Recently, I wrote about agentic loitering munitions: persistent AI agents that can quietly wait for opportunities to attack the enterprise network. While that article focused on threats to networks, a much bigger threat is that this technology can attack the organization itself.
Human networks
An organization is a system of people, technologies, and relationships, with an attack surface extending far beyond its employees and devices.
Its job postings, social media announcements, and employee profiles reveal clues about technology deployments and organizational structures. Leaked credentials and stolen session tokens provide potential ways to bypass access controls. This extends to vendors, contractors, and other supply-chain partners that have their own people and system exposures.
An organization's employees also have lives outside work. Their spouses, children, friends, and other trusted relationships connect them to personal devices and social network accounts that corporate security teams typically don't observe. Employees may share passwords and even passkeys, while credential-recovery mechanisms create dependencies beyond the corporate identity system. Advertising networks and data brokers may also expose information about individuals' locations and routines.
Knowledge of these exposures isn't new. Human-centered attack graphs and multi-stage social engineering have been proposed in security research, and elements of AI-assisted operations have already been observed. State intelligence agencies have long cultivated human targets and exploited organizational graphs of people and technology to steal secrets.
But these operations were expensive, relying on skilled human labor and difficult manual investigations.
AI changes the economics.
A persistent intelligence system can perform substantial portions of this analysis using inexpensive, self-hosted LLMs to continuously monitor organizational weaknesses. It can propose hypothetical attack paths, perform investigations, and revisit the list of weaknesses over months or years, waiting for additional weaknesses to create a successful attack chain.
But this isn't simply cheaper reconnaissance. GenAI provides the ability to preserve findings and be selective about when to expend resources. Rather than indiscriminately phishing or monitoring cell-phone locations, an adversarial AI system can use this information to manipulate trust, blackmail, and otherwise compromise relationships extending beyond work.
Replying to a discussion-board post about someone's hobby may be more credible than a corporate phishing email. An otherwise ordinary discussion could become a vehicle for a tailored malicious download, disguised as something useful, such as a fishing planner. And the availability of capable open-weight cybersecurity models makes this easier than ever before.
Attacks could also target not only people employees trust, but the AI agents they rely on. Think of a mass gaslighting attack in which agents are fed false information to influence employee decisions or cause them to disregard user instructions.
An adversary may need to compromise only one critical employee or supplier to handicap the entire organization.
This is the glide path to an organizational zero-day.
This is not necessarily an attack exploiting an unknown software vulnerability. It is a large-scale, AI-mediated attack on the individual decision-makers of a company and the technologies they rely on.
AI effectively gives non-state actors selected capabilities that historically required state-actor resources, while giving state actors a large force multiplier.
And the cat is already out of the bag, with much of the agent infrastructure and capability already broadly disseminated.
Defense unknown
This new reality requires thinking beyond conventional security protections: approved devices, verified individuals, device-bound sessions, and verification of intent.
Even if all four were broadly enforced—far beyond what is currently standard—they would not be sufficient.
Beyond these protections, we need ways to establish the integrity and provenance of information, including agent-generated information, that leads to consequential authorization decisions. I don't think we yet have a complete solution to that problem.
We have spent decades securing technical networks. But the next adversary will attack the human network as well.
And the organizational zero-day may not be a vulnerability in any individual product. It may be a vulnerability in the organization itself.
Previous article: https://yakovshkolnikov.com/writing/agentic-loitering-munitions/