The most important new capability is not superhuman hacking. It is adaptive labor at software scale.
Cybercriminals already have automation.
Botnets generate traffic. Exploit kits target known vulnerabilities. Phishing tools send millions of messages. Malware runs without constant supervision. Fraud platforms manage accounts, identities, payments, and victims.
AI agents do not replace these systems by making every criminal operation autonomous. Instead, they fill the gap between rigid automation and human judgment.
A traditional bot can repeat a predefined process millions of times. A human operator can interpret unexpected situations and adapt—but only across a limited number of targets. An AI agent can potentially do both: operate at machine speed while making enough contextual decisions to navigate unfamiliar or changing environments.
That combination creates something cybercriminals have never possessed at comparable cost: a scalable workforce of imperfect but persistent digital operators.
What is actually new?
The distinction between traditional automation and agentic automation can be summarized like this:
| Existing criminal capability | What an AI agent adds | Defensive implication |
|---|---|---|
| Fixed scripts | Adaptation to unexpected responses | Small interface changes may no longer stop automation |
| Mass messaging | Individualized, continuing conversations | Content similarity becomes a weaker signal |
| Manual application exploration | Automated navigation of unfamiliar interfaces | Every public workflow can receive sustained attention |
| Human troubleshooting | Machine-speed diagnosis and retrying | Defenders have less time to react |
| Separate fraud tools | Coordination across text, images, voice and applications | Detection must connect signals across channels |
| Human-managed personas | Persistent memory and narrative consistency | Long conversations are no longer proof of a human |
| Single-task bots | Goal-directed, multi-step workflows | Risk must be measured across an entire sequence |
| Centralized scam labor | One person supervising many agents | Criminal operations can scale without equivalent hiring |
| Static targeting lists | Continuous prioritization based on feedback | Attack resources can be concentrated dynamically |
| Bots interacting with people | Malicious agents interacting with legitimate agents | Agent identity and delegated authority become security controls |
None of these capabilities is entirely unprecedented. Skilled criminal organizations can already perform them with teams of people and specialized software.
What changes is their availability, speed, and economics.
Adaptive automation
The fundamental limitation of conventional bots is brittleness.
A script expects a particular page, field, response, or API structure. When the environment changes, a developer must update it. Defensive friction works partly because it makes the attacker’s automation expensive to maintain.
An agent can inspect the current state, infer what changed, and select another action. It may recognize that a field moved, a workflow added a step, or an application returned an unfamiliar error. It can then retry, choose another route, or ask a human operator for assistance.
This is not perfect autonomy. It is sufficient adaptability to keep many operations running without constant developer intervention.
That matters because defenders have historically relied on small amounts of unpredictability to disrupt large-scale abuse. Agents reduce the value of that strategy.
Generalizing across unfamiliar applications
Traditional automation is usually built for a particular target. AI agents can transfer knowledge between applications.
A computer-use agent can reason about buttons, menus, forms, dashboards, and error messages from their visible meaning. A tool-using agent can inspect structured responses and decide which operation is relevant. It does not necessarily require a dedicated integration or access to source code.
OpenAI has evaluated agents against sandboxed web applications where the model had no source-code access and had to interact with the target remotely. The GPT-5.4 system card describes meaningful black-box vulnerability-identification capability, while emphasizing that benchmark targets are simpler and less defended than hardened production systems.
For criminals, the new capability is not guaranteed exploitation. It is inexpensive exploration.
Applications that were previously too obscure or individually low-value to justify manual attention can now be examined by automated operators.
One human supervising many operations
This may be the most consequential change for fraud.
Current scam operations can be labor intensive. Operators must communicate with victims, remember personal details, maintain emotional narratives, respond to objections, and decide when to escalate.
An agent can handle routine conversation, summarize what happened, suggest the next step, and alert a supervisor when a consequential decision is required. One person may eventually supervise dozens or hundreds of active conversations.
The resulting operation is neither human nor autonomous. It is a human-agent organization in which people handle exceptions and agents provide scalable labor.
This dramatically improves the economics of fraud without requiring models to be perfectly reliable.
INTERPOL estimates that AI-enabled financial fraud can be 4.5 times more profitable than comparable non-AI-enhanced tactics because it increases both reach and persuasiveness. Its 2026 financial-fraud assessment describes AI-powered fraud-as-a-service platforms, synthetic identities, victim-management tools, and agentic workflows as parts of an increasingly industrialized fraud economy.
