Your AI agents are now an attack surface

On 3 June, Anthropic published something more useful than another warning about AI and cybercrime. Its threat intelligence team took 832 accounts banned for malicious activity between March 2025 and March 2026, and mapped every case onto MITRE ATT&CK, the standard framework security teams already use to describe attacker behaviour.

The conclusion is not that AI invented new attacks. It is that AI removed the skill requirement for old ones.

That distinction matters for you, because your marketing stack is now full of agents holding real credentials.

What the report actually says

Anthropic’s earlier disclosure in November 2025 got the headlines: a Chinese state-linked group, tracked as GTG-1002, ran what the company described as the first largely autonomous AI-orchestrated cyber espionage campaign, against roughly thirty targets. Anthropic estimated that 80 to 90 percent of the operations executed without human intervention.

Plenty of security researchers pushed back on that framing, and fairly. The claim that AI ran the operation is hard to verify from the outside, and the industry has been burned before by vendors overselling their own telemetry.

The June study is more grounded, because it is not one dramatic case. It is a year of banned accounts, categorised. And the pattern it shows is consistent: reconnaissance, vulnerability discovery, credential harvesting and data analysis are the phases where AI helps most. These are the tedious, knowledge-heavy parts of an intrusion. Automate them and someone who could not previously run a campaign suddenly can.

The two numbers that matter more than the headline

Strip out the espionage angle and two findings survive.

The first is that the phases where AI contributes most are the ones that used to take expertise and patience. Reconnaissance across a target’s public surface. Reading code to find a weakness. Testing credentials at scale. Correlating exfiltrated data to work out what is valuable. None of that is glamorous, all of it used to be a barrier to entry.

The second is that the volume of accounts involved, 832 over twelve months, describes a steady flow rather than a handful of sophisticated operators. That is the part with consequences for you. A world with a few elite attackers is a world where you are probably not a target. A world where the skill floor collapsed is a world where being unremarkable stops protecting you.

Why this lands on marketing, not just IT

Two years ago, the marketing department did not hold credentials that mattered to an attacker. That is no longer true.

Think about what a connected agent touches in a typical setup. It reads your CRM to enrich lead records. It queries your ad accounts to build reports. It has an analytics token. It probably has write access somewhere, because read-only agents are less useful and nobody wanted to configure two sets of keys.

Now consider how those credentials were provisioned. In most companies we audit, the answer is the same: someone pasted an existing admin key into a configuration file, because it worked and the deadline was Friday.

The risk is not that a model turns hostile. It is that an over-scoped credential sits in a place with weaker controls than your production infrastructure, and that an agent can be steered into using it. Prompt injection through a scraped page, a poisoned dataset, a malicious document dropped into a shared folder: the entry points are mundane.

What we actually changed on our own stack

We run agents across client accounts, so this is not theoretical for us. Four things we now treat as non-negotiable.

Separate credentials per agent, always read-only by default. If an agent builds reports, it gets a reporting token. Write access is granted per use case, never as a convenience. This is dull work and it is the single highest-value control.

Spend caps at the platform level, not in the prompt. Telling an agent not to exceed a budget is a suggestion. Setting a campaign-level cap in the ad platform is a rule. Never rely on instructions to enforce something a setting can enforce.

Every tool call logged, with the arguments. When something goes wrong you need to know what the agent did, not what it said it did. Anthropic recovered roughly 17,600 attacker actions from logs during a later incident. Logs are what turned that case from a mystery into a timeline.

A human gate on anything irreversible. Publishing, sending, deleting, spending. An agent can prepare all of it. A person confirms it. We wrote about this when we looked at what you can safely delegate to agents, and the boundary has not moved.

The threat is not a clever model. It is an admin token that nobody remembered was in a config file. MyDigipal

What an agent audit actually turns up

We have now run this exercise on enough accounts to know what comes out of it. The findings repeat with unhelpful reliability.

A credential belonging to someone who left. Usually an agency, a freelancer or a former employee. Nobody revoked it because nobody knew it existed, and the automation it powers still works, which is exactly why it went unnoticed.

An agent with write access it never needed. It was granted during setup to unblock a test, and the test became production.

A tool connected to a personal account. Someone authorised an integration with their own login because the shared account did not have the right permission that day. The integration now depends on one person’s session.

No logs at all. The agent runs, does things, and leaves no trace beyond its final output. When something looks wrong, there is nothing to inspect.

A prompt containing a rule that should be a setting. “Do not spend more than 500 a day” written in an instruction, with no cap configured anywhere.

None of these require an attacker to be involved before they cost you something. The credential from a departed contractor is a compliance problem on its own. The missing logs mean an ordinary mistake becomes unexplainable.

The objection we hear most

“We are too small to be a target.” It was a reasonable position when running an intrusion required a specialist. The whole point of the Anthropic data is that this is no longer the constraint.

Automated opportunism does not select for company size. It selects for exposure. A small firm with an over-scoped API key sitting in a public repository is more exposed than a large one with proper credential hygiene, and the tooling that finds that key does not care which of the two you are.

The uncomfortable part

There is a version of this article that ends with “so be careful out there”. That is not useful.

Here is the harder point. Most marketing teams cannot currently answer three questions about their own agents: which credentials does each one hold, what is the blast radius if one is compromised, and where are the logs. If you cannot answer those, you do not have an AI security problem yet. You have an inventory problem, and it will become an AI security problem.

Start with the inventory. List every agent, automation and integration touching your marketing stack. Write down what each one can read and what each one can write. Most teams find at least one credential that should have been revoked months ago.

That exercise takes an afternoon. It is also the only part of this that you can do without buying anything.

If your tracking and data flows are already unclear, that audit is the natural place to start, and it is work we do before we connect anything to anything. And if you are building agents into client-facing workflows, our AI solutions team scopes them with these controls from day one.

Sources: Anthropic, mapping a year of AI-enabled cyber threats (3 June 2026) - Help Net Security on the study (5 June 2026) - Anthropic on the GTG-1002 campaign - The Conversation, why researchers have questions