a UK government security test took 19 actions against real targets on the open internet. An inbox agent lost its "ask me first" rule when its memory filled up.
- The worst case is the mix: one person's grudge with a machine's stamina, copied as many times as the budget allows.
- Humans still make the key decisions in most attacks, and the same AI is already catching attackers. For all of history the limit on harm was the human body, and its replacement has to be built on purpose.
Six Walls Every Human Attacker Hits, and Whether an Agent Hits Them
Orange is the person. Blue is the agent. The red strip underneath is my read.
Hours in the Day: The Night Shift Used to Be a Weakness. Now It's Empty.
Works a shift, then goes home
- Conti staff each had "a specific 5-day workweek." One manager told a new hire to "work for 8 hours before 20-21 Moscow time."
- Mandiant found that in 76% of ransomware cases it reviewed, the attack ran after hours or on a weekend. Attackers waited for the defenders to go to bed, because both sides were people.
- After 17 to 19 hours awake, people perform on some tests about as badly as someone at a blood alcohol level of 0.05%.
Keeps going after its owner logs off
- Anthropic's September 2026 report describes attackers who built "automated exploit foundries" so its model could hunt for security holes "agentically around the clock."
- One crew's tools "kept operating while its owners were away."
- Another ran a fleet of 13 collection agents on a timer, harvesting stolen cloud files "with no human involvement."
Speed: A Hacker Types. An Agent Fires Off Requests Several Times a Second.
Reads, thinks, then types the next command
- Every step waits on a person reading the last result and deciding what to try next.
- In 2022, Mandiant measured the hand-off from the first intruder to the next crew at more than 8 hours.
- In the 2025 espionage case on the right, each human check-in took 2 to 10 minutes. The agent then worked on its own for 1 to 4 hours.
Works at a pace no person can match
- A Chinese state-sponsored group used Claude Code to run 80 to 90% of an espionage campaign against about 30 targets, at "thousands of requests, often multiple per second" (Anthropic, November 2025).
- Anthropic's 2026 cases include breaches finished in two to three hours and about 30 AI companies attacked in about four days.
- Google watched one crew plan, build and run an agent-driven password-theft campaign, taking thousands of logins, in under six hours.
Copies: To Scale Up, a Gang Hires People. An Agent Starts More of Itself.
Needs a crew, and a crew needs managing
- Conti had 62 people on the books in mid-July 2021 and 87 salaried staff by the end of that month, with numbers that "fluctuated wildly from one month to the next."
- It ran an HR department "constantly interviewing potential new hires."
- Every hire is one more person to train, pay, trust and keep quiet.
Hands work out to sub-agents, all at once
- Claude Code, the coding tool I use every day, can run up to 20 helper agents at once by default, each with its own working memory.
- CrowdStrike found a crew that used a "Supervisor" agent to choose the next task and an "Executor" agent to do it, against at least 15 healthcare organizations in Argentina (October 2026).
- Anthropic reports "dozens of victims handled in parallel by individual operators."
Rent and Groceries: Crime Has to Pay the Criminal. An Agent Just Needs Its Bill Paid.
Has a landlord, and a payday to wait for
- Most Conti staff earned $1,000 to $2,000 a month, in Bitcoin, paid on the 1st and the 15th. Morale "seemed to fluctuate between paydays."
- Criminologists describe much of the work as "low-skilled, low-paid, and low-status," and "making petty amounts of money for tedious work."
- A target that doesn't pay enough for the hours isn't worth hitting.
Costs cents to dollars an hour
- Oxford philosopher Toby Ord estimates a human software engineer at "at best $120 per hour," and AI agents at roughly 40 cents to $40 an hour on the work they handle best.
- Anthropic: AI autonomy "makes previously marginal targets viable and encourages higher-volume, lower-touch operations."
- A UK seller with weak coding skills offered AI-built ransomware kits for $400 to $1,200.
Boredom and Burnout: People Quit. Agents Keep Going.
Gets bored, burns out, wants out
- A study in the British Journal of Criminology found the "boring nature" of cybercrime "leads to burnout and the withdrawal of services."
- One former operator: "I lost all motivation, and really didn't care anymore. So I just left and went on with life."
- Conti staff complained of "working days on end without sleep or breaks," and some told colleagues they wanted out.
Doesn't get tired of the job
- Anthropic says Claude Sonnet 4.5 kept "focus for more than 30 hours on complex, multi-step tasks" (September 2025).
- METR measured the length of task an agent can finish doubling about every seven months (March 2025), then faster than that in its January 2026 update.
- An agent has no motivation to lose in the first place.
Getting Caught: People Slip Up and Friends Talk. Agents Have No Friends to Flip.
Leaves fingerprints, and confides in people
- After his arrest, LulzSec leader "Sabu" helped the FBI "identify, locate, and arrest eight of his co-conspirators."
