1
Rising From the Ashes: How Agentic AI is Unblocking Challenges in Cybersecurity
arXiv:2606.23138v1 [cs.CR] 22 Jun 2026
Gabriela F. Ciocarlie1 , Kathrin Grosse2 , Somesh Jha3 , Daryna Oliynyk4 , Andrew Paverd5 , Christian Wressnegger6 1 Stevens Institute of Technology, USA 2 Independent Researcher, Italy 3 University of Wisconsin-Madison, USA 4 CDL AsTra, Faculty of Computer Science, University of Vienna, Austria 5 Microsoft Security Response Center (MSRC), UK 6 KASTEL Security Research Labs, Karlsruhe Institute of Technology (KIT), Germany
Abstract—Security remains a high-cost challenge, with many problems historically deemed inefficient to address or effectively unsolvable. A significant number of these problems stem from labor-intensive tasks that create bottlenecks in defensive approaches. Agentic AI has the potential to alleviate these bottlenecks by directly ingesting and reasoning over natural language or code, thereby expanding the scope of feasible defenses. In this paper, we map open security problems to emergent agentic AI capabilities. To illustrate this potential, we examine 16 case studies, including supply chain analysis, highlighting how agentic AI may benefit defenders.
I NTRODUCTION The annual cost of cybersecurity incidents is estimated to range from 0.001 % to 9 % of global GDP [9]. These high costs reflect that security is far from solved. Over the past decades there have been many proposals for techniques and approaches that could prevent attacks or solve contemporary cybersecurity challenges. However, many of these have been held back from reaching their full potential because they are inherently labor-intensive, knowledge-intensive, slow, or error-prone. For example, although we now have memorysafe programming languages, we still have large amounts of legacy code because the human effort required to rewrite this in a new language exceeds the benefit. We have the tools to formalize and verify standards and protocols, but very few have actually been verified. We have techniques for attribution and threat intelligence, but these are largely unused due to scarce expertise. Recent developments in AI have enabled direct, languagebased communication with AI systems [30]. Fine-tuning these approaches has shown promising capabilities in code analysis [20], potentially processing large amounts of data, and integration of specific, general, or interdisciplinary knowledge. In addition, AI systems have become more autonomous as they are integrated directly with tools [45, 1]. In contrast to humans, AI agents may have the cognitive stamina to scan and analyze large code bases and reason about them. Agentic AI may thus not only enable mere automation of security workflows, but also redefine how we conceive, build, and deploy security tools at scale. In this paper, we explore how agentic AI can catalyze reviving capabilities or exploring entirely new approaches to
cybersecurity. To this end, we first summarize five challenges (C1-C5) that have impeded the use of security techniques, and then outline five potential agentic AI capabilities (A1-A5) that could ameliorate these challenges. To illustrate, consider the example of feasibility studies that check whether an attack applies to realistic targets, whether a proposed defense holds against a class of threats, or whether a new mechanism can be prototyped end-to-end at all. Although the question they aim to answer may be simple, such studies can be expensive and slow to carry out, contradicting the “fail fast, learn fast” principle. Based on its natural language understanding, information processing, and generalization capabilities, Agentic AI can solve previous challenges. An agentic AI can produce code, conduct experiments, and reason about outcomes, and can thus perform feasibility studies at substantially reduced cost and on shorter timescales, addressing previous challenges of excessive human effort, lowering previously high latency, providing potentially scarce expertise, and providing task-specific solutions. We argue that the application of agentic AI provides a potential general solution to security challenges. To this end, we elaborate on 16 case studies spanning the domains of systems security, software security, attacks and defenses, and cyber threat intelligence (CTI). However, the promise of a universal solution must be matched with rigor: agents entrusted with security-critical tasks must themselves be secure, offering strong guarantees that their autonomy does not introduce unforeseen vulnerabilities. PREVIOUS CHALLENGES In this section, we highlight five factors previously posed as challenges to the widespread adoption or deployment of various security mechanisms, and for each of them, we discuss how modern agentic AI systems can help to change the status quo. (C1) Requires excessive human effort: The task requires significant human time and effort, and the cost of doing this is likely to exceed the value obtained. For example, writing a complete formal specification for a widely-used security protocol may be sufficiently valuable to justify the effort, but doing the same for a rarely-used specialized protocol may not be justifiable.
2
TABLE I M APPING BETWEEN AI AGENT CAPABILITIES AND THE SECURITY CHALLENGES THEY HELP ADDRESS . Potential AI Capability
Excessive human effort
Unattainably low latency
✓ ✓ ✓ ✓
Natural language understanding Processing large amounts of information Cognitive stamina Generalization and replicability Multi-disciplinary knowledge
(C2) Requires unattainably low latency: The task must be completed within a bounded time, but humans are generally unable to complete the task within this time. For example, to be effective against an active attack, a self-healing system may need to be adapted/healed faster than a human is capable. (C3) Requires scarce/unavailable expertise: The task requires specialized expertise or skills, but there are not enough people with the requisite skills or expertise to carry out the task at scale. For example, finding vulnerabilities in deployed software systems requires specific skills, but there is a scarcity of people with these skills relative to the demand. (C4) Task-specific effort: A solution for one instance of the task does not generalize to other instances of the task, thus making widespread deployment or adoption very costly. For example, translating legacy code into memory-safe programming languages requires a specific solution for each code base. (C5) Problem complexity: The task is inherently complex, with exceptionally many constraints or aspects to be considered. This could imply that solving the task requires excessive human effort or scarce expertise, but could also extend into the realm of tasks that are beyond human ability.
