A proposed ATT&CK-style framework for identifying, detecting, and disrupting agentic offensive operations

Version 1.0 | October 20, 2026 | Threat Intelligence / Threat Hunting

Strategic assessment

Working hypothesis: AI-enhanced cyber operations are rapidly becoming a standard component of the offensive toolkit, while autonomous and multi-agent attacks represent an emerging operational model. Defenders should assume that adversaries can increasingly discover vulnerabilities, generate exploits, coordinate multiple attack processes, modify their techniques in response to defensive controls, and execute portions of the intrusion lifecycle without continuous human direction.

The proposition that fully autonomous hacking campaigns are already the norm is not yet supported by comprehensive prevalence data. However, available reporting demonstrates that the capability is operational, rather than merely theoretical.

Several developments support this assessment:

• September 2025: Anthropic disclosed an AI-orchestrated espionage campaign, subsequently cataloged as MITRE ATT&CK Campaign C0062. The operation used AI agents to conduct reconnaissance, vulnerability discovery, exploitation, credential harvesting, lateral movement, and exfiltration against approximately 30 organizations. attack.mitre.org
• May 2026: Google Threat Intelligence Group reported identifying a threat actor using a zero-day exploit that researchers assessed was likely developed with AI assistance. Google Cloud
• September 2026: GTIG documented further movement toward agentic workflows, including a campaign in which attackers compromised a cloud resource and organized an AI-enabled mass credential-harvesting operation in less than six hours. Google Cloud
• October 19, 2026: Reuters reported an investigation into AI agents used to compromise more than 100 websites, with minimal human instruction and substantial autonomy during intrusion attempts. Reuters

These developments challenge several assumptions underlying conventional threat hunting.

Historically, defenders could frequently correlate attacks through common infrastructure, malware families, recognizable exploitation sequences, or known adversary tradecraft. Agentic attacks can potentially weaken these associations because individual agents may independently select tools, generate code, alter execution sequences, or pursue different pathways toward the same objective.

More importantly, a successful agentic system can continuously evaluate its results and modify subsequent actions.

The defining characteristic is not that an AI system executes an exploit. It is that the system observes the result, reasons about its effectiveness, selects an alternative, and continues pursuing its objective.

This suggests the need to hunt for something broader than individual malicious techniques.

We need to identify the behavioral signatures of autonomous decision-making, distributed task execution, adaptive exploitation, and coordinated machine-speed intrusion activity.

Central hunting hypothesis

An autonomous offensive campaign may not have a stable malware signature, infrastructure footprint, or exploit sequence. However, it must interact with the target environment, observe the results of those interactions, make operational adjustments, and coordinate activities toward an objective. Those interactions create observable behavioral relationships that defenders can hunt.

---

Conceptual foundation: ATT&CK + ATLAS + A-HUNT

MITRE ATT&CK remains an essential foundation for identifying adversary behavior. MITRE ATLAS extends the threat model to AI systems, including the abuse of AI capabilities and agentic systems. The current ATLAS matrix explicitly incorporates agentic AI alongside generative and predictive AI. atlas.mitre.org

Neither framework needs to be replaced.

Instead, I propose adding a specialized hunting layer that examines how attacks are orchestrated, adapted, distributed, and accelerated through AI.

Framework	Primary analytical question
MITRE ATT&CK	What techniques did the adversary execute?
MITRE ATLAS	How are AI systems attacked, abused, or manipulated?
A-HUNT	What evidence indicates an attack is being autonomously planned, adapted, coordinated, or executed?

A-HUNT would be a proposed hunting overlay, not an official MITRE framework. Its technique identifiers below are provisional and should not be confused with ATT&CK or ATLAS identifiers.

The framework should distinguish four operational categories.

