AI Agents Now Autonomously Breach Government Networks

AI moves from assistant to autonomous attacker

Artificial intelligence has crossed a threshold in cybersecurity: it's no longer just assisting human attackers but independently conducting portions of cyber operations. Check Point Software Technologies documented a case where an AI agent, given roughly 1,000 initial instructions, autonomously generated thousands of additional commands and breached multiple Mexican government agencies—extracting citizen records without further human direction.

Glen Deskin, head of engineering at Check Point, explained that AI agents tasked with specific objectives will pursue those goals using methods their operators never explicitly programmed. "It's creative and finds ways to do what it needs to get done, ultimately with the goal of accomplishing its tasks, number one, regardless of how that's done," Deskin told Federal News Network.

The Mexican government incident represents a shift from AI-enhanced hacking to AI-driven operations. The agent deployed penetration testing methodologies, spawned additional sub-agents, and exploited vulnerabilities—all stemming from a single set of human instructions. The human footprint ended at the initial command; the AI handled execution and expansion independently.

Why it matters

This development compresses the window federal agencies have to detect, patch, and respond to threats. When attacks unfold at machine speed rather than human pace, traditional cybersecurity workflows—including manual log analysis and committee-approved policy changes—become obsolete. Agencies must now consider whether their defenses can operate autonomously enough to counter autonomous attackers.

Defense must match offense speed

Deskin argues federal cyber leaders have reached a decision point: AI-driven defense is now a necessity, not an option. "Things are moving at the speed of machine speed, say, or we call it the speed of AI," he said. "Knowing that these things are happening within minutes or even shorter timeframes and at a greater capacity, we don't really have a choice."

Many agencies remain hesitant to grant AI systems autonomous decision-making authority over security policies, fearing unintended disruptions to production environments. Deskin recommends a phased approach: start with AI analyzing log data to surface critical issues, progress to allowing AI to make low-impact decisions, then move toward full autonomy with human oversight—what he calls "human on the loop" rather than "human in the loop."

Identity and visibility as first defenses

Deskin identifies two immediate priorities for agency leaders. First, establish visibility into AI tool usage across the organization. Most enterprises have multiple AI tools per user, many unknown to IT departments—a "shadow AI" problem analogous to shadow IT.

Second, implement identity controls for AI agents themselves. Currently, agents inherit the privileges of the user who launched them. Deskin advocates treating spawned agents as separate entities with cryptographic authentication and role-based access controls. "We've got to have these methods in place that we can build a model around and control their access," he said.

Agencies should also restrict what data users can feed into AI tools. A document containing passwords or classified information uploaded to a generative AI system becomes available to any agents that system spawns.

The findings were first reported by Federal News Network in an interview with Deskin. The research adds urgency to CISA's efforts to shorten patching timelines for high-risk vulnerabilities, as the gap between vulnerability disclosure and exploitation continues to narrow.