Scarce expertise
Taskagnostic solution
Problem complexity
✓
✓
✓ ✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓
POTENTIAL AI CAPABILITIES Having described the challenges that have kept security ideas from scaling, we now turn to the capabilities of AI agents that could address them. We present five capabilities that current agents have demonstrated to varying degrees and that are improving as the technology matures. Table I provides an overview of how each capability addresses the challenges outlined in the previous section. (A1) Natural language understanding: Unlike conventional software, AI agents can process and reason in natural language, while still using ordinary programming languages for implementation. This capability enables operation at a higher level of abstraction, which reduces the manual effort and the expertise required to solve complex problems and supports more general, system-independent solutions. (A2) Processing large amounts of information: AI agents are capable of processing large amounts of material at once and reasoning over it jointly, rather than examining it piece by piece like humans. This both reduces the human effort required to work through large problems, helps address inherently complex tasks where the relevant context is too broad to hold
Excessive human effort
Unattainably low latency
Scarce expertise
Taskspecific solution
Problem complexity
Systems Security
Optimizing Instrumentation for Security Moving-Target Defense & SW Diversification Formalization of Security Standards Supply Chain Analysis Self-Healing Systems Customization of System Security
✓
✓ ✓
✓ ✓ ✓
✓ ✓ ✓ ✓ ✓ ✓
✓ ✓
Software Security
Vulnerability Discovery Exploit Generation Translation to Memory-Safe Language Domain-Specific Code Optimization Code IP Protection
✓ ✓ ✓
✓ ✓ ✓ ✓ ✓
✓ ✓
CTI
Attribution and Threat Intelligence Provenance Analysis for Forensics
✓ ✓
✓
✓ ✓
Attack Det.
TABLE II D EFENSIVE IDEAS AND THEIR LIMITATIONS Defensive idea
Insider Threat Detection Provenance Analysis & RT Monitoring Adaptive honeypots
✓ ✓
✓
✓ ✓
✓ ✓ ✓
✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
✓
✓ ✓ ✓
✓
3
in view all at once, and allows a conclusion to be reached quickly enough for tasks that must be completed within a tight-time bound. (A3) Cognitive stamina: AI agents deliver consistent judgments across similar tasks, consistently applying the same level of scrutiny without the fatigue or attention drift that affect human analysts. This sustained cognitive ‘agentic stamina’ reduces the burden of prolonged analysis and is especially valuable for complex tasks, where maintaining uniform standards across many cases or constraints is challenging for humans. (A4) Generalization and replicability: Building and validating an AI agent for a specific task is a one-time investment; once complete, the agent can be cloned and deployed in parallel across many systems at minimal additional cost. Adapting the agent to new tasks often only requires high-level adjustments rather than extensive code rewrites. This reshapes the economics of every aforementioned challenge: expert effort is spent once at the agent layer rather than repeatedly for each case; a single validated agent can extend scarce expertise wherever it is needed; system-specific solutions can be generated by the agent rather than handcrafted; and multiple operating agents meet volumes and timelines that overwhelm human teams. (A5) Multi-disciplinary knowledge: AI agents can integrate knowledge from multiple domains simultaneously, spanning areas such as browser internals, operating systems, compilers, and cryptographic protocols, all of which may be relevant to a single security problem. In contrast, human experts typically specialize deeply in only a subset of these areas, making comprehensive coverage dependent on assembling multiple specialists. By concentrating otherwise fragmented expertise in one place, agents enable cross-domaine reasoning, offering solutions that are not confined to a single discipline, and make it easier to tackle complex problems that require combining knowledge rarely found in any one individual. CASE STUDIES We present 16 case studies across different domains that have faced the challenges outlined above and demonstrate how they can take advantage of agentic AI for scalable adoption. Specifically, we look at: ▷ Systems Security ▷ Software Security ▷ Cyber Threat Intelligence (CTI) ▷ Attack Detection Table II summarizes these mechanisms and their limitations, which we elaborate on in subsequent sections. SYSTEMS SECURITY Optimizing Instrumentation for Security Many security techniques work by adding code to a target system so that relevant behavior can be observed, controlled, or constrained. Canonical examples include partitioning secrets across trusted execution environments [43], adding harnesses and argument generators for fuzzing [8], placing sanitizer and audit hooks in production code [27], and inserting declassification points for information-flow control [32]. Optimizing instrumentation runs into all five limitations at once.
