Resecurity published a survey of autonomous offensive-security agents, and CyberStrike is on the list — next to T3MP3ST, Strix, XBOW, PentAGI and others — under a section titled, plainly, “misuse potential.” It would be easy to get defensive about that. I’d rather sit with the question it raises, because it is the right one: the same engine that runs an authorized assessment can, with almost no modification, be pointed at infrastructure that never agreed to be tested. Pretending otherwise is how you lose the trust of the people you are asking to run this on their own networks.
So here is the honest version.
1. The capability is real, and so is the dual-use
These are not chatbots that suggest payloads. A modern offensive agent runs a loop — plan, execute, observe, reason, adapt — across recon, exploitation, lateral movement and reporting, holding context the whole way and recovering when a step fails. That is genuinely useful for a defender who wants to see their attack surface the way an attacker would. It is also, by construction, a capable adversary tool. Both are true at the same time. A vendor who only tells you the first half is selling you something.
2. The incidents are no longer hypothetical — but be precise
The survey points at FortiBleed, JadePuffer and the GTG-2002 / GTG-5004 Claude Code abuse as early signals that AI-assisted operations have left the lab. Precision matters here: the degree of AI involvement varies and, in several cases, is assessed rather than confirmed. FortiBleed’s AI assistance is publicly discussed but not independently verified — we said the same in our own teardowns of that campaign. What is not in doubt is the direction. Autonomous tooling makes reconnaissance, credential harvesting and known-pattern exploitation cheaper, faster and tireless. The honest framing is “early signals of a shift,” not “the robots are here.”
3. What actually separates a tool from a weapon
It is not the model. It is the controls around it:
- Authorization and scope containment. A mission has a target set, and an egress gate that refuses off-scope hosts. Scope is enforced in code, not in a prompt.
- A gate before high-impact actions. Destructive or privileged steps require explicit approval instead of firing autonomously. “Find a working exploit and just run it” should never be the default path.
- A human on the loop. A person owns scope, judgment and sign-off, and can stop the run.
An attacker removes these controls — that is precisely the point, and precisely why they are the thing that matters. The gate is a design choice, not a law of physics. The only responsible way to ship one of these is to make the safe path the default and the dangerous path deliberate. That is the line we build CyberStrike on, and it is the line a defender should demand of any agent they let near their estate.
4. The limit nobody selling hype mentions
AI here is a force multiplier, not a replacement. The public 2026 benchmarking keeps landing in the same place: the ARTEMIS evaluation out of Stanford and CMU, and several scaffold-versus-model studies cited in the survey, all find that agents win on speed, scale and known-pattern breadth, while humans still win on business logic, creative chaining and genuinely novel bugs — and that the scaffold around a model moves results more than the model itself does. That matches what we see day to day. It is also why CyberStrike is built as AI-augmented, with the human owning the parts that carry real judgment, rather than fire-and-forget. “AI does the pentest” is a slogan; a hybrid of automated breadth and human depth is an operating model.
5. What this means if you are defending
You do not need to wait for the taxonomy to settle to act on it.
- Assume AI-scale scanning. Exposed admin panels, VPN gateways and management interfaces will be found, continuously. Take them off the public internet where you can; enforce MFA and segmentation where you cannot.
- Patch the boring flaws first. The ones these agents love are unauthenticated RCE, default credentials, path traversal and weak JWT secrets. Automated exploitation makes “low priority, internet-facing” a contradiction.
- Watch for agentic behaviour. Perfectly sequential requests with no human think-time, self-correcting retries against the same endpoint, tool output echoed into parameters, natural-language reasoning in request bodies. Behavioural detection beats signatures against an adversary that rewrites itself.
- Red-team yourself with the same tools. Run an authorized agent against your own environment, with a human validating findings, so your first encounter with an attacker’s AI is not in production.
The honest summary: being listed among dual-use offensive agents is not a label to dodge, it is the whole truth about this category. The capability is real, the misuse is real, and the only thing standing between the two is authorization, scope control and a human who owns the consequences. Build and buy accordingly.
Resecurity’s full survey, “When AI Becomes the Attacker: Understanding Autonomous Offensive Security Agents,” is here.
