If you're not using AI to attack your own systems, your adversaries will
- ID
- 16870
- Status
- summarized
- Published
- 22 Aug 2026, 11:02 PM
- Fetched
- 22 Aug 2026, 11:54 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/22/if-youre-not-using-ai-to-attack-your-own-systems-your-adversaries-will/5291346
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 7.5
- Created
- 22 Aug 2026, 11:54 PM
- Tags
- Audience
- developersai_agent_userssaas_founders
What happened
Former CISA acting head Matt Hartman and former NSA cyber boss Rob Joyce warn that AI agents are now actively used in real attacks for automated reconnaissance, personalized phishing, and exploit-chain discovery, while also creating a new attack surface via non-human identities and data-integration channels. Joyce's core message at RSAC: if you aren't running AI agents against your own systems, adversaries will do it for you—and keep the results.
Why it matters
If you ship AI agents or integrate them into production, you now have a growing population of non-human privileged identities that bypass traditional static security policies. Practically, this means treating every agent as a privileged identity, adopting phishing-resistant auth and zero-trust behavioral signals, and running agentic red teaming against your own stack before attackers do it for free.
Discussion angle
How do you scope permissions and audit trails for non-human agent identities in your current stack—and would an autonomous red-team agent find anything your manual reviews missed?