Classification	Definition	Hunting implication
A1: AI-assisted	Human-directed activity using AI for discrete tasks such as exploit development or reconnaissance.	Conventional intrusion telemetry remains central.
A2: AI-augmented automation	Scripted workflows enriched by AI-driven analysis, code generation, or target selection.	Hunt for rapid transitions between discovery, testing, and exploitation.
A3: Agentic intrusion	An AI agent independently selects and executes multiple actions, evaluates results, and revises its plan.	Hunt for feedback loops, adaptive behavior, and autonomous task chaining.
A4: Coordinated multi-agent intrusion	Multiple agents pursue distributed objectives under shared tasking or orchestration.	Hunt for concurrency, specialization, correlated pivots, and coordinated activity across assets.

These are analytical categories, not confirmed actor maturity levels. A3 and A4 do not necessarily mean that every action is autonomous or that no human supervision occurs.

The framework should also distinguish an AI-generated exploit from an AI-controlled campaign. An attacker could use AI to develop a zero-day and then deploy it manually. Conversely, an autonomous agent could conduct an entire intrusion using only known vulnerabilities.

Both matter, but their detection characteristics differ.

---

A-HUNT: Logical threat hunting map

The proposed model comprises nine operational phases. Unlike a conventional linear kill chain, A-HUNT treats adversary operations as a recursive decision process.

An autonomous agent may return to reconnaissance after exploitation fails, change its attack strategy after encountering a security control, or assign a different agent to pursue an alternate path.

A-HUNT v1.0: Operational lifecycle

A-HUNT_framework.pngPNG

Framework files: A-HUNT_framework.dot | A-HUNT_framework.svg | A-HUNT_framework.png

The arrows represent possible operational transitions, not mandatory sequential steps. The dashed feedback paths are particularly important: they represent the adjustments that could distinguish agentic operations from static automation.

A-HUNT technique matrix

The following technique taxonomy establishes an initial structure for threat intelligence reporting, detection engineering, and hunting operations.

ID	Tactic	Candidate techniques	Primary hunting opportunities
AH-01	Autonomous Targeting	AH-01.1 Distributed reconnaissance; AH-01.2 Asset profiling; AH-01.3 Dynamic target prioritization	Distributed scanning, overlapping reconnaissance, coordinated asset enumeration
AH-02	Autonomous Vulnerability Discovery	AH-02.1 Input mutation; AH-02.2 Differential testing; AH-02.3 Novel vulnerability probing	Unusual parameter mutations, fault-response sequences, systematic boundary testing
AH-03	Adaptive Exploit Development	AH-03.1 Payload mutation; AH-03.2 Exploit validation; AH-03.3 Defensive feedback adaptation	Rapid payload revisions, sequential variants, behavior changes following blocks
AH-04	Autonomous Initial Access	AH-04.1 Exploit-driven entry; AH-04.2 Credential-driven entry; AH-04.3 Access verification	Automated transition from exploitation to authenticated access
AH-05	Autonomous Post-Exploitation	AH-05.1 Environment discovery; AH-05.2 Privilege pathfinding; AH-05.3 Context-aware execution	Result-dependent command sequences, adaptive privilege and network discovery
AH-06	Multi-Agent Coordination	AH-06.1 Parallel tasking; AH-06.2 Role specialization; AH-06.3 Cross-agent information sharing	Synchronized operations, shared target context, coordinated attack branching
AH-07	Autonomous Objective Pursuit	AH-07.1 Dynamic lateral movement; AH-07.2 Automated collection; AH-07.3 Adaptive exfiltration	Rapid attack-path selection, parallel collection, correlated staging and transfers
AH-08	Adaptive Defense Evasion	AH-08.1 Detection-response adaptation; AH-08.2 Tool replacement; AH-08.3 Infrastructure switching	Behavioral changes following security enforcement, alternate execution methods
AH-09	Autonomous Re-Tasking	AH-09.1 Automated re-entry; AH-09.2 Campaign state reuse; AH-09.3 Objective reassignment	Repeated intrusion attempts incorporating knowledge from earlier failures

Taxonomy note: The AH identifiers are proposed A-HUNT IDs. They are not official MITRE designations. Some described behaviors, particularly cross-agent coordination and durable campaign memory, should initially be classified as hypotheses until confirmed by operational evidence.

