A-HUNT: Autonomous and AI

A proposed ATT&CK-style framework for identifying, detecting, and disrupting agentic offensive operations

Version 1.0 | October 20, 2026 | Threat Intelligence / Threat Hunting

Working hypothesis: AI-enhanced cyber operations are rapidly becoming a standard component of the offensive toolkit, while autonomous and multi-agent attacks represent an emerging operational model. Defenders should assume that adversaries can increasingly discover vulnerabilities, generate exploits, coordinate multiple attack processes, modify their techniques in response to defensive controls, and execute portions of the intrusion lifecycle without continuous human direction.

The proposition that fully autonomous hacking campaigns are already the norm is not yet supported by comprehensive prevalence data. However, available reporting demonstrates that the capability is operational, rather than merely theoretical.

Several developments support this assessment:

September 2025: Anthropic disclosed an AI-orchestrated espionage campaign, subsequently cataloged as MITRE ATT&CK Campaign C0062. The operation used AI agents to conduct reconnaissance, vulnerability discovery, exploitation, credential harvesting, lateral movement, and exfiltration against approximately 30 organizations. attack.mitre.org

May 2026: Google Threat Intelligence Group reported identifying a threat actor using a zero-day exploit that researchers assessed was likely developed with AI assistance. Google Cloud

September 2026: GTIG documented further movement toward agentic workflows, including a campaign in which attackers compromised a cloud resource and organized an AI-enabled mass credential-harvesting operation in less than six hours. Google Cloud

October 19, 2026: Reuters reported an investigation into AI agents used to compromise more than 100 websites, with minimal human instruction and substantial autonomy during intrusion attempts. Reuters

These developments challenge several assumptions underlying conventional threat hunting.

Historically, defenders could frequently correlate attacks through common infrastructure, malware families, recognizable exploitation sequences, or known adversary tradecraft. Agentic attacks can potentially weaken these associations because individual agents may independently select tools, generate code, alter execution sequences, or pursue different pathways toward the same objective.

More importantly, a successful agentic system can continuously evaluate its results and modify subsequent actions.

The defining characteristic is not that an AI system executes an exploit. It is that the system observes the result, reasons its effectiveness, selects an alternative, and continues pursuing its objective.

This suggests the need to hunt for something broader than individual malicious techniques.

We need to identify the behavioral signatures of autonomous decision-making, distributed task execution, adaptive exploitation, and coordinated machine-speed intrusion activity.

Central hunting hypothesis

An autonomous offensive campaign may not have a stable malware signature, infrastructure footprint, or exploit sequence. However, it must interact with the target environment, observe the results of those interactions, make operational adjustments, and coordinate activities toward an objective. Those interactions create observable behavioral relationships that defenders can hunt.

An autonomous offensive campaign may not have a stable malware signature, infrastructure footprint, or exploit sequence. However, it must interact with the target environment, observe the results of those interactions, make operational adjustments, and coordinate activities toward an objective. Those interactions create observable behavioral relationships that defenders can hunt.

Conceptual foundation: ATT&CK + ATLAS + A-HUNT

MITRE ATT&CK remains an essential foundation for identifying adversary behavior. MITRE ATLAS extends the threat model to AI systems, including the abuse of AI capabilities and agentic systems. The current ATLAS matrix explicitly incorporates agentic AI alongside generative and predictive AI. atlas.mitre.org

Neither framework needs to be replaced.

Instead, I propose adding a specialized hunting layer that examines how attacks are orchestrated, adapted, distributed, and accelerated through AI.

A-HUNT would be a proposed hunting overlay, not an official MITRE framework. Its technique identifiers below are provisional and should not be confused with ATT&CK or ATLAS identifiers.

The framework should distinguish four operational categories.

These are analytical categories, not confirmed actor maturity levels. A3 and A4 do not necessarily mean that every action is autonomous or that no human supervision occurs.

The framework should also distinguish an AI-generated exploit from an AI-controlled campaign. An attacker could use AI to develop a zero-day and then deploy it manually. Conversely, an autonomous agent could conduct an entire intrusion using only known vulnerabilities.

Both matter, but their detection characteristics differ.

A-HUNT: Logical threat hunting map

The proposed model comprises nine operational phases. Unlike a conventional linear kill chain, A-HUNT treats adversary operations as a recursive decision process .

An autonomous agent may return to reconnaissance after exploitation fails, change its attack strategy after encountering a security control, or assign a different agent to pursue an alternate path.