Effective instrumentation demands substantial effort, since the work is performed by hand on large codebases, as longrunning projects such as Firefox sandboxing illustrate [27]. The relevant expertise is scarce, since correct placement requires deep familiarity with both the target program and the analysis it feeds. Each codebase has its own structure and invariants, so a strategy that works for one target rarely transfers to another. Some level of automation has been achieved more recently but not to a full extent [2][27]. The underlying problem is complex, requiring joint reasoning over program semantics, the analysis policy, and the cost of each added probe. And in online settings, instrumentation must be produced quickly enough to keep up with the systems it observes. AI agents have the potential to ingest source code, reason over the analysis goal, and propose where and how to instrument, turning instrumentation from a multimonth manual effort into a step that scales with the codebases it protects. Moving Target Defense & SW Diversification Varying the attack surface of a system so that an exploit prepared against one configuration does not work against another [19] is a long-standing approach to increase the cost of attacks. Software diversification is the leading example: rather than shipping a single binary, the defender produces many variants that differ in memory layout, instruction selection, or system-call interface, so that an exploit tuned for one variant fails on the rest. Network-layer techniques such as address/port shuffling and platform-rotation schemes follow the same principle. Four factors prevent these techniques from being widely deployed: First, the changes must occur faster than an attacker can adapt, often on the order of seconds, which is below what human-driven reconfiguration can achieve. Second, the work requires expertise in compilers, runtime systems, or network architecture that is concentrated in small communities. Third, every system has its own performance budget, dependencies, and operational constraints, so a diversification strategy designed for one application or network rarely transfers to another. Fourth, designing an effective moving target defense is inherently challenging, demanding a careful balance between security benefits, performance overhead, verifiability, and compatibility. Determining what to vary, how frequently to adapt, and at what cost has yet to admit a tractable algorithmic formulation. AI agents that can analyze a target system, generate diverse variants, and schedule reconfiguration under operational constraints can make moving target defense practical for systems that rely on static configurations and reactive patching. Formalization of Security Standards The vast majority of standards and security policies are defined primarily in natural language. From public standards through to internal organizational policies, these documents form the basis of modern computing. Over the past two decades we have witnessed significant advantages in formal verification techniques, enabling verification of systems and protocols (e.g., seL4 [23], TLS 1.3 [10]). However, several
4
factors have limited widespread adoption of formal analysis techniques. First, the work demands substantial human effort to translate from natural language into the precise machinecheckable language used by these tools. Second, this translation requires familiarity with both the source domain (e.g., legal, organizational, technical) and the formal semantics of the target language—a combination that could be exceedingly rare. Third, every translation is task-specific: each pairing of source description and target language brings its own ambiguities and idioms, so a translation pipeline built for one pairing rarely transfers to another. AI agents that can read informal requirements, reason over the target policy language, and produce a candidate translation for review could enable this translation to be carried out at scale to unlock the potential of formal verification.
factors make security self-healing difficult. First, the response must be applied inline, e.g., while the attack is in progress, before the exploit completes its effect. Second, every program has its own logic, integrity constraints, and set of functions that are safe or unsafe to repair, so a recovery strategy that works for one application does not transfer to another. Third, choosing a correct repair is a hard reasoning problem in itself, since it requires understanding what the program was trying to do, which state the attack has corrupted, and which of the available fixes restores a consistent state rather than merely suppressing the symptom. AI agents can act fast enough to intervene while the attack is still unfolding and reason about the specific program and the ongoing attack to construct a repair tailored to that situation rather than applying a fixed recovery rule.
Supply Chain Analysis
Customization of System Security
Complex software projects typically depend on a diverse ecosystem of components, introducing potential attack vectors through dependencies, build infrastructure, or the human elements supporting the supply chain [42]. To monitor dependencies and facilitate identification of imported vulnerabilities, software bill of materials (SBOMs) are usually compared to vulnerability lists. However, currently generated SBOMs still face automation challenges: they may be inaccurate or unsound, containing incorrect dependencies or versions [42]. AI agents, with their ability to ingest and interpret vast quantities of information, are well suited to this challenge. For example, agents can analyze entire repositories to identify dependencies and their versions, and cross-reference these against existing vulnerability repositories. Furthermore, AI agents may offer broader solutions for strengthening the software supply chain. They may defend against project takeover by systematically analyzing publicly available information about new contributors and continuously examining their commits for anomalous or suspicious behavior. In doing so, they reduce the reliance on implicit trust and alleviates the unsustainable cognitive and operational burdens historically placed on open-source maintainers. AI agents could also identify typo-squatting attacks by flagging suspicious package names, enabling timely intervention and removal. Finally, they could prevent dependency confusion by enforcing and monitoring policies that govern how dependencies are resolved and sourced.
Systems-level security mechanisms such as SELinux, AppArmor, seccomp, and capability-based sandboxing are designed to support fine-grained, per-system tailoring of access control and isolation policies [18, 26]. In practice, the policies shipped with most distributions are either too permissive or too complex to adapt, and operators often disable or bypass these policies rather than tuning them to a specific application or threat model. Two factors make customization difficult: First, customization is task and domain specific by construction: each deployment has its own application stack, operational context, and risk posture, so a configuration written for one system rarely transfers to another. Second, the problem itself is complex, requiring joint reasoning over program semantics, system-call behavior, and policy-language details that classical tools handle only in isolation. AI agents that can observe application behavior, reason over the target policy language, and produce per-system configurations on demand would address both at once, turning customization from a costly expert exercise into a routine deployment step. AI agents can help with tasks, such as customization of security mechanisms.