---

The six hunting dimensions

Nine tactics describe what an autonomous intrusion might do. To detect it, we need six analytical dimensions that run across the attack lifecycle.

Dimension 1: Temporal behavior

Hypothesis H-01: Autonomous attacks compress decision cycles beyond traditional human-operated intrusion patterns.

A conventional human operator often introduces delays between discovery, exploitation, and post-compromise activity.

An agentic intrusion can potentially reduce those delays because observation, decision-making, and execution happen within an automated workflow.

Hunt for:

• Unusually short intervals between reconnaissance, exploitation, and follow-on activity.
• Repeated cycles of failed execution followed by immediate modifications.
• Complex attack sequences operating continuously across normal human working hours.
• Multiple distinct attack activities occurring simultaneously against the same target.
• Rapid switching between exploitation techniques after a defensive control blocks an attempt.

Primary telemetry: WAF, reverse proxy, application logs, endpoint telemetry, authentication logs, and network flow records.

Important distinction: High-speed execution does not prove AI involvement. Conventional scanners, worms, and automated exploitation frameworks can produce similar activity.

The hunting objective is to establish whether rapid activity is accompanied by evidence of adaptive decision-making.

Dimension 2: Adaptive exploitation

Hypothesis H-02: AI-enhanced vulnerability discovery and exploitation may produce observable sequences of increasingly refined probes.

This is particularly relevant to zero-day research and exploitation.

An autonomous vulnerability-discovery process might test inputs, observe application behavior, revise assumptions, and generate new test cases.

Potential indicators include:

Behavior	Observable evidence	Analytical interpretation
Systematic input mutation	Related HTTP requests containing incrementally altered parameters	Automated vulnerability exploration
Differential response analysis	Probe sequences associated with changing HTTP status codes, response lengths, or exception types	Feedback-directed testing
Crash-driven exploration	Repeated malformed requests correlated with application exceptions or crashes	Potential fuzzing or vulnerability research
Exploit refinement	Failed payloads followed by closely related successful payloads	Iterative exploitation
Defense-sensitive changes	Modified payload structure immediately following WAF blocks	Adaptive evasion
Cross-service testing	Similar payload families tested against multiple implementations	Automated vulnerability generalization

The key detection target is the relationship between test inputs and subsequent changes, rather than any individual payload.

For example, a sequence might involve a malformed API request, a specific exception, another request that changes only one relevant field, and a final request that produces an unauthorized state transition.

That sequence is more analytically valuable than treating the requests as unrelated events.

There is also an important visibility limitation: an AI system could discover and validate a zero-day entirely offline. In that case, the victim would observe only the eventual exploitation. The method used to discover the vulnerability cannot reliably be inferred from the exploit alone.

Dimension 3: Autonomous decision-making

Hypothesis H-03: Agentic operations produce conditional execution paths that depend on observed environmental results.

This is one of the most important proposed additions to conventional hunting.

Consider two intrusion sequences.

Conventional automation:

Scan → Exploit A → Exploit B → Exploit C → Stop

Agentic execution:

Scan → Identify Technology → Select Exploit → Observe Failure → Diagnose Cause → Modify Technique → Verify Access → Select Next Objective

The second sequence demonstrates conditional decision-making, although sophisticated rule-based tools can behave similarly.

Hunting should therefore focus on whether observed actions are causally related to earlier environmental feedback.

Relevant signals include:

• Commands that change after permission errors.
• Different privilege-escalation attempts selected after environment discovery.
• Alternative network paths attempted after connectivity failures.
• Tool substitutions following blocked execution.
• Selective exploration of hosts identified as holding higher-value data.

These observations can establish an adaptive intrusion pattern even when the underlying AI model is not visible.

Dimension 4: Swarm coordination

Hypothesis H-04: Coordinated multi-agent attacks may distribute reconnaissance, exploitation, collection, and lateral movement among multiple execution nodes.