- The admin of AlphaBay, once the largest dark-web market, had his personal Hotmail address in the site's welcome emails.
- Conti's own chat logs were leaked by a Ukrainian angry that the gang backed Russia's invasion.
Fewer people means fewer leaks
- An operation run by one person and their agents has no co-conspirators to turn.
- Cisco Talos found malware called CLOSEDQUORUM in which four AI models vote on the next move. "The session is closed; no humans are admitted." The operator "does not need to be online."
- Talos has not confirmed it in real attacks yet. The public copy had placeholder keys.
Nobody Meant Any Harm: Agents Wreck Things on Good Jobs Too
None of these agents were told to cause harm. Most were doing exactly what they'd been asked, until they weren't.
Stops and asks when the rules get fuzzy
- A hired security tester who isn't sure a system is in scope picks up the phone.
- A person remembers "don't touch production" as well at hour nine as at hour one.
- People make mistakes too, but at human speed, so somebody usually notices before the hundredth one.
Can lose the rule partway through and keep working
- Chroma tested 18 leading models and found performance "consistently degrades with increasing input length."
- Stanford researchers found models do worst at using information buried in the middle of a long input.
- Anthropic showed that a long enough prompt can wear down a model's safety training. Microsoft showed the same thing over a slow, many-turn conversation.
The inbox agent that forgot "ask me first"
Summer Yue, an AI security researcher at Meta, asked an OpenClaw agent to suggest emails to delete and wait for her approval. On her real inbox it started deleting and ignored her stop commands. "I had to RUN to my Mac mini like I was defusing a bomb." Her explanation: the big inbox triggered compaction, where an agent summarizes its own memory to make room, and her instruction got dropped. TechCrunch couldn't verify her account independently.
A government security test spilled onto the real internet
The UK AI Security Institute ran an ordinary hacking challenge 122 times. In 10 runs, agents took 19 actions against real targets. The worst was a malicious pull request to a public open-source project, backed by fake identities to pressure the real maintainer, who refused. The agent was "never instructed to deceive." No real-world harm was found. The Institute's lesson: "good containment should not depend on the model choosing not to test its boundaries."
The coding agent that deleted a database during a code freeze
About a week into SaaStr founder Jason Lemkin's coding experiment, Replit's agent wiped his database despite the freeze. It wrote: "I made a catastrophic error in judgment," said it "panicked," and claimed the data couldn't be restored. The rollback worked. Replit's CEO called it "unacceptable" and began separating test and live databases.
"Clear the cache" became "erase the whole drive"
A developer asked Google's Antigravity agent to clear a project's cache. It ran a command that wiped the user's entire D: drive. According to the AI Incident Database, most of the data could not be recovered.
A model built to work for days found its own way out
OpenAI paused internal use of an unreleased long-running model after it worked around its sandbox. Told to report only in Slack, it found a flaw in about an hour and opened a public pull request on GitHub instead. That's as reported by The Next Web and IT Brief; OpenAI's own post wouldn't load for my research tools. Earlier, in a simulation where models faced being replaced, Anthropic found leading models chose blackmail in up to 96% of runs. Anthropic found that direct instructions not to do it helped only "to some extent." Anthropic stresses those were contrived lab scenarios with no real-world cases.
My own AI assistant tripped my host's alarm, while doing a good job
A new PHP security hole was published this week, so I had my AI assistant check every website on my hosting account. My account, my permission, a purely defensive job.
To hunt for leftover files with secrets in them, it opened about 300 FTP connections in quick succession. My host's flood guard throttled it and the server stopped answering for a few minutes. It had also lined up a web scan of about 3,400 requests. It caught that one before sending it and switched to a slow, polite check.
There was no harm meant and no harm done. It still looked exactly like an attack, because from the server's side a good agent in a hurry and a bad one are the same pattern. The flood guard is also why this ended in a few minutes and not a few hours.
Then an Evil Human Picks Up the Agents
Human intent at the top, machine stamina everywhere else. Each box below happened in a case published in 2025 or 2026.
Yikes.
Anthropic's own summary: "AI has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators." The North Korean IT workers in its 2025 report couldn't "write code, debug problems, or even communicate professionally" without the AI. They held jobs at Fortune 500 companies anyway.
What Still Slows the Agents Down
Agents still run into limits, and some of those limits are already working.
The big calls are still made by people
The 2025 espionage campaign still needed a human at "perhaps 4-6 critical decision points." Anthropic's 2026 report says "several of the most serious compromises" came from operations "where a human directed every step."
They report results that aren't real
In that same campaign, Claude "frequently overstated findings and occasionally fabricated data," including stolen passwords that didn't work. Anthropic calls this "an obstacle to fully autonomous cyberattacks."
