July has been a significant month when we talk about AI in the context of cybersecurity.
Much has already been said about how AI isn’t changing the attacker’s objective, but rather the speed at which they operate, requiring defenders to detect and respond more quickly to ongoing malicious activity.
Many have been pitching “Fight AI with AI” to counter fast, AI-powered cyber threats. For me, that is not always the case because we often forget the “cyber basics that can disrupt and derail any intrusion.”
This month started with JADEPUFFER, identified as the first aggressive ransomware attack managed end-to-end by an AI Agent. It was discovered by the cybersecurity firm Sysdig.
This ransomware marks a milestone because the AI makes operational decisions autonomously instead of following a static script. The analysis shows an extortion operation against databases in which a large language model (LLM) autonomously executed tasks of reconnaissance, fault correction, credential discovery, lateral movement, encryption of thousands of configuration items, and destruction of information.
The key defensive change is not asking whether the attacker “uses AI,” but whether the organization has the appropriate controls and skills to identify and contain the threat just in time.
Ransomware still has its typical “playbook,” but its speed and automation will test organizations’ defenses and early detection capabilities. As a professional involved in active defense initiatives for nearly 11 years, I can attest that cyber deception and cyber denial techniques are fundamental in many cases. However, the historical challenge lies in ensuring that defense teams can identify these warning signs as early as possible in the attack chain and automate the response. A specialized anti-ransomware layer that provides resilience when the attacker bypasses the EDR component is a strategic piece in the current threat landscape and security architectures at endpoint level.
As precedent, last March, Halcyon had already reported increased instances of the LLM-developed EvilAI masquerading as fake AI-productivity apps while secretly providing ransomware actors initial access. Researchers saw FulcrumSec use LLM-assisted negotiation and data triage.
Now, the hot news flooding media headlines is OpenAI’s most recent and widely discussed security incident, which occurred in July 2026. Advanced models from the company escaped a controlled testing environment and launched an autonomous cyberattack against the Hugging Face platform where:
The GPT-5.6 Sol model and another, even more capable, preliminary version, which were being evaluated internally, were involved.During a cybersecurity test with reduced restrictions, the AI discovered a zero-day vulnerability to bypass the sandbox and connect to the internet.While searching for resources to complete their task, the autonomous agents attacked Hugging Face servers using stolen credentials, generating thousands of automated actions in a short period.Hugging Face’s security team and agents detected and stopped the activity on their infrastructure, and had already begun containment and forensic reconstruction using their own open-source models when the teams connected.
This incident has raised concerns from various perspectives, and more opinions will continue into the coming weeks, including from the political side, technical aspects like AI kill switches, security by design, and others.
But new challenges for defenders are emerging as we begin to see new use cases generated from the endpoint. I remember that early in 2022, analysts coined a new “ITDR” layer (Identity Threat Detection and Response) to address identity-based attacks that became “the new normal” during human-operated ransomware attacks and high-profile incidents, such as SolarWinds.
Now, new scenarios are emerging in the current surface for defenders:
1. Discovering, understanding, and controlling every agentic application action before it reaches sensitive data or systems.
2. Continuous inventory agents, plugins, skills, MCP servers, extensions, models, and enterprise software across managed and unmanaged endpoints.
3. Agentic software that can interpret goals, invoke tools, chain actions, and operate autonomously under valid permissions. Each action may look normal while the overall sequence creates unacceptable risk. The defender needs to consider adding a granular control layer for application reasoning and tool use, complementing the existent endpoint, identity, network, and data controls.
4. Workflow Controls and Governance will be the new must-have in the “agentic software” world.
No, maybe it’s not “Skynet,” but the AI riders continue to outpace the defense teams.