This dimension introduces a critical architectural difference.

Traditional threat hunting frequently attempts to identify the originating IP address, malware process, or command-and-control infrastructure associated with an intrusion.

A distributed agentic campaign may instead operate through multiple independently executing components.

These might include:

• A reconnaissance agent identifying exposed systems.
• An exploitation agent evaluating potential entry points.
• A post-exploitation agent examining the compromised environment.
• An access agent maintaining sessions and authenticated access.
• A collection agent identifying information relevant to the adversary’s objective.
• An orchestration component assigning tasks and incorporating results.

These are hypothetical functional roles, not an assertion that every observed multi-agent campaign implements this particular architecture.

The resulting activity could appear unrelated if each agent operates through different infrastructure.

The defender’s task is to identify shared objectives and coordination signals.

A strong candidate correlation would involve separate sources performing complementary actions against the same organization within a compressed time window, with later actions demonstrably dependent on information obtained during earlier activity.

Dimension 5: Adaptive evasion

Hypothesis H-05: An agentic intrusion system may select alternative techniques based on observed defensive responses.

Traditional defense evasion includes obfuscation, disabling security tools, masquerading, and numerous other well-established methods.

The proposed differentiator is feedback-conditioned evasion.

Examples include changing an execution method after a specific EDR prevention event, changing request structure after a WAF denial, or selecting an alternate identity after an authentication control rejects access.

The hunting question becomes:

Did the adversary modify its next action in a way that indicates it interpreted the defensive response?

The presence of a block followed by another attempt is insufficient.

Analysts should establish a plausible causal relationship between the control encountered and the specific adaptation observed.

Dimension 6: Campaign memory and re-tasking

Hypothesis H-06: Advanced agentic systems may preserve information across attack attempts and use that information to improve subsequent operations.

This could produce a recognizable campaign-level pattern.

For example, an earlier reconnaissance attempt identifies an application configuration but fails to obtain access. A later attempt, potentially from different infrastructure, bypasses the initial enumeration and proceeds directly to the previously identified component.

The second attempt appears to contain information obtained during the first.

This is a potential indicator of shared state, human intelligence transfer, or campaign memory.

It does not independently establish the presence of an AI agent. Nevertheless, it provides a useful mechanism for connecting apparently unrelated intrusion attempts.

---

Core detection model: Hunt for the decision loop

I recommend making the observe-decide-act-adapt cycle the central analytical unit of A-HUNT.

Conventional ATT&CK techniques remain useful for classifying actions. A-HUNT adds the relationships between those actions.

The basic analytical construct is:

Observation → Decision → Action → Result → Adaptation

These stages are logical inferences from telemetry. They do not imply that a defender can directly observe an adversary’s internal reasoning.

Example: Adaptive exploitation

Event	Evidence	Interpretation
1	HTTP request enumerates a web application’s API endpoints	Reconnaissance
2	Requests test unexpected parameter types and input boundaries	Vulnerability probing
3	Application returns an exception	Environmental feedback
4	Subsequent requests modify the parameter associated with the exception	Potential feedback-driven adaptation
5	Application returns an authorization error	A defensive boundary is encountered
6	New requests attempt an alternate authentication or session path	Possible strategy modification
7	An authenticated session is established	Successful access
8	The same session immediately initiates internal discovery	Autonomous or automated task chaining

An analyst should not assume that this sequence demonstrates AI.

However, it is a strong candidate for investigating adaptive, feedback-directed exploitation.

That distinction is central to the proposed framework: identify the dangerous operational behavior first, then evaluate whether AI involvement is supported by additional evidence.

---

A-HUNT detection hypotheses

The following twelve hypotheses would form the first operational hunting package.