Self-Healing Systems A long-standing vision in systems design is that of systems that detect compromise, diagnose what went wrong, and repair themselves without human intervention [21]. Today, most deployed systems apply this idea only in a narrow, reliabilityoriented sense: restarting failed processes or shifting load to recover from downtime. Recovering from a security incident is a harder problem, because the system must not only survive the attack but also keep the affected process in a correct and consistent state. A repair that lets a program continue past an exploited vulnerability can be worse than a crash if it leaves the program in an unsafe or inconsistent state, for instance by allowing an attacker past an authorization check [25]. Three
SOFTWARE SECURITY Vulnerability Discovery Software vulnerabilities are the facilitators of far-reaching security incidents, either as a direct gateway into a computer system or as part of malware. Although advanced program analysis and AI have accelerated vulnerability discovery in recent years, human expertise has remained the deciding factor for finding flaws in complex software systems. These days, successful attacks are often a team effort of highly skilled individuals [4] specialized in subdomains that eventually merge into attack chains of ever-increasing complexity. Recent developments, such as Claude Mythos [6], demonstrate that agentic AI has the potential to bring another leap in vulnerability discovery. These systems (a) cover a wide range of specialized expertise in specific domains (e.g., kernel, browser, smart contracts, cryptographic protocol, web) and attack/analysis techniques; (b) can draw far-reaching connections in both depth and breadth across codebases, subdomains, and techniques; (c) scale well across software projects even if
5
they operate on rare architectures or assume different trust boundaries. However, agentic AI has not only great potential for mere discovery, but also for related mechanisms, such as verifying and assessing the severity of vulnerabilities, prioritizing repair, and patch management.
Exploit Generation Finding out whether a software defect is exploitable is inherently difficult. In contrast to pattern-based vulnerability discovery that locates candidates of exploitable flaws, fuzz testing (fuzzing) already produces inputs that crash a program at runtime and thus reach the software defect via usercontrolled input. However, a significant gap remains between discovering a vulnerability or crash and producing a working exploit [3]. In particular, scaling automatic exploit generation to real-world settings requires reasoning about the targeted software as part of a larger system, interacting with a larger environment. Each of these abstraction levels imposes individual constraints on the exploit, including those via deployed defensive mechanisms. This complexity makes exploit development notoriously difficult, labor-intensive and, for a long time, a manual effort. Agentic AI can bring highly-specialized domain knowledge, reason about far-reaching dependencies among components, and scale nearly without bound. Moreover, the asymmetry between exploit generation and verification is advantageous: while constructing an exploit is inherently difficult, validating whether a candidate exploit succeeds is typically inexpensive and unambiguous. This asymmetry enables agents to iterate against an oracle, a property that is not always available in other security tasks.
Translation to Memory-Safe Languages A large fraction of security-critical infrastructure is written in C and C++, and memory-safety violations in this code continue to account for a substantial share of disclosed vulnerabilities. This has motivated broad calls to migrate to memorysafe languages such as Rust [12], including dedicated efforts such as DARPA’s Translating All C to Rust (TRACTOR) program, which explicitly targets automated, idiomatic Cto-Rust translation. Three factors keep such migration out of reach at realistic scale. First, manual rewriting demands substantial human effort: codebases of interest run to hundreds of thousands or millions of lines, and the work cannot be parallelized without expert review of each piece. Second, producing safe and idiomatic translations requires expertise in both the source and target languages, a combination concentrated in a small community. Third, each codebase carries its own idioms, build systems, and invariants, so a translation strategy that works on one project rarely transfers to another, and existing automatic translators fall back on unsafe Rust constructs that preserve the very safety issues the migration was meant to eliminate. AI agents that can read C source, reason about aliasing and ownership, and produce idiomatic Rust under expert supervision could make memory-safety migration tractable for the codebases that need it most.
Domain-Specific Code Optimization General-purpose security mechanisms are designed to cover a wide range of use cases, but in any specific deployment, only a small subset of their functionality is actually used. Studies of widely deployed systems show this margin to be substantial: across more than two thousand programs on a typical Linux desktop, only about five percent of the standard C library is used on average, the rest contributing nothing to the application, but expanding its attack surface [29]. Examples of optimization for a specific deployment include software and protocol debloating, stripping unused TLS cipher suites or extensions, and reducing kernel or library functionality to what a given application requires. However, two factors keep such optimization out of reach in most settings. First, the work requires expertise that is concentrated in a small community, since deciding which features can be safely removed depends on detailed knowledge of both the codebase and the threat landscape it serves. Second, every deployment uses a different subset of functionality and faces a different threat profile, so a debloating result for one application or environment does not transfer to another. AI agents that can analyze a codebase, infer which functionality each deployment actually uses, and produce a stripped-down build could make per-deployment optimization a standard step in deployment rather than a specialist undertaking this challenging task. Code IP Protection Software encodes knowledge for solving a particular problem and thus represents a vendor’s intellectual property (IP). Consequently, there is a long-standing history of obfuscation/protection schemes for software. To a large extent, these techniques originate from the virus scene and aim to prevent third parties from analyzing or identifying the presence of a malicious payload. As early as the 1990s, polymorphic obfuscation came to