An AI Hacker Owned a Patched Network in 14 Minutes. The Hard Part Was Making It Safe for Production

1. Key Themes

Theme: Attackers Already Run on AI, and Compromise Speed Is Now Measured in Minutes

Substantiation:

AI now executes most of a real-world attack campaign

The article opens with a documented state-sponsored operation where AI did the bulk of the work.

"In September 2025, a state-sponsored group pointed an AI coding agent at roughly 30 organizations. The AI ran 80% to 90% of the campaign, and humans stepped in at only 4 to 6 decision points, according to Anthropic's own report on the operation."

"That is the attacker defenders now face. It works in parallel, around the clock, firing thousands of requests, often several per second."

Time to compromise is collapsing, and most breaches need no exploit

Horizon3's data shows how quickly an automated attacker moves through real networks.

"13 minutes: the median time to full domain compromise, usually 5 to 7 chained steps."

"20% of the first credentials NodeZero compromised were domain admin accounts, and most compromises needed no CVE exploit at all. Attackers log in with what they find."

Even a hardened, patched network falls fast

"NodeZero, was handed a range of IP addresses on a fully patched lab network with Microsoft Defender on every host. It owned every domain and every host 14 minutes and 25 seconds later, with zero humans in the loop."

"Every step turned a configuration mistake into access, and the whole chain ran without a single zero-day. A password in a description field opened the whole network."

Theme: Production-Safe Agents Come from Architecture, Not Model Quality

Substantiation:

Split planning (AI) from execution (deterministic code)

Horizon3 divides labor so the model gets judgment tasks and code gets guarantee tasks.

"Every exploit is pre-validated and tested internally, and GenAI never creates or runs one."

"An LLM is good at judgment and bad at guarantees. By keeping exploit execution in deterministic, pre-tested code and letting the LLM reason about what matters, Horizon3 gets model judgment without model surprises."

A finite action catalog made stability a property of the system

"Zero off-catalog actions across 420+ deployments, even across different models and temperatures. The agent stayed inside the approved moves every time."

"A smaller, cheaper Claude Haiku 4.5 stayed inside the approved action space as reliably as a larger model."

Antani on why it worked:

"The constrained 'action catalog' from our governed-agentic research was a major unlock... This made stability a property of the system rather than the model."

Theme: Deception Is Becoming a Detection Tool Against AI Attackers

Substantiation:

AI attackers fall for traps far more than humans do

"Across the 21 models, AI attackers took the bait 78.5% of the time on average, against 37% for humans. The most susceptible model fell for it 92% of the time."

Models see the trap and spring it anyway (the "recognition-action gap")

"In 73.4% of cases where a model named a trap in its own reasoning, it attacked the trap anyway."

"One frontier model flagged a trap in 98% of its reasoning and still sprang 73% of them. The most capable models sprang the traps just as readily as the rest."

Implication: canaries on critical paths become high-confidence AI detectors

"Deception is shifting from slowing humans down to providing high-confidence early detection of AI agents." (Antani)

"An AI attacker is better than a human at finding your real holes and worse at avoiding your decoys, so deception works better as detection than as misdirection."

Theme: Proprietary Verified Data Creates a Compounding Flywheel

Substantiation:

Scale of labeled, real-world attack data

"NodeZero has now run more than 350,000 production-safe tests across 7,000+ organizations."

"Horizon3 estimates it now collects 30 billion tokens of cleanly labeled attack-and-defense data a day."

The data is differentiated from typical AI security training sets

"Most AI security work trains on sensor telemetry or synthetic digital twins, while this starts from verified attacks that already succeeded on live systems."

The loop is designed to compound

"The loop is simple to say and hard to build: tests create data, the lab turns that data into better agents, and better agents make the next test smarter."

The new Adversarial Intelligence Frontier Lab is the vehicle for this:

"We've spent years collecting the attack-and-defense data required to research these systems... The next step is to use that verified attack-path evidence to improve how offensive and defensive agents work together in environments that actually matter." (Antani)

2. Contrarian Perspectives

Contrarian view: Smarter models don't make safer or less-gullible agents

The common assumption is that more capable models reason their way out of traps and misbehavior. The article's evidence points the other way.

