Unnamed customer of Sophos agentic AI attack — Oct 2026

Overview

Sophos researchers have documented a significant shift in cyberattack methodology, identifying a case where a threat actor utilized autonomous AI agents to accelerate the development of malicious software. This incident highlights the emergence of AI as an operational force multiplier, enabling attackers to compress development timelines that previously required weeks of human effort into just a few days.

What happened

Sophos tracked a threat actor identified as STAC6994, who successfully gained initial access to an unnamed customer's network. Once inside, the attackers deployed approximately 12 AI agents to conduct a software development operation. These agents were tasked with autonomously writing and testing various malware modules specifically designed to evade detection by security software, including products from Sophos, CrowdStrike, and Microsoft Defender.

According to the Sophos AI Security 2026 report, this automated process resulted in the creation of nearly 80 distinct malware modules and over 70 unique methods intended to bypass security controls. John Peterson, chief technology officer at Sophos, noted that this activity represents the first documented instance of AI being actively used as an operational force multiplier in this capacity. The report indicates that Sophos was able to track the activity of STAC6994 and successfully block the techniques developed by the agents before they could be deployed more broadly. This incident underscores the evolving nature of cyber threats, where attackers are increasingly leveraging AI to automate the creation and refinement of malicious tools within compromised environments.