light [40], improving over simple encoding and encryption schemes by mutating the decoder/decrypter for every instance. Instead of selecting from a predefined set of options, the true goal is metamorphism: transforming code while preserving semantics. Emulator-based obfuscation [36] that uses randomized instruction-to-bytecode mapping is as close to metamorphism as it has got so far. Truly morphing program code, however, is inherently difficult as it requires extensive reasoning across the codebase and program semantics. Agentic AI “transpiling” code from one (logic) representation to another, and thus code metamorphism, seems within reach both conceptually and in terms of scalability. Similarly, an AI agent can reason about program semantics, statistical or structural properties, and the threat model simultaneously, enabling more comprehensive protection schemes beyond individual (parts of) programs. CYBER THREAT INTELLIGENCE Attribution and Threat Intelligence When a security incident occurs, defenders need to understand not just what happened but who is behind it, what their broader campaign looks like, and what they are likely to do
6
next. Attribution and threat intelligence aims to answer these questions by combining technical evidence (malware similarity, infrastructure overlap, code reuse) with non-technical sources such as open-source intelligence, leaked documents, language and cultural artifacts, and geopolitical context. However, this is widely regarded as a challenging task for various reasons [31]. First, producing a single well-supported attribution or intelligence report takes weeks of focused analyst work, since evidence must be gathered from many sources and carefully cross-checked. Second, the expertise required is rare and unusual, since the same analyst often needs technical depth in malware and network forensics together with knowledge of relevant languages, regions, and adversary practices. Third, every campaign is its own case: each adversary has its own infrastructure patterns, tooling habits, and operational preferences, and methods that worked on one campaign rarely transfer cleanly to the next. Fourth, attribution itself is a hard reasoning problem, since defenders must weigh evidence under active deception, where adversaries plant false flags and reuse other groups’ tools to mislead investigators. AI agents that can collect and correlate evidence across technical and open-source data, propose candidate attributions with their supporting reasoning, and flag where evidence is weak or contradictory could allow attribution and threat intelligence to be produced for many more incidents at a fraction of the cost. Provenance Analysis for Forensics When a security incident occurs, investigators must reconstruct the sequence of events: identifying the initial process, determining which files were accessed, tracing any data exfiltration, and assessing the overall scope of the compromise. Provenance analysis supports this task by recording causal relationships between system entities—such as processes, files, sockets, and users—in a graph structure. This graph can be traversed backward from a detection point to uncover the root cause, or forward to identify downstream effects [22] [17]. This capability was a central objective of the DARPA Transparent Computing (TC) program [11], which aimed to deliver fine-grained visibility into system interactions across all layers of software while maintaining low performance overhead. The TC program also sought to support both real-time detection and post hoc forensic analysis of advanced persistent threats (APTs). Although substantial progress has been made through DARPA TC and subsequent work [37, 24, 34, 33], challenges remain in scaling these approaches, generalizing them across environments, and enabling widespread adoption. AI agents can help address these gaps by automating key aspects of provenance analysis: interpreting complex provenance graphs, identifying likely attack paths, and explaining the supporting evidence. This added automation has the potential to make forensic provenance analysis a routine part of incident response, rather than a specialized process reserved for highpriority cases. Moreover, provenance analysis extends beyond individual systems to encompass entire supply chains. In manufacturing, for example, provenance includes information about a part’s components, origin, design, manufacturer, associated software, production data, and quality control records
encompassed in cyber-physical passports [14]. In such settings, AI agents can further enhance automation by enabling coordinated forensic analysis across multiple nodes in the supply chain. ATTACK DETECTION Insider Threat Detection Some of the most damaging security incidents come from people who already have legitimate access to a system: malicious insiders who misuse their privileges to steal data or sabotage systems, and external attackers who compromise legitimate accounts. Detecting either case is challenging precisely because the activity intentionally looks like normal behavior. A long line of work on insider threat detection has approached this through behavioral analysis, building a model of how each user typically operates and flags deviations [35]. However, four factors make this approach challenging to operationalize at scale. First, building and maintaining accurate behavioral models requires substantial manual effort, since each user’s normal behavior shifts over time and must be tuned by analysts who understand the organization. Second, when a real insider attack is in progress, the response must be fast: every additional minute the attacker has access translates into more data exfiltrated or more systems compromised; human review of every flagged event is simply too slow. Third, every organization has its own roles, workflows, and acceptable behaviors, so a detection model trained on one company’s users rarely transfers directly to another. Fourth, separating malicious activity from legitimate but unusual behavior requires reasoning over the user’s role, the current task, the data being touched, and the wider organizational context, which is why both rule-based systems and learned models continue to produce far more false positives than analysts can review. AI agents that can read user activity, build per-user and per-role models of normal behavior, and explain why a given event is suspicious could allow insider threat detection to operate routinely at the scale of entire organizations. Provenance Analysis & RT Monitoring Beyond after-the-fact forensics, provenance data can be leveraged for continuous attack detection by monitoring how processes, files, and systems interact in real time. This perspective naturally extends beyond individual systems to encompass entire supply chains, where events occurring across multiple organizations, suppliers, and production stages form a distributed provenance graph. However, deploying such monitoring at enterprise or supply chain scale remains a significant challenge. Even organizations of modest size generate tens of thousands of alerts each week, far more than analysts can realistically investigate, while the underlying event stream can reach hundreds of millions of records per day [15]. When expanded across interconnected supply chain nodes, this volume and complexity grow even further. Three factors keep real-time provenance monitoring difficult to operate at this scale. First, finding the relevant subgraph in a continuous high-volume stream takes substantial manual effort, and analysts who can do it well are rare, so most alerts