Persistent personas
A human fraudster operating many identities eventually makes mistakes. Details conflict. Writing styles shift. A story changes between conversations.
Agents can maintain structured memories for each persona and victim:
Personal history
Previous claims
Relationship status
Promises and deadlines
Language preferences
Emotional tone
Earlier objections
Documents and images already shared
That allows one system to operate many identities while keeping each narrative internally consistent.
Persistent memory does not make a persona convincing by itself. But it removes one of the operational bottlenecks that historically limited personalized fraud.
It also weakens a familiar safety assumption: that a long, detailed conversation probably reflects genuine human investment.
Multimodal identity construction
Language models generate text, but modern fraud increasingly combines several media.
An agent can coordinate:
Written conversation
Profile images
Documents
Voice generation
Video avatars
Application forms
Social-media activity
The capability is not simply creating one deepfake. It is maintaining consistency across an entire identity.
A profile’s age, occupation, location, language, photographs, voice, documents, and conversational history can all be derived from the same underlying persona record.
INTERPOL has identified deepfake-as-a-service marketplaces selling synthetic identity kits that combine video avatars, voice clones, and biometric materials. The International AI Safety Report 2026 also cites research in which people accepted cloned audio as authentic in 80% of cases.
For defenders, this means identity signals cannot be evaluated independently. A matching face, voice, document, and personal story may all originate from the same synthetic system.
Machine-speed troubleshooting
Conventional automation succeeds quickly or fails predictably. A human attacker must diagnose unusual failures.
Agents introduce an intermediate capability: automated troubleshooting.
A model can interpret an error, revise an assumption, try another permitted action, and compare the outcomes. It can retain a record of unsuccessful approaches and avoid repeating them.
Google Threat Intelligence reported in 2026 that adversaries were moving toward autonomous systems capable of interpreting environmental state and adapting their commands. It also identified what it believes was the first threat actor using a zero-day exploit developed with AI. Google’s assessment describes a broader transition from AI experimentation toward industrial integration.
The defensive impact is a compressed response window. Activity that once required a human to notice a failure, understand it, and write a correction may continue with little delay.
Long-horizon coordination
Traditional bots are good at short transactions. Agents can potentially maintain goals over longer periods.
A fraud agent could track many partially completed processes, revisit them when conditions change, and coordinate activity across accounts and applications. A cyber agent could preserve observations from earlier reconnaissance and connect them with later information.
The important capability is state management:
What has already been attempted?
What was learned?
Which accounts remain usable?
Which targets appear promising?
What requires human review?
When should a dormant process resume?
Reliable long-horizon autonomy is still difficult. Models lose context, make inconsistent decisions, and sometimes misunderstand their own tools.
But partial long-horizon capability is already valuable. An agent does not need to run an operation independently for months; it only needs to reduce the amount of human attention required to keep it moving.
Multi-agent task decomposition
One agent can become overloaded by a complicated objective. Multi-agent systems divide the work.
Different agents might specialize in research, application navigation, document analysis, translation, conversation, or quality control. A coordinating agent combines their findings and decides what to escalate.
This resembles a criminal organization—but implemented partly in software.
The novelty is not specialization. Criminal groups already specialize. The change is that additional digital workers can be created cheaply, operated continuously, and replicated across targets.
The practical value will depend on coordination quality. Multi-agent systems can amplify errors, duplicate work, and accept one another’s false conclusions. More agents do not automatically produce better outcomes.
Personalized targeting at population scale
Mass fraud traditionally trades personalization for reach.
A generic message can be sent to millions of people, but it is less convincing. A carefully researched approach may perform better, but manual research is expensive.
Agents can narrow this tradeoff. They can summarize public information, segment potential victims, generate culturally appropriate communication, and adapt follow-up conversations to individual responses.
This makes personalized social engineering available at a scale previously associated with generic spam.
The risk is not merely better grammar. It is a system that changes strategy as it learns what a particular victim believes, fears, or wants.
Continuous economic prioritization
Criminal operations have limited resources: model inference, stolen accounts, infrastructure, human supervision, and time.
Agents can continually estimate which targets or conversations are worth further investment. Low-probability opportunities can be dropped, promising ones escalated, and expensive resources reserved for difficult cases.
This is the same optimization legitimate businesses use in sales and customer support. Applied to fraud, it increases the return from a fixed criminal workforce.