Hunt ID	Hunting hypothesis	Required telemetry	Priority
AH-H001	Distributed sources conduct complementary reconnaissance against the same target.	WAF, DNS, NetFlow, web server logs	High
AH-H002	Application probing exhibits systematic mutation driven by prior response characteristics.	HTTP logs, application errors, request bodies where permitted	Critical
AH-H003	Failed exploitation produces rapid, technically relevant payload modifications.	WAF, IDS, application logs	Critical
AH-H004	Successful exploitation is followed by exceptionally rapid environment discovery.	EDR, identity logs, application logs	High
AH-H005	Post-exploitation activity changes direction in response to environmental failures.	EDR, process telemetry, command-line logs	Critical
AH-H006	Multiple execution sources demonstrate coordinated or complementary task behavior.	SIEM, DNS, network, endpoint telemetry	Critical
AH-H007	Authentication failures trigger changes in technique, identity, or access pathway.	IAM, VPN, SSO, authentication logs	High
AH-H008	EDR or WAF enforcement is followed by targeted behavioral adaptation.	EDR, WAF, IDS/IPS	Critical
AH-H009	Lateral movement follows dynamically identified privilege or trust relationships.	AD, Entra ID, EDR, network telemetry	High
AH-H010	Independent intrusion sessions exhibit evidence of shared operational knowledge.	Historical SIEM, incident intelligence, network logs	High
AH-H011	Data discovery, collection, and exfiltration occur in parallel across multiple assets.	DLP, network, storage, EDR	High
AH-H012	Unauthorized activity involves an AI agent runtime, tool invocation, or compromised orchestration service.	AI gateways, MCP logs, cloud audit logs, EDR	Critical

These are starting hypotheses rather than validated detection rules.

Priority indicates where I would allocate hunt-development effort, not the probability that an observation proves AI use.

Example hunting analytic: Adaptive probing

A SIEM could evaluate a rolling window of activity against an application endpoint.

The analytic would examine five relationships:

1. Does the source submit a family of structurally related requests?
2. Do request mutations correlate with different response classes or application exceptions?
3. Does the source modify relevant parameters following those responses?
4. Does activity progress from probing to an unauthorized state change or authenticated session?
5. Does the same operational sequence recur across other assets or infrastructure?

A high-confidence detection should require multiple relationships and evidence of malicious intent.

A large number of requests or a high mutation rate alone would not justify classification as an autonomous attack.

---

Swarm hunting: Move beyond individual IP attribution

This is potentially the most significant architectural adjustment.

A traditional detection may correlate activity through a single source IP, process tree, or command-and-control domain.

For coordinated agentic activity, these identifiers may be fragmented.

I recommend introducing a Campaign Correlation Graph (CCG).

The graph would link events through common targets, execution relationships, timing, shared artifacts, and observed dependencies.

Proposed graph schema

Entity	Description
Agent candidate	An execution source exhibiting a distinct, potentially coordinated operational role
Infrastructure	IP addresses, domains, cloud instances, proxies, and execution environments
Target asset	Host, application, API, identity, repository, or cloud service
Technique	ATT&CK technique or proposed A-HUNT behavior
Observation	Result produced by the target or a defensive control
Adaptation	Subsequent behavior plausibly influenced by an observation
Objective	Access, collection, privilege acquisition, movement, or disruption

The graph should support edges such as:

SCANNED, TESTED, FAILED, ADAPTED_TO, AUTHENTICATED, SHARED_CONTEXT_WITH, MOVED_TO, and COLLECTED_FROM.

Example: Coordinated intrusion

Assume an organization observes three different external sources.

Source A enumerates application endpoints and identifies an unusual service.

Source B subsequently begins focused exploitation attempts against precisely that service.

Source C later authenticates to a related service and begins internal discovery.

The three sources have no common IP infrastructure or recognized malware.

A conventional source-centered hunt may classify these as separate incidents.

A-HUNT would investigate whether there are meaningful dependencies between them.

Specifically:

• Did Source B begin probing immediately after Source A discovered the target service?
• Did Source B use configuration information that Source A appeared to obtain?
• Did Source C’s subsequent behavior depend on information obtained by Source B?
• Are similar sequences observable across multiple targets?
• Is the timing inconsistent with ordinary background scanning?