7
go uninvestigated. Second, the value of an alert drops quickly: a real attack that is flagged hours after it begins is much harder to contain than one caught while it is still in its early stages, and human review of a queue with thousands of alerts cannot keep up. Third, deciding whether a sequence of events is benign or malicious requires reasoning at once over normal system behavior, the structure of the graph, and the specific patterns that distinguish real attacks from background noise. AI agents that can read live provenance streams, identify the small fraction of subgraphs that need attention, and explain their reasoning could allow real-time provenance monitoring to keep pace with the data that defenders already collect but cannot yet act on. Adaptive Honeypots Honeypots are electronic bait that lure attackers into interacting with it, allowing to assess and analyze their tactics, techniques, and procedures (TTPs) [41]. There are two prevalent strategies: (a) passive honeypots and (b) active honeypots. The former is deployed (e.g., in a network’s unmapped IP range) with the sole purpose of passively monitoring any incoming interaction and increasing/maintaining engagement. The latter actively set out interact with a system (e.g., a potentially harmful web page) imitating a “victim.” For both, agentic AI can be beneficial, allowing for the creation of significantly more complex bait. In the passive setting, AI agents can act as a collective of honeypots imitating a complex network structure, where interaction can happen in accordance to an adversary’s expectation. Additionally, agentic AI can realistically populate observable communication (e.g., network traffic). In contrast to “traditional” setups, honeypots based on AI agents can adapt to adversaries on an individual basis, giving rise to effective analysis of even lateral movement in sophisticated and highly specific attacks. For active honeypots, in turn, the ability to adapt to the potential attacker is equally essential to extract as much information as possible. For instance, multiple agents can effectively probe and bypass environment fingerprinting (as used for web-based exploit kits)—even for environments and attack prerequisites not known upfront. LIMITATIONS & OPEN QUESTIONS As discussed in the previous section, AI agents have the potential to revive previously impractical or abandoned security strategies, enabling solutions to problems that were once considered intractable. However, agents are not a panacea and introduce their own set of challenges. For example, their inherently stochastic nature necessitates verification [28] and inspection [16] to ensure reliability and correctness of outputs. An additional challenge lies in evaluation. Benchmarking agent performance is difficult: once a metric becomes a target for optimization, the benchmark may defeat its purpose [13]. Recent work has therefore proposed, for example, a comparative approach between models across benchmarks [44]. However, a fundamental question remains: how to evaluate agents’ performance when they surpass human capabilities? These difficulties are compounded when considering the security of the AI agents themselves [38]. More precisely, agents
inherit the vulnerabilities of the underlying AI systems [5], while simultaneously amplifying risk through autonomy and privileged access, if misconfigured [7]. Securing such AI systems is inherently difficult and these vulnerabilities affect AI agents’ transparency [39]. Given the interplay between AIspecific vulnerabilities [38, 5] and system-level security concerns [7], adopting agentic AI approaches requires caution— especially for security-critical settings. Agents risk amplifying existing weaknesses or obscuring system behavior. A principled approach that explicitly accounts for these challenges is therefore essential. CONCLUSION Agentic AI will lead to significant changes in all areas of technology. In cybersecurity specifically, an exciting prospect is how agentic AI can be used to overcome challenges that have previously prevented various security techniques from reaching their full potential if open questions and limitations are overcome. The case studies discussed above have been chosen to illustrate this potential, but this list is by no means exhaustive. We therefore encourage the community to reexamine past assumptions and revisit past security techniques with the assistance of agentic AI. ACKNOWLEDGMENTS We thank Christian Schroeder de Witt for contributing to the initial discussions during Dagstuhl Perspectives Workshop 26162: “Autonomous AI Agents in Computer Security,” that lead to this work. This material is supported in part by the U.S. Department of Energy’s Office of Energy Efficiency and Renewable Energy (EERE) under the Advanced Materials and Manufacturing Technologies Office, Award Number DE-EE0009046, the DARPA under agreement number 885000, the NSF CCFFMiTF-1836978, and ONR N00014-21-1-2492. The views expressed herein do not necessarily represent the views of the U.S. Department of Energy or the United States Government. Moreover, we gratefully acknowledge support by the Austrian Federal Ministry of Economy, Energy and Tourism, the National Foundation for Research, Technology and Development and the Christian Doppler Research Association, the SBA Research (SBA-K1 NGC), a COMET Center funded by BMIMI, BMWET, the federal state of Vienna, managed by FFG, and the Helmholtz Association (HGF) within topic ”46.23 Engineering Secure Systems.” REFERENCES [1] Deepak Bhaskar Acharya, Karthigeyan Kuppan, and B Divya. Agentic ai: Autonomous intelligence for complex goals—a comprehensive survey. IEEe Access, 13:18912–18936, 2025. [2] Mohannad Alhanahnah, Shiqing Ma, Ashish Gehani, Gabriela F. Ciocarlie, Vinod Yegneswaran, Somesh Jha, and Xiangyu Zhang. autompi: Automated multiple perspective attack investigation with semantics aware execution partitioning. IEEE Transactions on Software Engineering, 49(4):2761–2775, 2023.
