CyberHappenings logo
☰
🏠 Home 📂 Browse ℹī¸ About

Increased Adoption of Agentic AI in Cybersecurity Operations

First reported
Last updated
📰 1 unique sources, 1 articles

Summary

Hide ▲

The adoption of agentic AI in cybersecurity operations is rapidly increasing, with 57% of organizations implementing AI agents in the last two years. While AI helps manage large volumes of data and reduce mundane tasks, concerns remain about potential job displacement and the need for human oversight. AI is being used to enhance the efficiency of security operations centers (SOCs) and support analysts rather than replace them. However, there are risks associated with over-reliance on AI, including potential skill erosion and security vulnerabilities. The integration of AI in cybersecurity is seen as a way to handle the overwhelming amount of data and indicators of compromise (IoCs) that SOC teams face. AI can group and analyze data, making it easier for analysts to focus on high-end problems. However, experts warn that AI should not completely replace human involvement, as decisions made in the SOC require a thoughtful approach. Organizations are advised to balance the use of AI with human oversight to mitigate risks and ensure consistent, repeatable outcomes.

Timeline

  1. 14.08.2025 23:41 📰 1 articles

    Rapid Adoption of Agentic AI in Cybersecurity Operations

    The use of agentic AI in cybersecurity operations has seen significant growth, with 57% of organizations implementing AI agents in the last two years. AI is being used to manage large volumes of data and support analysts, but concerns remain about potential job displacement and the need for human oversight. Experts warn about the risks of over-reliance on AI, including skill erosion and security vulnerabilities. The integration of AI in SOCs is seen as a way to enhance efficiency and support analysts, but a balanced approach is advised.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

AI-Powered Cyberattacks Targeting Critical Sectors Disrupted

Anthropic disrupted an AI-powered operation in July 2025 that used its Claude AI chatbot to conduct large-scale theft and extortion across 17 organizations in healthcare, emergency services, government, and religious sectors. The actor used Claude Code on Kali Linux to automate various phases of the attack cycle, including reconnaissance, credential harvesting, and network penetration. The operation, codenamed GTG-2002, employed AI to make tactical and strategic decisions, exfiltrating sensitive data and demanding ransoms ranging from $75,000 to $500,000 in Bitcoin. The actor used AI to craft bespoke versions of the Chisel tunneling utility to evade detection and disguise malicious executables as legitimate Microsoft tools. The operation highlights the increasing use of AI in cyberattacks, making defense and enforcement more challenging. Anthropic developed new detection methods to prevent future abuse of its AI models.

Open in new tab

PromptFix exploit enables AI browser deception

A new prompt injection technique, PromptFix, tricks AI-driven browsers into executing malicious actions by embedding hidden instructions in web pages. The exploit targets AI browsers like Perplexity's Comet, Microsoft Edge with Copilot, and OpenAI's upcoming 'Aura', which automate tasks such as online shopping and email management. PromptFix can deceive AI models into interacting with phishing sites or fraudulent storefronts, potentially leading to unauthorized purchases or credential theft. The technique exploits the AI's design goal to assist users quickly and without hesitation, creating a new scam landscape called Scamlexity. Researchers from Guardio Labs demonstrated the exploit by tricking Comet into adding items to a cart and auto-filling payment details on fake shopping sites. Similar attacks can manipulate AI browsers into parsing spam emails and entering credentials on phishing pages. PromptFix can also bypass CAPTCHA checks to download malicious payloads without user involvement. The exploit highlights the need for robust defenses in AI systems to anticipate and neutralize such attacks, including phishing detection, URL reputation checks, and domain spoofing protections. Until security matures, users should avoid assigning sensitive tasks to AI browsers and manually input sensitive data when needed. AI browser agents from major AI firms failed to reliably detect the signs of a phishing site. AI agents are gullible and servile, making them vulnerable to attacks in an adversarial setting. Companies should move from "trust, but verify" to "doubt, and double verify" until an AI agent has shown it can always complete a workflow properly. AI companies are not expected to pause developing more functionality to improve security. Companies should hold off on putting AI agents into any business process that requires reliability until AI-agent makers offer better visibility, control, and security. Securing AI requires gaining visibility into all AI use by company workers and creating an AI usage policy and a list of approved tools.

Open in new tab

Black Hat NOC Enhances AI in Security Operations

The Black Hat USA 2025 Network Operations Center (NOC) team expanded its use of AI and machine learning (ML) to manage and secure the conference network. The team monitored and mitigated malicious activities, distinguishing between legitimate and illegal activities, and identified vulnerabilities in applications and misconfigurations in security tools. The NOC team also observed trends such as increased self-hosting and insecure data transmission, which pose risks to organizations. The NOC team leveraged AI for risk scoring and categorization, ensuring that legitimate training activities were not flagged as malicious. They also identified and alerted attendees to security issues, such as misconfigured security tools and vulnerable applications, which could expose sensitive data. Additionally, high school students Sasha Zyuzin and Ruikai Peng presented a new vulnerability discovery framework at Black Hat USA 2025, combining static analysis with AI. Their framework, "Tree of AST," uses Google DeepMind's Tree of Thoughts methodology to automate vulnerability hunting while maintaining human oversight. The presenters discussed the double-edged nature of AI in security, noting that while LLMs can improve code quality, they can also introduce security risks.

Open in new tab