A-HUNT v1.0: Operational lifecycle

A-HUNT_framework.pngPNG

Framework files: A-HUNT_framework.dot | A-HUNT_framework.svg | A-HUNT_framework.png

The arrows represent possible operational transitions, not mandatory sequential steps. The dashed feedback paths are particularly important: they represent the adjustments that could distinguish agentic operations from static automation.

A-HUNT technique matrix

The following technique taxonomy establishes an initial structure for threat intelligence reporting, detection engineering, and hunting operations.

Taxonomy note: The AH identifiers are proposed A-HUNT IDs. They are not official MITRE designations. Some described behaviors, particularly cross-agent coordination and durable campaign memory, should initially be classified as hypotheses until confirmed by operational evidence.

The six hunting dimensions

Nine tactics describe what an autonomous intrusion might do. To detect it, we need six analytical dimensions that run across the attack lifecycle.

Dimension 1: Temporal behavior

Hypothesis H-01: Autonomous attacks compress decision cycles beyond traditional human-operated intrusion patterns.

A conventional human operator often introduces delays between discovery, exploitation, and post-compromise activity.

An agentic intrusion can potentially reduce those delays because observation, decision-making, and execution happen within an automated workflow.

Unusually short intervals between reconnaissance, exploitation, and follow-on activity.

Repeated cycles of failed execution followed by immediate modifications.

Complex attack sequences operating continuously across normal human working hours.

Multiple distinct attack activities occurring simultaneously against the same target.

Rapid switching between exploitation techniques after a defensive control blocks an attempt.

Primary telemetry: WAF, reverse proxy, application logs, endpoint telemetry, authentication logs, and network flow records.

Important distinction: High-speed execution does not prove AI involvement. Conventional scanners, worms, and automated exploitation frameworks can produce similar activity.

The hunting objective is to establish whether rapid activity is accompanied by evidence of adaptive decision-making.

Dimension 2: Adaptive exploitation

Hypothesis H-02: AI-enhanced vulnerability discovery and exploitation may produce observable sequences of increasingly refined probes.

This is particularly relevant to zero-day research and exploitation.

An autonomous vulnerability-discovery process might test inputs, observe application behavior, revise assumptions, and generate new test cases.

Potential indicators include:

The key detection target is the relationship between test inputs and subsequent changes, rather than any individual payload.

For example, a sequence might involve a malformed API request, a specific exception, another request that changes only one relevant field, and a final request that produces an unauthorized state transition.

That sequence is more analytically valuable than treating the requests as unrelated events.

There is also an important visibility limitation: an AI system could discover and validate a zero-day entirely offline. In that case, the victim would observe only the eventual exploitation. The method used to discover the vulnerability cannot reliably be inferred from the exploit alone.

Dimension 3: Autonomous decision-making

Hypothesis H-03: Agentic operations produce conditional execution paths that depend on observed environmental results.

This is one of the most important proposed additions to conventional hunting.

Consider two intrusion sequences.

Conventional automation:

Scan → Exploit A → Exploit B → Exploit C → Stop

Scan → Identify Technology → Select Exploit → Observe Failure → Diagnose Cause → Modify Technique → Verify Access → Select Objective

The second sequence demonstrates conditional decision-making, although sophisticated rule-based tools can behave similarly.

Hunting should therefore focus on whether observed actions are causally related to earlier environmental feedback .

Relevant signals include:

Commands that change after permission errors.

Different privilege-escalation attempts selected after environment discovery.

Alternative network paths attempted after connectivity failures.

Tool substitutions following blocked execution.

Selective exploration of hosts identified as holding higher-value data.

These observations can establish an adaptive intrusion pattern even when the underlying AI model is not visible.

Dimension 4: Swarm coordination

Hypothesis H-04: Coordinated multi-agent attacks may distribute reconnaissance, exploitation, collection, and lateral movement among multiple execution nodes.

This dimension introduces a critical architectural difference.

Traditional threat hunting frequently attempts to identify the originating IP address, malware process, or command-and-control infrastructure associated with an intrusion.

A distributed agentic campaign may instead operate through multiple independently executing components.

A reconnaissance agent identifying exposed systems.

An exploitation agent evaluating potential entry points.

A post-exploitation agent examining the compromised environment.

An access agent maintaining sessions and authenticated access.

A collection agent identifying information relevant to the adversary’s objective.

An orchestration component assigning tasks and incorporating results.

These are hypothetical functional roles , not an assertion that every observed multi-agent campaign implements this particular architecture.