8
[3] Thanassis Avgerinos, Sang Kil Cha, Brent Lim Tze Hao, and David Brumley. AEG: automatic exploit generation. In Proceedings of the Network and Distributed System Security Symposium, NDSS 2011, San Diego, California, USA, 6th February - 9th February 2011. The Internet Society, 2011. [4] Guru Baran. Hackers Exploited 73 0-Day Vulnerabilities and Earned $1,024,750. https://cybersecuritynews.com/ 73-unique-0-day-vulnerabilities-pwn2own/. [5] Battista Biggio and Fabio Roli. Wild patterns: Ten years after the rise of adversarial machine learning. In Proceedings of the 2018 ACM SIGSAC conference on computer and communications security, pages 2154– 2156, 2018. [6] Nicholas Carlini, Newton Cheng, Keane Lucas, Michael Moore, Milad Nasr, Vinay Prabhushankar, Winnie Xiao, Hakeem Angulu, Jackie Bow Evyatar Ben Asher, Keir Bradwell, Ben Buchanan, David Forsythe, Daniel Freeman, Alex Gaynor, Xinyang Ge, Logan Graham, Kyla Guru, Hasnain Lakhani, Matt McNiece, Mojtaba Mehrara, Renee Nichol, Adnan Pirzada, Sophia Porter, Andreas Terzis, and Kevin Troy. Assessing claude mythos preview’s cybersecurity capabilities. https://red. anthropic.com/2026/mythos-preview/. [7] Mihai Christodorescu, Earlence Fernandes, Ashish Hooda, Somesh Jha, Johann Rehberger, Kamalika Chaudhuri, Xiaohan Fu, Khawaja Shams, Guy Amir, Jihye Choi, Sarthak Choudhary, Nils Palumbo, Andrey Labunets, and Nishit V. Pandya. Agent security is a systems problem. arXiv preprint arxiv.org:2605.18991, 2026. [8] Abraham Clements, Abel Gomez Rivera, Richard Jiayang Liu, Kirill Levchenko, Rick Kennell, and Gabriela Ciocarlie. Rt-fuzzer: Task driven fuzzing of real time operating system firmware. In NDSS Workshop on Binary Analysis Research (BAR), 2026. [9] E. Cobos and Selcen Cakir. A review of the economic costs of cyber incidents. Report, World Bank Group, 2024. [10] Cas Cremers, Marko Horvat, Jonathan Hoyland, Sam Scott, and Thyla Van Der Merwe. A comprehensive symbolic analysis of tls 1.3. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pages 1773–1788, 2017. [11] DARPA. Transparent Computing. https://www.darpa.mil/ research/programs/transparent-computing. [12] Mehmet Emre, Ryan Schroeder, Kyle Dewey, and Ben Hardekopf. Translating c to safer rust. Proc. ACM Program. Lang., 5(OOPSLA), October 2021. [13] Charles AE Goodhart. Problems of monetary management: the uk experience. In Monetary theory and practice: The UK experience, pages 91–121. Springer, 1984. [14] Howard D. Grimes, Gabriela F. Ciocarlie, Robert J. Butler, and Wayne E. Austad. Microelectronics Offer Case Study for Securing Defense-Critical Supply Chains. https://www.afcea.org/signal-media/cyber-edge/ microelectronics-offer-case-study-securing-defense-
critical-supply-chains. [15] Wajih Ul Hassan, Shengjian Guo, Ding Li, Zhengzhang Chen, Kangkook Jee, Zhichun Li, and Adam Bates. NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage. In Proceedings 2019 Network and Distributed System Security Symposium, San Diego, CA, 2019. Internet Society. [16] Afzal Hussain and Ashfaq Hussain. Transparency and accountability: unpacking the real problems of explainable ai. AI & SOCIETY, 40(7):5587–5588, 2025. [17] Hassaan Irshad, Gabriela F. Ciocarlie, Ashish Gehani, Vinod Yegneswaran, Kyu Hyung Lee, Jignesh M. Patel, Somesh Jha, Yonghwi Kwon, Dongyan Xu, and Xiangyu Zhang. TRACE: enterprise-wide provenance tracking for real-time APT detection. IEEE Trans. Inf. Forensics Secur., 16:4363–4376, 2021. [18] Trent Jaeger, Reiner Sailer, and Xiaolan Zhang. Analyzing integrity protection in the selinux example policy. In Usenix Security, 2003. [19] Sushil Jajodia, Anup K. Ghosh, Vipin Swarup, Cliff Wang, and X. Sean Wang, editors. Moving Target Defense: Creating Asymmetric Uncertainty for Cyber Threats, volume 54 of Advances in Information Security. Springer New York, New York, NY, 2011. [20] Juyong Jiang, Fan Wang, Jiasi Shen, Sungju Kim, and Sunghun Kim. A survey on large language models for code generation. ACM Transactions on Software Engineering and Methodology, 35(2):1–72, 2026. [21] J.O. Kephart and D.M. Chess. The vision of autonomic computing. Computer, 36(1):41–50, 2003. [22] Samuel T. King and Peter M. Chen. Backtracking intrusions. In Proceedings of the Nineteenth ACM Symposium on Operating Systems Principles, SOSP ’03, page 223–236, New York, NY, USA, 2003. Association for Computing Machinery. [23] Gerwin Klein, Kevin Elphinstone, Gernot Heiser, June Andronick, David Cock, Philip Derrin, Dhammika Elkaduwe, Kai Engelhardt, Rafal Kolanski, Michael Norrish, et al. sel4: Formal verification of an os kernel. In Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles, pages 207–220, 2009. [24] Yushan Liu, Xiaokui Shu, Yixin Sun, Jiyong