Correlated activity does not prove agents are sharing information. A human-directed team could produce the same pattern.

However, the graph provides a means to test the multi-agent hypothesis instead of treating every source as an independent adversary.

The central shift is from infrastructure-based attribution toward behavioral and objective-based correlation.

---

Hunting for AI-developed zero-days

Zero-day discovery and exploitation deserve a distinct analytical treatment.

An AI-generated exploit does not necessarily expose unique network signatures. Generated code, exploit payloads, and protocol interactions can be indistinguishable from human-developed counterparts.

Consequently, there is no reliable general-purpose network signature for an AI-developed zero-day.

Instead, A-HUNT should emphasize detecting vulnerability exploration and exploitation outcomes.

Detection opportunities

Hunting area	Observable signal	Analytical value
Novel input testing	Malformed or unexpected inputs against rarely exercised application functionality	Potential vulnerability discovery
Differential testing	Structured input changes correlated with changes in application behavior	Feedback-directed experimentation
Crash analysis	Repeated exceptions or crashes tied to closely related requests	Possible fuzzing or exploitation development
Exploit validation	Related requests transitioning from failures to unauthorized execution or access	Potential successful exploitation
Post-exploitation verification	Immediate authentication, environment discovery, or execution following an application anomaly	Evidence of compromise
Cross-target propagation	The same unusual exploit behavior appearing across comparable applications	Potential campaign-scale exploitation

A-HUNT should therefore incorporate vulnerability research telemetry where available.

This includes application exception logs, API traces, memory-safety telemetry, web request metadata, and runtime security events.

For organizations with mature engineering environments, instrumenting high-value applications to preserve the relationship between input, exception, and subsequent request behavior could significantly improve detection.

Novel exploit hunting hypothesis

AH-ZD001: A series of related malformed inputs produces application exceptions, followed by a successful unauthorized state transition and immediate post-exploitation activity, without a previously identified vulnerability signature.

This is a behavioral zero-day hunting hypothesis.

It does not claim to identify AI-generated code. Instead, it detects the exploitation sequence that an autonomous vulnerability-discovery system might produce.

---

Autonomous intrusion confidence assessment

I would avoid a binary AI Attack: Yes/No classification.

Instead, the framework should distinguish evidence of automation, evidence of adaptive control, and evidence specifically linking an operation to AI.

A proposed scoring system follows.

Indicator	Points
Machine-speed multi-stage execution	1
Sustained execution without obvious human scheduling constraints	1
Multiple complementary execution sources	2
Observable feedback-conditioned payload mutation	3
Context-dependent changes in post-exploitation behavior	3
Demonstrable coordination between separate execution sources	3
Evidence of campaign knowledge reused across attempts	3
Confirmed malicious AI agent or orchestration tooling	5
Direct agent execution traces linked to the intrusion	5

Preliminary scoring bands

Score	Hunting disposition
0–3	Conventional intrusion or insufficient behavioral evidence
4–7	Automated intrusion with characteristics warranting further investigation
8–12	Strong candidate for adaptive or coordinated offensive automation
13+	High-priority investigation for agentic offensive activity

These thresholds are illustrative, unvalidated triage thresholds, not calibrated probabilities.

The presence of confirmed AI orchestration evidence should materially increase confidence, but the framework should not label an attack AI-driven based solely on its numerical score.

I recommend maintaining three separate confidence judgments:

Confidence in malicious activity: Is the behavior unauthorized and indicative of intrusion?

Confidence in adaptive autonomy: Is there evidence of feedback-driven planning, execution, or coordination?

Confidence in AI involvement: Is there direct or independently corroborated evidence that an AI system controlled or materially influenced the operation?

This prevents an important analytical error: interpreting sophisticated automation as proof of artificial intelligence.

---

Required telemetry architecture

Detecting agentic offensive activity requires correlation across security domains that are often monitored separately.