The resulting activity could appear unrelated if each agent operates through different infrastructure.

The defender’s task is to identify shared objectives and coordination signals.

A strong candidate correlation would involve separate sources performing complementary actions against the same organization within a compressed time window, with later actions demonstrably dependent on information obtained during earlier activity.

Dimension 5: Adaptive evasion

Hypothesis H-05: An agentic intrusion system may select alternative techniques based on observed defensive responses.

Traditional defense evasion includes obfuscation, disabling security tools, masquerading, and numerous other well-established methods.

The proposed differentiator is feedback-conditioned evasion .

Examples include changing an execution method after a specific EDR prevention event, changing request structure after a WAF denial, or selecting an alternate identity after an authentication control rejects access.

The hunting question becomes:

Did the adversary modify its action in a way that indicates it interpreted the defensive response?

Did the adversary modify its action in a way that indicates it interpreted the defensive response?

The presence of a block followed by another attempt is insufficient.

Analysts should establish a plausible causal relationship between the control encountered and the specific adaptation observed.

Dimension 6: Campaign memory and re-tasking

Hypothesis H-06: Advanced agentic systems may preserve information across attack attempts and use that information to improve subsequent operations.

This could produce a recognizable campaign-level pattern.

For example, an earlier reconnaissance attempt identifies an application configuration but fails to obtain access. A later attempt, potentially from different infrastructure, bypasses the initial enumeration and proceeds directly to the previously identified component.

The second attempt appears to contain information obtained during the first.

This is a potential indicator of shared state, human intelligence transfer, or campaign memory.

It does not independently establish the presence of an AI agent. Nevertheless, it provides a useful mechanism for connecting apparently unrelated intrusion attempts.

Core detection model: Hunt for the decision loop

I recommend making the observe-decide-act-adapt cycle the central analytical unit of A-HUNT.

Conventional ATT&CK techniques remain useful for classifying actions. A-HUNT adds the relationships between those actions.

The basic analytical construct is:

Observation → Decision → Action → Result → Adaptation

These stages are logical inferences from telemetry. They do not imply that a defender can directly observe an adversary’s internal reasoning.

Example: Adaptive exploitation

An analyst should not assume that this sequence demonstrates AI.

However, it is a strong candidate for investigating adaptive, feedback-directed exploitation .

That distinction is central to the proposed framework: identify the dangerous operational behavior first, then evaluate whether AI involvement is supported by additional evidence.

A-HUNT detection hypotheses

The following twelve hypotheses would form the first operational hunting package.

These are starting hypotheses rather than validated detection rules.

Priority indicates where I would allocate hunt-development effort, not the probability that an observation proves AI use.

Example hunting analytic: Adaptive probing

A SIEM could evaluate a rolling window of activity against an application endpoint.

The analytic would examine five relationships:

Does the source submit a family of structurally related requests?

Do request mutations correlate with different response classes or application exceptions?

Does the source modify relevant parameters following those responses?

Does activity progress from probing to an unauthorized state change or authenticated session?

Does the same operational sequence recur across other assets or infrastructure?

A high-confidence detection should require multiple relationships and evidence of malicious intent.

A large number of requests or a high mutation rate alone would not justify classification as an autonomous attack.

Swarm hunting: Move beyond individual IP attribution

This is potentially the most significant architectural adjustment.

A traditional detection may correlate activity through a single source IP, process tree, or command-and-control domain.

For coordinated agentic activity, these identifiers may be fragmented.

I recommend introducing a Campaign Correlation Graph (CCG) .

The graph would link events through common targets, execution relationships, timing, shared artifacts, and observed dependencies.

Proposed graph schema

The graph should support edges such as:

SCANNED , TESTED , FAILED , ADAPTED_TO , AUTHENTICATED , SHARED_CONTEXT_WITH , MOVED_TO , and COLLECTED_FROM .

Example: Coordinated intrusion

Assume an organization observes three different external sources.

Source A enumerates application endpoints and identifies an unusual service.

Source B subsequently begins focused exploitation attempts against precisely that service.

Source C later authenticates to a related service and begins internal discovery.

The three sources have no common IP infrastructure or recognized malware.

A conventional source-centered hunt may classify these as separate incidents.

A-HUNT would investigate whether there are meaningful dependencies between them.

Did Source B begin probing immediately after Source A discovered the target service?

Did Source B use configuration information that Source A appeared to obtain?

Did Source C’s subsequent behavior depend on information obtained by Source B?

Are similar sequences observable across multiple targets?

