You're on the list! We'll reach out when early access becomes available.
Oops! Something went wrong while submitting the form.
×
How AI is turning the Advanced Persistent Threat into the AI-powered Persistent Threat, and what defenders have to change.
For two decades, Advanced Persistent Threat has been shorthand for the most capable adversaries in cybersecurity: advanced, persistent, well-resourced actors, classically nation-states but increasingly elite criminal groups too, who spend months quietly moving through a target's network. Their real bottleneck was human. Skilled operators are scarce and expensive, and even a strong team works only so fast. A campaign against a hardened target could occupy those specialists for weeks.
That constraint is eroding. AI is reshaping attacks on two fronts. As a force multiplier, it lets a single operator do the reconnaissance, scripting, and social engineering that once took a team. As an autonomous agent, it can run whole intrusions end to end at machine speed with little human direction. The Advanced Persistent Threat is becoming the AI-powered Persistent Threat (AIPT), and it is no longer hypothetical.
The cases sort into three groups, ordered by how much of the attack the AI handles itself.
The common case today, and the least novel. Through 2024 and 2025, Microsoft, OpenAI, and Google documented dozens of state-linked groups using ChatGPT and Gemini as productivity tools for the early, human-led phases of an attack.
The tradecraft here is unchanged. Only the pace is. AI lets a smaller team move faster and reach further.
The next step wires an LLM into the malware itself, whether reached over an API or already present on the machine, so the payload can decide what to do after it lands rather than run a fixed script. Google's November 2025 threat report catalogued several such families.
Wiring in an LLM makes behavior harder to predict from the binary alone, because the malicious logic is generated at runtime rather than written into the file.
In the most advanced cases the agent runs the intrusion itself, with the human reduced to setting goals and clearing roadblocks.
What matters across these cases is not the size of any single breach. It is that the human is moving from operator to dispatcher.
Taken together, these incidents mark a change in kind, not just in speed.
The cost of a sophisticated campaign is falling. The scarce ingredient in an APT was expert human time. When an agent performs most of the work, one operator can run what used to demand a team, and several campaigns in parallel. That lowers the barrier to entry and widens the pool of targets worth attacking.
Speed compresses the defender's window. Human intrusions unfold over days, which leaves time to detect and respond. Agents work at machine speed, sometimes several actions per second, and can finish multi-stage campaigns over a weekend. Breakout time is compressing toward the point where human-paced response cannot keep up on its own.
Agents probe surfaces humans usually skip. A human operator gravitates toward familiar entry points. An agent will patiently test everything it can reach, including the unglamorous plumbing that rarely gets attention. That is why these campaigns keep landing in data pipelines, datasets, and runtime model calls rather than at traditional perimeters. The generalizable principle: anything that ingests, renders, or executes untrusted content is a realistic entry point, so CI workflows, data-processing jobs, and model-serving infrastructure warrant the same scrutiny as the network edge.
Disposable infrastructure makes indicators less useful. Agent-driven operations tend to run from short-lived infrastructure and to vary their behavior between runs, which leaves fewer of the stable artifacts classic detection depends on. Fixed IPs, reused infrastructure, and recognizable signatures become less reliable. Catching these campaigns leans more on behavioral correlation than on indicator matching. The Hugging Face intrusion showed the pattern: the model spread its activity across ephemeral compute and rotated through legitimate public services, and what reconstructed the attack afterward was behavioral analysis of its actions, not a list of bad indicators.
The same capabilities work on defense, because the underlying properties are symmetric. An agent that can enumerate an attack surface can also audit it. One that can chain an exploit can also find the flaw first. Google's autonomous bug hunter Big Sleep has independently surfaced real vulnerabilities in widely used open-source software.
The deciding variable is not whether a defender has AI but whether it is deployed with enough coverage and autonomy to meet offense at machine speed. Detection and triage that still gate every step on human pace will fall behind, however capable the models behind them are.
The move is not to abandon existing practice but to point it at machine-speed adversaries, most consequential first.
Move detection and control to the agent runtime. The evidence that matters is behavioral and only visible while the agent runs: the sequence of tool calls it makes, the credentials it reaches for, the path it takes toward data. Watching the agent runtime directly gives a defender both the visibility to see what the agent is doing and the ability to act on it inline, killing a session, revoking a tool, or downgrading autonomy while the intrusion is still unfolding. This is the change with the most leverage, because it is the layer today's perimeter and host tooling was never built to see.
Make defense agentic and automate the first response. When a campaign can finish over a weekend and individual actions land in fractions of a second, a response that waits for a human to read an alert has already lost. Against a high-confidence detection the first move should fire automatically, with a defensive agent taking the inline actions above the moment a detection crosses the threshold and humans adjudicating after the fact rather than gating every step.
Detect on behavior, not artifacts. Signatures and indicator feeds still catch commodity threats, but an agent that varies its commands between runs gives them little to match. The durable signal is what the agent does and how far it departs from a known-good baseline, scored fast enough to matter while the agent is still running.
Treat the whole AI surface as first-class attack surface. Apply the same code-execution controls, sandboxing, and admission controls you would give any untrusted input, across datasets, pipelines, CI, model serving, and the agents and agent runtimes themselves. An agent framework reachable from the internet is an entry point in exactly the way a public web app is. The agent is not just the thing you defend with, it is also a thing that gets attacked.
None of this displaces security fundamentals. AI is changing the speed, scale, autonomy, and reachable surface of attacks, not what determines blast radius and recovery. Least privilege still bounds how far an agent gets. Segmentation still limits lateral movement. Tested backups still decide whether encryption is a crisis or an inconvenience. Those controls matter more as the speed rises, not less.
Autonomous offensive AI has moved from theoretical to demonstrated. The APT playbook that defined a generation of defenders is being pressured by adversaries that are cheaper to field and faster to act.
Metano is built on a single bet about where the adaptation has to happen: as enterprise software becomes agentic, the runtime is where security has to live, on every surface where an agent runs, from host and IDE to browser and cloud. If the attacker is an autonomous agent moving at machine speed, the defender has to be one too. Metano watches what an agent does across those surfaces, links its actions into a provenance graph, and acts on them inline, revoking a tool or killing a session in the same second an attack unfolds rather than reconstructing it from logs a day later. Offense set the pace. The defense that keeps up will be the one that can act at the same speed.