Jang, and Prateek Mittal. Rapid: Real-time alert investigation with context-aware prioritization for efficient threat discovery. In Proceedings of the 38th Annual Computer Security Applications Conference, ACSAC ’22, page 827–840, New York, NY, USA, 2022. Association for Computing Machinery. [25] Michael E. Locasto, Angelos Stavrou, Gabriela F. Cretu, and Angelos D. Keromytis. From stem to sead: speculative execution for automated defense. In 2007 USENIX Annual Technical Conference on Proceedings of the USENIX Annual Technical Conference, ATC’07, USA, 2007. USENIX Association. [26] Peter Loscocco and Stephen Smalley. Integrating flexible support for security policies into the linux operating system. In 2001 USENIX Annual Technical Conference (USENIX ATC 01), Boston, MA, June 2001. USENIX
9
Association. [27] Shiqing Ma, Juan Zhai, Fei Wang, Kyu Hyung Lee, Xiangyu Zhang, and Dongyan Xu. MPI: Multiple perspective attack investigation with semantic aware execution partitioning. In 26th USENIX Security Symposium (USENIX Security 17), pages 1111–1128, Vancouver, BC, August 2017. USENIX Association. [28] Mark Huasong Meng, Guangdong Bai, Sin Gee Teo, Zhe Hou, Yan Xiao, Yun Lin, and Jin Song Dong. Adversarial robustness of deep neural networks: A survey from a formal verification perspective. IEEE Transactions on Dependable and Secure Computing, 2022. [29] Anh Quach, Aravind Prakash, and Lok Yan. Debloating software through Piece-Wise compilation and loading. In 27th USENIX Security Symposium (USENIX Security 18), pages 869–886, Baltimore, MD, August 2018. USENIX Association. [30] Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAI blog, 2019. [31] Thomas Rid and Ben Buchanan. Attributing cyber attacks. Journal of Strategic Studies, 38(1-2):4–37, 2015. [32] A. Sabelfeld and A.C. Myers. Language-based information-flow security. IEEE Journal on Selected Areas in Communications, 21(1):5–19, 2003. [33] Dinuka Sahabandu, Joey Allen, Shana Moothedath, Linda Bushnell, Wenke Lee, and Radha Poovendran. Quickest detection of advanced persistent threats: A semi-markov game approach. In 2020 ACM/IEEE 11th International Conference on Cyber-Physical Systems (ICCPS), pages 9–19, 2020. [34] Dinuka Sahabandu, Baicen Xiao, Andrew Clark, Sangho Lee, Wenke Lee, and Radha Poovendran. Dift games: Dynamic information flow tracking games for advanced persistent threats. In 2018 IEEE Conference on Decision and Control (CDC), pages 1136–1143, 2018. [35] Malek Ben Salem, Shlomo Hershkop, and Salvatore J. Stolfo. A Survey of Insider Attack Detection Research, pages 69–90. Springer US, Boston, MA, 2008. [36] Monirul Sharif, Andrea Lanzi, Jonathon Giffin, and Wenke Lee. Automatic reverse engineering of malware emulators. In 2009 30th IEEE Symposium on Security and Privacy, pages 94–109, 2009. [37] Xiaokui Shu, Danfeng (Daphne) Yao, Naren Ramakrishnan, and Trent Jaeger. Long-span program behavior modeling and attack detection. ACM Trans. Priv. Secur., 20(4), September 2017. [38] Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. Advances in neural information processing systems, 33:1633–1645, 2020. [39] Jon Vadillo, Roberto Santana, and Jose A Lozano. Adversarial attacks in explainable machine learning: A survey of threats against models and humans. Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery, 15(1):e1567, 2025. [40] John von Neumann. Advanced code evolution techniques and computer virus generator kits.
[41] David Watson and Jamie Riden. The honeynet project: Data collection tools, infrastructure, archives and analysis. In 2008 WOMBAT Workshop on Information Security Threats Data Collection and Sharing, pages 24–30, 2008. [42] Laurie Williams, Giacomo Benedetti, Sivana Hamer, Ranindya Paramitha, Imranur Rahman, Mahzabin Tamanna, Greg Tystahl, Nusrat Zahan, Patrick Morrison, Yasemin Acar, et al. Research directions in software supply chain security. ACM Transactions on Software Engineering and Methodology, 34(5):1–38, 2025. [43] Peterson Yuhala, Pascal Felber, Hugo Guiroux, JeanPierre Lozi, Alain Tchana, Valerio Schiavoni, and Gaël Thomas. Secv: Secure code partitioning via multilanguage secure values. In Proceedings of the 24th International Middleware Conference, Middleware ’23, page 207–219, New York, NY, USA, 2023. Association for Computing Machinery. [44] Guanhua Zhang, Florian E. Dorner, and Moritz Hardt. How benchmark prediction from fewer data misses the mark. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. [45] Shuyan Zhou, Frank F Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, et al. Webarena: A realistic web environment for building autonomous agents. In International Conference on Learning Representations, volume 2024, pages 15585–15606, 2024.