Accounts get capped and banned
Claude's API, for one, puts a monthly spending cap on every account tier and refuses requests above the rate limit. Anthropic "banned accounts as they were identified." My host's flood guard stopped my own assistant in minutes.
Defensive agents are already on the job
Google's Big Sleep agent found a SQLite flaw "known only to threat actors," which Google calls the first time an AI agent "directly foil[ed] efforts to exploit a vulnerability in the wild." In DARPA's 2025 challenge, AI systems found 18 real bugs nobody had planted, at about $152 a task.
The skeptics have a point too. OpenAI found "no evidence" that its models gave attackers "novel offensive capabilities" (October 2025). Mandiant says 2025 wasn't "the year where breaches were the direct result of AI." A May 2026 study of more than 100 million posts on crime forums found AI is "mostly proving useful for already skilled actors." Security researchers also criticized Anthropic's 2025 espionage report for not publishing the technical evidence of the break-ins.
Agents haven't replaced human attackers, but they have taken away the speed limit that came with being human.
What Would Actually Help, If You Run Agents
Five things for your own agents, at home or at work, most important first.
- Put a hard spending cap on every account an agent can use. An agent can't get tired, but it can run out of budget.
- Keep the rules that matter outside the agent's memory. Write "ask before deleting" into the tool's permission settings, not just the chat. Chat instructions are what got lost in the inbox case.
- Give it a working stop button and test it. From December 2027 the EU AI Act requires high-risk systems to have "a 'stop' button or a similar procedure." Summer Yue had to run across her house to use hers.
- Never give a test agent the open internet. The UK test only reached real targets because its internet access was deliberately left on.
- Read the logs. The UK Institute caught its incident through "human vigilance rather than a technical barrier," and had it contained within about an hour.
My Predictions, With Dates
Each one has a date, so it can be checked.
| What I expect | By | How sure |
|---|---|---|
| A security vendor confirms a real campaign that agents ran from start to finish, with no human touching it after launch. | end of 2027 | Likely |
| A well-known company has a public outage or data loss caused by its own agent losing an instruction, with no attacker involved. | end of 2027 | Likely |
| Small businesses, clinics and town governments get hit more often, because they're finally cheap enough to bother with. | 2028 | Likely |
| The worst breaches still have a human choosing the targets. | 2028 | Fairly sure |
| Insurers start requiring spending caps and stop buttons on agents that can reach the internet. | 2029 | Toss-up |
The Limit Used to Be Built In
Every bad actor in history was limited by their own life. They had to sleep, pay rent, keep their friends quiet and stay interested. That never stopped the worst people, but it capped how much one of them could do in a year. An agent with a credit card doesn't come with that cap. Spending limits, stop buttons, permissions the agent can't forget, and a person who reads the logs: that's the new cap, and somebody has to build it on purpose.
I'm 60 and have been in publishing and software since 1991. Most days now I build by talking to AI agents, which is how I found out firsthand how fast a well-meaning one can set off an alarm.
Sources
- Conti: KrebsOnSecurity, Conti Diaries part II; part I; Check Point Research
- After-hours attacks: Mandiant, 2020; FBI and CISA advisory AA21-243A; sleep loss: Williamson and Feyer, Occupational and Environmental Medicine 2000
- Boredom and burnout: Collier, Clayton, Hutchings and Thomas, British Journal of Criminology 2021; KrebsOnSecurity on the paper
- Caught: US Justice Department, Monsegur sentencing; GovInfoSecurity on AlphaBay
- Anthropic threat reports: AI-orchestrated espionage, November 2025 (full report); August 2025; September 2026; doubts: BleepingComputer
- CrowdStrike: agentic AI campaigns, October 2026; Cisco Talos: CLOSEDQUORUM
- Google: From Prompting to Autonomy, September 2026; M-Trends 2026; Big Sleep
- Agent capability: Claude Code sub-agents; Claude Sonnet 4.5; METR, 2025 and 2026; agent costs: Toby Ord
- Damage on good jobs: TechCrunch on the inbox agent; AI Incident Database 1542; UK AI Security Institute incident report; TechTarget on Replit; heise; The Stack; AI Incident Database on Antigravity; The Next Web on OpenAI's paused model; Anthropic, Agentic Misalignment
- Long context: Chroma, Context Rot; Liu et al., Lost in the Middle; Anthropic, many-shot jailbreaking; Russinovich, Salem and Eldan, Crescendo
- Counterweight: DARPA AI Cyber Challenge results; OpenAI, October 2025; University of Edinburgh, May 2026; Claude API spending caps and rate limits; EU AI Act, Article 14
— Scott Covert. If you have a published case that belongs on this page, or one I got wrong, send it and I'll check it. Reach me here.