Cybersecurity experts agree on one thing: the next wave of threats will be largely driven by generative artificial intelligence. And in particular, by agent-based AI—those autonomous systems capable of orchestrating complex attacks with little or no human intervention. 

“This gives cybercriminals an advantage,” notes Vincent Rémon, head of information systems security at the Ministry of Culture. “But it’s also an opportunity: the tools used by attackers can also be used to defend against them.”

This summer, Anthropic claimed to have dismantled a sophisticated cybercrime operation that relied on its Claude Code model. The model was used to automate reconnaissance, credential harvesting, infiltration, and data exfiltration, as well as to determine ransom amounts and generate psychologically targeted extortion notes.

AI Makes Cyberattacks More Accessible 

Thanks to AI, phishing is no longer limited to mass campaigns. Powered by models capable of analyzing contextual data, attacks are becoming hyper-personalized. An email, video conference, or voice message can now faithfully replicate the style and voice of an executive thanks to spectacular advances in deepfakes.

At the same time, AI enables the creation of new types of attacks capable of dynamically changing their behavior, scripts, or signatures to bypass traditional security tools. Research projects such as PromptLock have already demonstrated how ransomware can generate thousands of variants on the fly to evade detection systems and tracing mechanisms.

Another major shift: accessibility. Whereas complex campaigns once required technical expertise, a budget, and coordination, “ready-to-use” malicious agents are now available on underground marketplaces for a few hundred dollars. The result: an explosion in the volume of attacks, combined with a significant drop in costs for cybercriminals.

AI can also be defensive

Faced with these new AI-driven threats, CISOs and CIOs are also turning to… artificial intelligence. Agent-based AI can indeed strengthen cybersecurity systems: it enables a shift from static automation to autonomous defense strategies capable of adapting and responding proactively.

Unlike traditional automated systems, AI agents can analyze data in real time, understand context, and make independent decisions, all while collaborating with human teams. This approach enables a rapid response to sophisticated and unpredictable threats—where traditional tools fall short.

In security operations centers (SOCs), AI agents can filter and prioritize alerts, correlate weak signals, and automatically isolate compromised systems. They also analyze user behavior to identify internal threats or stealthy compromises, and orchestrate the continuous deployment of patches.

Thanks to large language models, these agents can analyze unstructured information—such as threat reports or malware notes—to detect emerging patterns before they become widespread. This ability to continuously learn is a key driver of proactive cyber resilience.