The capability is easy to underestimate because it does not look like “hacking.” But improving target selection may create more harm than improving any individual technical action.
Agent-to-agent deception
As applications deploy their own agents, criminals will increasingly interact with software rather than people.
A malicious agent might communicate with:
Customer-support agents
Shopping assistants
Payment agents
Marketplace moderation systems
Account-recovery assistants
Insurance or claims agents
Enterprise procurement systems
This creates a new security question. The application can no longer ask only, “Is this a human or a bot?”
It must ask:
Who authorized this agent?
What is it permitted to do?
Is it acting within that delegation?
Does its behavior match the user’s stated intent?
Can another agent manipulate its reasoning?
Legitimate agents will make blanket blocking impractical. Trust, identity, authorization, and intent will need to replace “human-looking behavior” as the foundation of application security.
Expertise becomes more transferable
AI agents can make specialist knowledge available to less-skilled operators.
They will not instantly turn novices into elite vulnerability researchers or experienced fraud strategists. Models still make errors, misunderstand context, and require judgment.
But they can explain unfamiliar systems, translate terminology, propose plans, summarize results, and help troubleshoot. This allows moderately capable criminals to attempt work that previously required more specialized collaborators.
The effect may be larger on the middle of the skill distribution than at the top. Elite attackers already possess sophisticated expertise. Agents give ordinary operators access to a partial, inconsistent version of it.
What agents still do not give criminals
It is equally important not to exaggerate the shift.
AI agents do not create access where none exists. They do not eliminate strong authentication, correct authorization, isolation, encryption, or well-designed transaction controls. They cannot exploit a vulnerability that does not exist simply by reasoning longer.
They also remain limited by:
Hallucinated findings
Inconsistent long-term planning
Poor judgment under ambiguity
Difficulty distinguishing noise from weak security signals
Provider safeguards and monitoring
Infrastructure cost
Operational visibility
Unreliable tool use
The need for real accounts, identities, payments, or access
Human intervention during unusual or consequential situations
A capable model can accelerate an operator. It does not remove the need for a viable criminal path.
Which capabilities will matter first?
Fraudsters are likely to benefit first from:
Multilingual conversation at scale
Persistent persona management
Application and support navigation
Synthetic identity coordination
Multi-account workflow management
Human supervision of many simultaneous interactions
Cybercriminals are likely to benefit first from:
Faster reconnaissance and target triage
Interpretation of unfamiliar systems
Black-box application exploration
Troubleshooting and adaptation
Rapid analysis of newly disclosed vulnerabilities
Coordination of existing tools across longer workflows
Fully autonomous compromise of hardened organizations is a later and much less certain capability.
What defenders should change
The arrival of agents means organizations must move beyond defenses designed exclusively for fixed bots or individual humans.
Detect coordinated behavior
One session may appear ordinary. Relationships across accounts, devices, payment instruments, beneficiaries, support conversations, and application objects may reveal the operation.
Secure the complete workflow
Every state transition needs server-side authorization. UI restrictions and assumed sequences are not security boundaries.
Treat agents as identities
Legitimate agents should authenticate explicitly and receive scoped, revocable permissions tied to the person or organization that delegated the task.
Introduce friction around consequences
High-value payments, identity changes, refunds, account recovery, and permission changes should require stronger evidence than conversational persuasiveness.
Test continuously from the outside
Organizations should use authorized agents defensively to explore the same public interfaces available to attackers. Code review alone does not reveal every behavioral or business-logic weakness.
Measure sequences, not just requests
Adaptive agents can vary individual actions. Detection should focus on intent inferred across a complete series of actions.
Shorten the remediation window
AI reduces the time between vulnerability disclosure, target identification, and attempted exploitation. Asset inventory and rapid patching become even more important.
The real new capability
AI agents do not give criminals a magical new exploit or a guaranteed way through secure systems.
They give them something more organizational: the ability to combine perception, reasoning, action, memory, and adaptation in a digital worker that can be copied.
That worker is less reliable than a skilled human but cheaper, faster, continuously available, and capable of escalating difficult cases rather than handling everything alone.
The resulting threat is not one autonomous super-hacker. It is a fraud or cyber operation in which a small number of people can direct a much larger amount of adaptive activity.
Traditional automation gave criminals scale without judgment. Human teams provided judgment without unlimited scale.
AI agents begin to merge the two.
