In late July 2026, OpenAI was testing one of its new models in a closed environment when the model decided to break out(nytt vindu). It hacked into the private infrastructure of another software firm, Hugging Face, to steal the answer key to a cybersecurity benchmark it was being tested on. In other words, it broke the law for the sake of expedience.

Days later, the UK AI Security Institute disclosed that Anthropic’s Mythos 5 AI model(nytt vindu) had created fake developer identities, spear-phished real GitHub users into approving malicious code, and edited its own activity log to cover its tracks when caught.

Then in August, news broke that a Melbourne man named Andrew had asked his personal AI agent,(nytt vindu) built on OpenClaw and running Anthropic’s Claude, to help him get into a fully booked morning gym class. He was fourth on the waitlist and asked if there was any way to move up.

The agent found that the booking API had no authorization check on cancelling other users’ reservations. So without asking permission from Andrew, it went ahead and cancelled the booking of the person in first place to make room for him. When Andrew asked it to undo the cancellation, it couldn’t: “The person I removed is gone from the waitlist and I have no way to restore them.”

The origin of these three incidents is not the same, but the result is: AI agents probed and exploited systems faster and more thoroughly than any human would have managed. They were never instructed to attack anything but found the shortest path to its goal anyway.

It doesn’t matter whether you’re a frontier lab’s infrastructure or a suburban gym’s booking software. If you have a business that exposes an API, you are now something an AI agent can probe, at a speed and completeness no human attacker matched. And nobody needs to decide to attack you.

Speed is the real story

A human attacker weighs effort against reward. They get bored, they run out of time, they decide a gym booking app isn’t worth the trouble. That calculation is what has quietly protected most low-value targets from casual exploitation for the last 20 years (unless you’re running WordPress).

An AI agent doesn’t make that calculation. Given a goal, it will try whatever the API technically permits, testing endpoints and parameter combinations at machine speed until something works. It found the gym’s authorization gap in the time it took Andrew to ask a follow-up question.

The scale of that speed gap is already visible in the numbers. Unit 42’s 2026 Global Incident Response Report(nytt vindu) found the fastest attacks now exfiltrate data in 72 minutes, down from 285 minutes the year before. That’s the trend with humans still mostly in the loop. An agent makes decisions in milliseconds; a human analyst responds in minutes to hours.

For security teams, that increasing speed is the real cause for concern, not any single incident that makes the news.

The new attack surface: everything with an API

Any service exposing an API is a potential target, whether or not it looks like one.

  • Pricing engines where discounts are validated client-side
  • Inventory systems where stock state lives in the storefront instead of the backend
  • Support platforms where internal fields are reachable through undocumented API paths
  • Subscription management that doesn’t verify caller ownership of the account being modified.

None of these require a human to go looking for them. They just require an agent with a goal and an API that answers.

The businesses most exposed aren’t the ones with obvious security holes. They’re the ones with business logic gaps: rules that exist only in the UI, actions the API technically allows but the interface never surfaces, workflows built on the assumption that no caller would ever try the path that skips the intended one.

The gym’s developer almost certainly didn’t think an authorization check on cancellations was worth writing, because no ordinary user, and no ordinary attacker, had reason to try it. An agent had no such reservations, and it wasn’t even trying to find a reservation to skip. It was just trying to be helpful.

How businesses can brace for AI attacks

Treat every API action as a privileged operation. Identity, authorization, and contextual policy, checked independently, on every call. Not “the frontend won’t let you do this,” but “the server verifies you’re allowed to do this, on this resource, given its current state.” The gym’s system would have stopped this specific incident with one line of authorization logic on the cancellation endpoint. This is not a new control at all, it’s the oldest item on OWASP’s API security list, broken object-level authorization, and it’s still the one most systems get wrong.

Give agents their own credential model. Scoped, short-TTL tokens issued specifically for agent sessions, distinct from ordinary human session tokens, constrain the blast radius even when the agent finds a gap you didn’t anticipate. If Andrew’s agent had held a token scoped only to his own reservation, the cancellation of someone else’s booking would have failed at the credential layer regardless of what the API otherwise permitted. This matters because you cannot rely on the agent’s own restraint. You have to rely on what its credentials physically allow it to do.

Instrument for agent behavior detection specifically. Agent traffic has a distinguishable shape: sub-human request timing, systematic endpoint enumeration, sequential probing across parameter combinations, successful execution of actions no human user has ever attempted through the actual interface. Baseline for that shape and alert on it in real time.

Close the response-time gap, not just the detection gap. Detecting a probe in an hour is meaningless if the probe completed and moved on in minutes. The Unit 42 number above, 72 minutes for the fastest human-paced attacks, is already the wrong benchmark to plan against. Automated response, not just automated alerting, is what closes a gap measured in milliseconds. Of course, you also need to ensure that your automated response is not a damaging one either.

Assume this will happen and rehearse the response. Document who gets called, predraft customer communications, and run tabletop exercises against agent-driven scenarios specifically, not just traditional breach playbooks. IBM’s 2026 Cost of a Data Breach Report put the average global breach at $4.99 million, with AI-enabled breaches averaging roughly $1 million more. Those figures increasingly describe incidents that started the way the gym’s did: no attacker in the traditional sense at all.

Test your own APIs the way an agent would, before an agent does it for you. Manual pentesting assumes a human tester with limited time and a finite list of things to try. An automated adversarial against your own endpoints, probing with the same persistence and speed as an agent, will surface the same gaps before a customer’s assistant stumbles into them. Open-source tools now exist specifically for this. CyberStrike(nytt vindu), for example, runs specialized agents mapped to OWASP WSTG and MITRE ATT&CK against your own endpoints, including a dedicated tester for exactly the object-level authorization gap that caught the gym off guard: It sends a baseline request, sends the attack, and only flags a finding if there’s a measurable, reproducible difference. That’s the same class of check that would have caught the cancellation endpoint before an agent found it in the wild.

The principle isn’t new of course. Site owners who ran their own vulnerability scanners against WordPress installs during the botnet era survived it. The tooling just needs to match the speed of the caller now, not the speed of a human attacker who might eventually get around to it.