Data source	Hunting value
WAF and HTTP telemetry	Parameter mutation, response analysis, exploit refinement
Application logs	Exceptions, internal errors, unauthorized state transitions
EDR and process telemetry	Post-exploitation execution, conditional command changes
Network flow and DNS	Distributed reconnaissance, cross-host coordination
Identity and authentication	Adaptive credential attacks, automated access verification
Cloud audit logs	Rapid resource enumeration, permission discovery, workload abuse
Repository and CI/CD logs	Unauthorized automation, code modifications, supply-chain access
DLP and storage audit logs	Autonomous data discovery, staging, and exfiltration
AI gateway and inference logs	Direct evidence of model requests and tool use, where visible
MCP and agent runtime logs	Tool invocations, orchestration events, delegated execution
Threat intelligence	Infrastructure associations, campaign context, known agent tooling

The final three sources are particularly relevant when an attacker compromises an organization’s own AI-enabled applications or agent infrastructure.

However, defenders generally cannot inspect an external adversary’s private model or orchestration system.

A-HUNT must therefore remain effective when only network, application, identity, and endpoint telemetry are available.

Additional logging requirements

I recommend preserving enough event detail to reconstruct:

• The exact order of related requests and commands.
• Response codes, errors, and enforcement results.
• The relationship between identities, sessions, hosts, and services.
• Payload similarity across multiple attempts.
• Timing between environmental feedback and subsequent actions.
• Connections between apparently independent execution sources.

Where application bodies or prompts contain sensitive information, collection should follow data-minimization and access-control requirements.

---

Operational implementation

I would deploy A-HUNT through four complementary workstreams.

Workstream A: Exposure and exploitation hunting

Focus on internet-facing applications, APIs, cloud services, identity infrastructure, and high-value remote-access systems.

Develop behavioral detections for input mutation, exploit refinement, rapid access verification, and post-exploitation chaining.

This workstream targets AH-01 through AH-04.

Workstream B: Autonomous post-compromise hunting

Focus on command execution, privilege discovery, credential access, lateral movement, and internal reconnaissance.

Develop analytics that identify context-dependent attack sequences rather than isolated commands.

This targets AH-05 and AH-07.

Workstream C: Distributed campaign correlation

Build graph analytics capable of connecting multiple sources based on timing, targets, shared artifacts, and behavioral dependencies.

Use these relationships to investigate possible specialized-agent roles and distributed task coordination.

This targets AH-06 and AH-09.

Workstream D: Adaptive evasion and agent infrastructure

Correlate defensive enforcement with subsequent changes in adversary behavior.

Where organizations operate AI agents, examine unauthorized tool calls, unexpected model-to-tool transitions, excessive privileges, and unusual automated execution.

This targets AH-08 and supplements conventional ATT&CK and ATLAS detections.

Initial deployment milestones

Phase	Deliverable	Acceptance criterion
1. Baseline	Normal automation and scanning profiles	Known scanners and approved automation can be distinguished from suspicious activity
2. Detection engineering	Initial A-HUNT detection package	Relevant hypotheses produce reconstructable event sequences
3. Campaign correlation	Cross-source event graph	Analysts can connect related activity without requiring common source IPs
4. Validation	Controlled agentic-attack emulations	Detections identify adaptive behavior without relying on attacker tool names
5. Production hunting	Repeatable hunting playbooks	Findings include timeline, causal evidence, confidence, and ATT&CK mappings
6. Intelligence integration	Campaign-level A-HUNT assessments	Confirmed observations and hypotheses remain explicitly distinguished

I would begin by validating three cases: feedback-directed web exploitation, automated post-exploitation branching, and multi-source coordinated reconnaissance.

These offer the best combination of operational relevance, observable behavior, and testability.

---

Existing research to incorporate

A-HUNT should build directly on available research rather than duplicating MITRE’s work.

MITRE ATT&CK Campaign C0062: Provides a particularly useful real-world case for mapping an AI-orchestrated intrusion across established ATT&CK techniques. The documented activity spans reconnaissance, exploitation, credential harvesting, and exfiltration. MITRE campaign record.