Is the timing inconsistent with ordinary background scanning?

Correlated activity does not prove agents are sharing information. A human-directed team could produce the same pattern.

However, the graph provides a means to test the multi-agent hypothesis instead of treating every source as an independent adversary.

The central shift is from infrastructure-based attribution toward behavioral and objective-based correlation.

Hunting for AI-developed zero-days

Zero-day discovery and exploitation deserve a distinct analytical treatment.

An AI-generated exploit does not necessarily expose unique network signatures. Generated code, exploit payloads, and protocol interactions can be indistinguishable from human-developed counterparts.

Consequently, there is no reliable general-purpose network signature for an AI-developed zero-day .

Instead, A-HUNT should emphasize detecting vulnerability exploration and exploitation outcomes.

Detection opportunities

A-HUNT should therefore incorporate vulnerability research telemetry where available.

This includes application exception logs, API traces, memory-safety telemetry, web request metadata, and runtime security events.

For organizations with mature engineering environments, instrumenting high-value applications to preserve the relationship between input, exception, and subsequent request behavior could significantly improve detection.

Novel exploit hunting hypothesis

AH-ZD001: A series of related malformed inputs produces application exceptions, followed by a successful unauthorized state transition and immediate post-exploitation activity, without a previously identified vulnerability signature.

AH-ZD001: A series of related malformed inputs produces application exceptions, followed by a successful unauthorized state transition and immediate post-exploitation activity, without a previously identified vulnerability signature.

This is a behavioral zero-day hunting hypothesis.

It does not claim to identify AI-generated code. Instead, it detects the exploitation sequence that an autonomous vulnerability-discovery system might produce.

Autonomous intrusion confidence assessment

I would avoid a binary AI Attack: Yes/No classification.

Instead, the framework should distinguish evidence of automation, evidence of adaptive control, and evidence specifically linking an operation to AI .

A proposed scoring system follows.

Preliminary scoring bands

These thresholds are illustrative, unvalidated triage thresholds , not calibrated probabilities.

The presence of confirmed AI orchestration evidence should materially increase confidence, but the framework should not label an attack AI-driven based solely on its numerical score.

I recommend maintaining three separate confidence judgments:

Confidence in malicious activity: Is the behavior unauthorized and indicative of intrusion?

Confidence in adaptive autonomy: Is there evidence of feedback-driven planning, execution, or coordination?

Confidence in AI involvement: Is there direct or independently corroborated evidence that an AI system controlled or materially influenced the operation?

This prevents an important analytical error: interpreting sophisticated automation as proof of artificial intelligence.

Required telemetry architecture

Detecting agentic offensive activity requires correlation across security domains that are often monitored separately.

The final three sources are particularly relevant when an attacker compromises an organization’s own AI-enabled applications or agent infrastructure.

However, defenders generally cannot inspect an external adversary’s private model or orchestration system.

A-HUNT must therefore remain effective when only network, application, identity, and endpoint telemetry are available.

Additional logging requirements

I recommend preserving enough event detail to reconstruct:

The exact order of related requests and commands.

Response codes, errors, and enforcement results.

The relationship between identities, sessions, hosts, and services.

Payload similarity across multiple attempts.

Timing between environmental feedback and subsequent actions.

Connections between apparently independent execution sources.

Where application bodies or prompts contain sensitive information, collection should follow data-minimization and access-control requirements.

Operational implementation

I would deploy A-HUNT through four complementary workstreams.

Workstream A: Exposure and exploitation hunting

Focus on internet-facing applications, APIs, cloud services, identity infrastructure, and high-value remote-access systems.

Develop behavioral detections for input mutation, exploit refinement, rapid access verification, and post-exploitation chaining.

This workstream targets AH-01 through AH-04.

Workstream B: Autonomous post-compromise hunting

Focus on command execution, privilege discovery, credential access, lateral movement, and internal reconnaissance.

Develop analytics that identify context-dependent attack sequences rather than isolated commands.

This targets AH-05 and AH-07.

Workstream C: Distributed campaign correlation

Build graph analytics capable of connecting multiple sources based on timing, targets, shared artifacts, and behavioral dependencies.

Use these relationships to investigate possible specialized-agent roles and distributed task coordination.

This targets AH-06 and AH-09.

Workstream D: Adaptive evasion and agent infrastructure

Correlate defensive enforcement with subsequent changes in adversary behavior.

Where organizations operate AI agents, examine unauthorized tool calls, unexpected model-to-tool transitions, excessive privileges, and unusual automated execution.