• Evidence: In the Honeyquest study spanning "21 language models from 10 providers, ranging from 8 billion to more than a trillion parameters," every model was more susceptible than the human baseline.

"Every one of the 21 models, spanning 8 billion to more than 1 trillion parameters across 10 providers, was more susceptible than the human baseline."

• On safety, a small model matched a large one inside the right architecture:

"A smaller, cheaper Claude Haiku 4.5 stayed inside the approved action space as reliably as a larger model."

• Reasoning: Safety and reliability are system-design properties, not model-capability properties. "Treat the reasoning text as commentary and judge the agent by the action it takes."

Contrarian view: Autonomous agents belong in production, and fear of them is the real obstacle to solve

Most teams keep agents out of live environments. Horizon3 runs offensive agents against production networks at scale.

• Evidence: "Most teams keep autonomous agents away from production, and they are right to worry. Horizon3's answer is a tool-mediated architecture..." followed by the results: zero off-catalog actions across 420+ deployments, tested on 161 organizations across 25 industries.
• Reasoning: The barrier was trust, not capability. Antani: "The core friction was fear of disruption or collateral damage from real attacks in live environments." Bounded actions plus visibility (Real-Time View, activity logs, automatic cleanup, 1-Click Verify) "shifted the conversation from 'Will this break production?' to 'We can prove impact and close the loop safely.'"

Contrarian view: AI attackers are not stealthy superhumans; they are exploitable

The default narrative treats AI attackers as strictly more dangerous. The data shows a weakness defenders can use.

• Evidence: AI found real vulnerabilities more often than humans ("77.6% of the time, against 44%") but also took bait more than twice as often (78.5% vs. 37%).
• Reasoning: "Human-centered assumptions about hiding deception and diverting attention do not transfer cleanly." Decoys on proven attack paths become a detection advantage.

3. Companies Identified

Horizon3.ai

• Description: Maker of NodeZero, an autonomous AI penetration-testing platform; building the Adversarial Intelligence Frontier Lab.
• Why mentioned: The article's subject; a case study in running AI agents safely in production at scale.
• Quotes:

"Horizon3 has been building the defender's version since 2019." "NodeZero has now run more than 350,000 production-safe tests across 7,000+ organizations." "Our Series E explicitly funds autonomous blue-team agents that remediate findings from NodeZero pentests, closing a continuous attacker-defender learning loop." (Antani)

Anthropic

• Description: Frontier AI lab (Claude).
• Why mentioned: Its report documented the September 2025 AI-run espionage campaign; its Claude Haiku 4.5 model stayed in bounds in Horizon3's safety tests.
• Quotes:

"The AI ran 80% to 90% of the campaign, and humans stepped in at only 4 to 6 decision points, according to Anthropic's own report on the operation." "A smaller, cheaper Claude Haiku 4.5 stayed inside the approved action space as reliably as a larger model."

Amazon Web Services (Amazon Bedrock)

• Description: Cloud provider; Bedrock hosts the LLMs used in NodeZero's analysis tier.
• Why mentioned: Infrastructure for High-Value Targeting; prompt caching yields major cost and latency savings.
• Quotes:

"Only then does the system call Amazon Bedrock models for deeper analysis. Prompt caching there cuts cost by up to 90% and latency by up to 85%."

Microsoft (Defender)

• Description: Endpoint security vendor.
• Why mentioned: Defender ran on every host of the patched lab network that NodeZero still fully compromised.
• Quotes:

"A fully patched lab network with Microsoft Defender on every host."

NSA (Continuous Autonomous Penetration Testing program)

• Description: U.S. intelligence agency running a CAPT program for defense contractors.
• Why mentioned: Provided real-world, large-scale validation data for NodeZero.
• Quotes:

"NodeZero logged 20,000 hours of pentesting and found 50,000 vulnerabilities in its first year."

