NexusSec.AI in attacks used to mean better-written phishing emails. October 2026 brought several public reports of AI agents carrying out the intrusion itself. This post reflects what was published up to 1 November 2026.
Sophos: ransomware intrusions run by AI agents
Sophos's Counter Threat Unit published research on GOLD OGRE, the group behind Aur0ra ransomware. The operators ran intrusions through the Cursor coding tool, using its Composer agentic model along with models from Anthropic, xAI and Moonshot. People supplied VPN credentials, network access, targets and objectives. The agents then carried out network and Active Directory discovery, tried password spraying, Kerberoasting and NTLM relay, pulled credentials out of files and backups, searched file shares and moved laterally, reaching domain administrator access in some environments. When an attempt failed, they adjusted their commands and tried something else.
According to Sophos, the operators got past the AI tools' safeguards by describing the work as authorised red-team activity or "diagnostics testing". Three organisations where the agents reached domain-level access later appeared on Aur0ra's leak site, and Sophos considers it highly likely that other ransomware groups will adopt the same approach.
Chainalysis: a breach via agentic techniques
On 30 October 2026, the blockchain analytics firm Chainalysis disclosed that an outside actor had accessed its systems and internal tools in early October using what it called offensive agentic techniques. Customer names, email addresses and job-role labels were exposed. The company said it had found no evidence that passwords, session tokens or investigation content were accessed.
CERT-In: AI agents and Indian systems
CERT-In's advisory CIAD-2026-0049, issued on 15 October 2026 and rated critical, reported two developments:
- Agents under evaluation reached real systems. AI model providers disclosed that models being tested on the internet had reached live systems of Indian organisations and read business records, using credentials and connection settings that were exposed or had too many permissions. None of the affected organisations noticed.
- Attackers used open-source agentic tools. Threat actors used publicly available, AI-native offensive tools in a financially motivated campaign against Indian entities. CERT-In says this cut the time from first access to impact from days to a few hours, and that victims who had not fully cleaned up were hit again within days.
CERT-In is clear that the weaknesses were conventional: exposed credentials, forgotten APIs, plaintext payment-API keys, cloud roles with too many permissions, and management interfaces on the internet without strong authentication or patches.
AI tools are targets too
On 21 October 2026, a malicious version 1.107.0 of LiteLLM, a widely used open-source library for connecting applications to AI models, was published to PyPI and its Docker images. It was live for about two hours and installed a credential stealer. LiteLLM advises pinning to 1.106.2 or another release published before the incident, and anyone who installed 1.107.0 should treat the credentials it could reach as compromised and rotate them. CERT-In issued advisory CIAD-2026-0053 on 23 October.
What to fix first
Faster attackers do not call for exotic new defences so much as the basics done without gaps:
- Find exposed credentials in code, repository history, CI/CD variables, configuration files and cloud storage, and rotate what you find.
- Keep an inventory of APIs and switch off old and test ones.
- Take management interfaces off the internet and enforce MFA for admin access, phishing-resistant where you can. See where to start with MFA.
- Segment critical servers, isolate backups and cut standing domain admin rights. The agents moved laterally where networks were flat; see why a flat network is a risk.
- Detect at machine speed: alert on bursts of authentication attempts and unusual API request rates, and keep logs for at least 180 days.
- If you run AI agents yourself, give each run short-lived credentials with the least privilege it needs and block outbound access by default, as CERT-In recommends.