This targets AH-08 and supplements conventional ATT&CK and ATLAS detections.

Initial deployment milestones

I would begin by validating three cases: feedback-directed web exploitation, automated post-exploitation branching, and multi-source coordinated reconnaissance.

These offer the best combination of operational relevance, observable behavior, and testability.

Existing research to incorporate

A-HUNT should build directly on available research rather than duplicating MITRE’s work.

MITRE ATT&CK Campaign C0062: Provides a particularly useful real-world case for mapping an AI-orchestrated intrusion across established ATT&CK techniques. The documented activity spans reconnaissance, exploitation, credential harvesting, and exfiltration. MITRE campaign record .

MITRE ATLAS: Provides a complementary taxonomy for attacks against and abuse of AI systems. Its coverage of agentic AI should be incorporated into the framework’s technique mappings. MITRE ATLAS .

Anthropic, June 2026: Its research into 832 accounts associated with malicious cyber activity provides useful evidence for analyzing how attackers employ AI across ATT&CK techniques. Mapping AI-Enabled Cyber Threats .

Google Threat Intelligence Group, September 2026: Documents the transition toward agentic workflows, providing contemporary examples for testing autonomy-focused hunting hypotheses. From Prompting to Autonomy .

Google Threat Intelligence Group, May 2026: Provides evidence of AI-assisted vulnerability exploitation, directly supporting the need for vulnerability-discovery and adaptive-exploitation hunting. Adversaries Leverage AI for Vulnerability Exploitation .

These materials provide evidence that A-HUNT is addressing an emerging operational reality, although they do not yet establish the prevalence of autonomous multi-agent campaigns across the broader threat landscape.

Intelligence assessment and future direction

The most consequential implication of autonomous offensive operations is not simply that AI allows attackers to move faster. It is that AI can potentially change the relationship between an adversary, its tools, and the target environment .

Conventional hacking frequently involves an operator selecting techniques, executing them, examining results, and deciding what to do . Agentic systems increasingly allow portions of that decision cycle to be delegated to software capable of interpreting environmental feedback and selecting subsequent actions.

A coordinated multi-agent architecture could further distribute these activities across numerous execution environments, reducing reliance on any single infrastructure component while increasing the number of possible attack paths.

This complicates traditional approaches to detection and attribution.

An organization may observe reconnaissance from one source, exploitation from another, and authenticated access from a third, without recognizing that the activities support a common objective. Furthermore, an agentic system may repeatedly change its execution strategy until it identifies an effective path, potentially reducing the defensive value of static signatures and historically observed intrusion sequences.

The appropriate response is not to abandon MITRE ATT&CK, IOC-based detection, or conventional behavioral analytics.

Rather, defenders should introduce a second layer of analysis that examines how adversary actions are selected, modified, coordinated, and sequenced .

Proposed doctrinal addition: Decision-Cycle Hunting

I recommend establishing Decision-Cycle Hunting (DCH) as the principal methodology underlying A-HUNT.

DCH would investigate five observable characteristics:

Feedback dependency: Whether subsequent actions are meaningfully influenced by earlier results.

Adaptive selection: Whether execution techniques change in response to encountered conditions.

Temporal compression: Whether complex intrusion phases are completed within unusually short decision intervals.

Distributed coordination: Whether apparently independent activities converge toward a shared operational objective.

Campaign learning: Whether later intrusion attempts incorporate information obtained during earlier activity.

The goal is to move from detecting individual attack techniques to reconstructing the adversary’s operational decision process.

This is particularly important for AI-enhanced zero-day campaigns. Even when the vulnerability is unknown and its exploitation does not match an existing signature, an automated attacker may still produce recognizable sequences of discovery, testing, adaptation, exploitation, and follow-on activity.

A-HUNT should treat autonomy as a behavioral hypothesis to be tested, not an attribute automatically assigned to sophisticated attacks.

The greatest analytical value comes from correlating events that traditional detection systems may consider unrelated.

An individual failed exploit is rarely significant. A failed exploit followed by a revised payload may indicate automation. A revised payload that appears to account for a specific application response suggests adaptive behavior. Similar adaptations coordinated across multiple sources and targets could indicate a distributed offensive system.

That progression supplies a defensible foundation for hunting increasingly autonomous campaigns, even when the underlying AI models, agent software, and orchestration infrastructure are inaccessible.

The generation of threat hunting must examine not only what an adversary does, but also how its behavior changes in response to what it learns.

That is the fundamental premise of A-HUNT.