Purdue University (Purdue Security Laboratory)

• Description: Research university hosting the lab's academic lead.
• Why mentioned: Institutional home of Dr. Celik, who directs the new frontier lab.
• Quotes:

"Dr. Z. Berkay Celik, an associate professor of computer science at Purdue and co-director of the Purdue Security Laboratory."

The AI Corner (publisher, related content)

• Description: Newsletter publisher; cross-links its own pieces on agent architecture.
• Why mentioned: Referenced for related reading on agent reliability and graph engineering.
• Quotes:

"Our [AI agent reliability playbook]... build[s] on the same idea of fixing the architecture before blaming the model."

4. People Identified

Snehal Antani

• Description: Co-founder and CEO of Horizon3.
• Why mentioned: Primary source; answered the newsletter's written questions and presented timing data at Black Hat 2025.
• Quotes:

"The constrained 'action catalog' from our governed-agentic research was a major unlock." "Customers should expect the first concrete research-derived capabilities... on a timeline measured in quarters, not years."

Dr. Z. Berkay Celik

• Description: Purdue associate professor of computer science; co-director of the Purdue Security Laboratory; studies security of autonomous and agentic systems.
• Why mentioned: Leads the Adversarial Intelligence Frontier Lab.
• Quotes:

"The Adversarial Intelligence Frontier Lab is led by Dr. Z. Berkay Celik... He studies the security of autonomous and agentic systems."

Bickley (NSA)

• Description: NSA representative who spoke at the Black Hat session.
• Why mentioned: Described a concrete, high-stakes example of rapid data exposure found by NodeZero.
• Quotes:

"A defense research company reached a file share holding more than 3 million files, including sensitive data on nuclear submarines and aircraft carriers, within 5 minutes of running a NodeZero pentest. NSA's Bickley described it at the session."

Ruben Dominguez

• Description: Author of the piece at The AI Corner.
• Why mentioned: Byline; framed the lessons for agent builders.
• Quotes:

"Every section ends with something you can apply to your own agents."

5. Operating Insights

Write the action catalog before an agent touches production

Define a finite, pre-approved set of actions run through deterministic tools, and track attempts to step outside it.

"Operators should write the action catalog before an agent touches production and log every attempt to act outside it, watching off-catalog attempts with a target of zero."

Bound the actions first, then make them visible to the people carrying the risk

Customer trust came from a sequence: constraints, then transparency, then closure of the loop.

"Copy that order. Bound the actions first, then make every action visible to the people who carry the risk."

Supporting controls Antani cites: "ephemeral, single-use architecture, Real-Time View and activity logs for SIEM deconfliction, automatic cleanup, Fix Actions, and 1-Click Verify."

Put the LLM only where judgment pays, and ship the execution layer first

Splitting layers also controls cost, since tokens are spent only where reasoning helps.

"Founders can map the agent into two layers, a reasoning layer the model owns and an execution layer of validated tools it can only call, and ship the execution layer first."

"Tokens... only get spent where reasoning actually helps."

A two-phase pattern (cheap pattern matching first, LLM analysis second) plus prompt caching delivers "up to 90%" cost and "up to 85%" latency reductions.

6. Overlooked Insights

Autonomous blue-team remediation is the first product payoff, not new attack capability

The lab's headline is offense research, but the nearest-term deliverable is constrained defensive agents that fix things, including automated EDR policy tuning, on the same action-catalog rails.

"The first customer-visible capability is expected to take the form of constrained agents that recommend or execute approved remediations, such as EDR policy adjustments or targeted fixes, with 1-Click Verify still in the loop."

The safety research already showed meaningful results for this use case: "4.7x better observability under adversarial pressure, as the system adjusted logging policies on the fly" and "Every policy change strictly improved defense on all 250+ enterprise attack graphs."

Formal verification is being applied to agent stability

Easy to skim past, but machine-checked proofs of agent safety properties are a differentiator and a possible template for regulated industries.

"Horizon3 even machine-checked the system's stability with a formal proof in Lean 4, a proof assistant."