MITRE ATLAS: Provides a complementary taxonomy for attacks against and abuse of AI systems. Its coverage of agentic AI should be incorporated into the framework’s technique mappings. MITRE ATLAS.

Anthropic, June 2026: Its research into 832 accounts associated with malicious cyber activity provides useful evidence for analyzing how attackers employ AI across ATT&CK techniques. Mapping AI-Enabled Cyber Threats.

Google Threat Intelligence Group, September 2026: Documents the transition toward agentic workflows, providing contemporary examples for testing autonomy-focused hunting hypotheses. From Prompting to Autonomy.

Google Threat Intelligence Group, May 2026: Provides evidence of AI-assisted vulnerability exploitation, directly supporting the need for vulnerability-discovery and adaptive-exploitation hunting. Adversaries Leverage AI for Vulnerability Exploitation.

These materials provide evidence that A-HUNT is addressing an emerging operational reality, although they do not yet establish the prevalence of autonomous multi-agent campaigns across the broader threat landscape.

---

Intelligence assessment and future direction

The most consequential implication of autonomous offensive operations is not simply that AI allows attackers to move faster. It is that AI can potentially change the relationship between an adversary, its tools, and the target environment.

Conventional hacking frequently involves an operator selecting techniques, executing them, examining results, and deciding what to do next. Agentic systems increasingly allow portions of that decision cycle to be delegated to software capable of interpreting environmental feedback and selecting subsequent actions.

A coordinated multi-agent architecture could further distribute these activities across numerous execution environments, reducing reliance on any single infrastructure component while increasing the number of possible attack paths.

This complicates traditional approaches to detection and attribution.

An organization may observe reconnaissance from one source, exploitation from another, and authenticated access from a third, without recognizing that the activities support a common objective. Furthermore, an agentic system may repeatedly change its execution strategy until it identifies an effective path, potentially reducing the defensive value of static signatures and historically observed intrusion sequences.

The appropriate response is not to abandon MITRE ATT&CK, IOC-based detection, or conventional behavioral analytics.

Rather, defenders should introduce a second layer of analysis that examines how adversary actions are selected, modified, coordinated, and sequenced.

Proposed doctrinal addition: Decision-Cycle Hunting

I recommend establishing Decision-Cycle Hunting (DCH) as the principal methodology underlying A-HUNT.

DCH would investigate five observable characteristics:

1. Feedback dependency: Whether subsequent actions are meaningfully influenced by earlier results.
2. Adaptive selection: Whether execution techniques change in response to encountered conditions.
3. Temporal compression: Whether complex intrusion phases are completed within unusually short decision intervals.
4. Distributed coordination: Whether apparently independent activities converge toward a shared operational objective.
5. Campaign learning: Whether later intrusion attempts incorporate information obtained during earlier activity.

The goal is to move from detecting individual attack techniques to reconstructing the adversary’s operational decision process.

This is particularly important for AI-enhanced zero-day campaigns. Even when the vulnerability is unknown and its exploitation does not match an existing signature, an automated attacker may still produce recognizable sequences of discovery, testing, adaptation, exploitation, and follow-on activity.

Final assessment

A-HUNT should treat autonomy as a behavioral hypothesis to be tested, not an attribute automatically assigned to sophisticated attacks.

The greatest analytical value comes from correlating events that traditional detection systems may consider unrelated.

An individual failed exploit is rarely significant. A failed exploit followed by a revised payload may indicate automation. A revised payload that appears to account for a specific application response suggests adaptive behavior. Similar adaptations coordinated across multiple sources and targets could indicate a distributed offensive system.

That progression supplies a defensible foundation for hunting increasingly autonomous campaigns, even when the underlying AI models, agent software, and orchestration infrastructure are inaccessible.

The next generation of threat hunting must examine not only what an adversary does, but also how its behavior changes in response to what it learns.

That is the fundamental premise of A-HUNT.