Agentic AI Attacks: How 22-Second Breakout Times Are Rewriting Cybersecurity Economics

From Hours to Seconds: The Collapse of the Defender Window

In 2022, the average time between an attacker achieving initial access and completing the lateral movement phase — called “breakout time” — was measured in hours. Security teams operating standard SIEM-based detection could realistically intervene. By 2025-2026, that window had collapsed to 22 seconds, according to Sandra Joyce, Vice President of Google Threat Intelligence, speaking at RSAC ’26.

The 22-second figure is not a theoretical minimum observed in lab conditions. It represents the operational tempo of adversarial campaigns that exploit agentic AI frameworks — systems capable of autonomously chaining together reconnaissance, credential harvesting, lateral movement, and privilege escalation without human operator input at each stage. A defender who receives an alert at the 30-second mark is already responding to an intrusion that has laterally moved, elevated privileges, and established persistence.

This is not incremental change in attacker capability. It is a category shift. Legacy cybersecurity architectures — perimeter firewalls, signature-based detection, human-reviewed SIEM alerts — were designed for an adversary that operated at human speed. Agentic attack frameworks operate at software speed. The asymmetry is structural.

How Agentic Attack Frameworks Operate

Understanding why the 22-second breakout time is achievable requires understanding what agentic AI attack frameworks actually do. Unlike traditional automated attacks (botnets, scripted exploits), agentic attack systems exhibit goal-directed behaviour: they receive an objective (achieve persistence in a target environment), decompose it into subtasks, select and sequence tools based on environmental feedback, and adapt when individual actions fail.

In practice, this means an agentic attack framework can: enumerate open ports and services, select the most promising exploitation path from a learned vulnerability database, execute the exploit, assess the result, escalate privileges using the appropriate technique for the discovered OS version, establish a C2 beacon, and enumerate adjacent systems for lateral movement — all within a single automated loop running at the speed of API calls.

The Microsoft security research team documented in April 2026 that AI-enhanced phishing campaigns now achieve a 54% click-through rate, compared to approximately 12% for traditional campaigns — a 450% effectiveness increase. The Tycoon2FA adversary-in-the-middle platform, dismantled in early 2026, was linked to nearly 100,000 compromised organisations since 2023 and accounted for approximately 62% of all phishing attempts Microsoft blocked at peak activity, operating through 330 seized domains. These are not isolated experiments — they are production-scale deployments of AI-assisted attack infrastructure.

The Google Cloud security team also reported at RSAC ’26 that 72% of organisations lack confidence in their ability to execute a secure AI strategy, according to a Cloud Security Alliance and Google survey. The gap between attacker AI adoption and defender AI adoption is widening.

What Enterprise Defenders Must Redesign

1. Automate First-Response Decisions or Concede the 22-Second Window

Manual review of SIEM alerts cannot operate inside a 22-second breakout window. No human analyst, regardless of skill, can review an alert, confirm it is genuine, escalate it, obtain approval, and execute containment in under 22 seconds. Organisations that have not automated their first-response decisions — automatic network isolation of a host upon confirmed anomalous lateral movement, automatic credential suspension upon impossible travel detection, automatic C2 beacon blocking upon signature match — are operating on a response model designed for a threat environment that no longer exists.

The practical redesign is: define the specific alert types that trigger automatic containment actions, implement those automations in the EDR and identity provider (not just recommended in the SIEM playbook), and accept the false-positive cost of occasional incorrect automatic containment as cheaper than the cost of a 22-second lateral movement. 89% of CISOs are pushing to accelerate adoption of agentic security capabilities, per Omdia research cited at RSAC ’26. The constraint is organisational risk tolerance for automated action, not technical capability.

2. Treat Memory Poisoning and Prompt Injection as Production-Grade Threat Vectors

Agentic AI systems deployed by defenders — autonomous triage agents, SOAR integrations, AI-assisted threat hunting — are themselves attack surfaces when adversaries understand how they work. Memory poisoning attacks inject false context into an AI agent’s working memory, causing it to misclassify threats or suppress alerts. Prompt injection attacks embed instructions into content that an AI agent will process (log entries, document contents, email bodies) that redirect the agent’s actions.

For enterprise security teams deploying AI-assisted detection and response, this means: isolating the AI agent’s input channels so that content processed from untrusted sources (emails, external documents, third-party API responses) cannot influence the agent’s core decision logic; implementing validation layers that verify agent outputs before executing high-impact actions (blocking rules, credential suspensions); and red-teaming the AI agent specifically for prompt injection before production deployment. These are not academic concerns — they are engineering requirements for any agentic security tool deployed in a production environment.

3. Shift Threat Intelligence to Dark Web Feed Integration

The 22-second breakout window means that threat intelligence must arrive before the attack, not after. Traditional threat intelligence cycles — weekly reports, monthly feeds — are calibrated for an attacker tempo that no longer applies. Google’s security team reported at RSAC ’26 that new dark web intelligence capabilities can analyse millions of daily external events with 98% accuracy to surface only the threats relevant to a specific organisation’s environment.

The practical shift for enterprise security teams is: subscribe to dark web intelligence feeds that monitor for credential listings, tool releases, and targeting discussions relevant to your organisation’s sector and technology stack; integrate these feeds into your SIEM or SOAR platform so that a newly listed credential or a newly released exploit module generates an automatic alert within minutes; and prioritise dark web feeds over traditional vulnerability advisory timelines, because the attacker ecosystem deploys tooling from dark web releases faster than vendors patch. Supply chain attacks — Axios npm in March 2026, Context AI/Vercel in April 2026 — frequently appear in dark web forums before official disclosure.

The Bigger Picture

The 22-second breakout time is an economic signal, not just a technical one. Agentic AI attack frameworks reduce the marginal cost of executing a sophisticated multi-stage intrusion to near zero: once the framework exists, running it against another target costs only compute time. Traditional cybersecurity economics assumed that sophisticated attacks required skilled human operators at each stage, which constrained attacker volume. Agentic automation removes that constraint.

This changes the threat model for every organisation. The question is no longer “are we a high-value enough target to justify a skilled adversary’s time?” The question is “are we in the subset of targets that an automated sweep will identify as exploitable?” At scale, automated agentic attack frameworks will scan and exploit at volumes that make every organisation a viable target. The Tycoon2FA case — 100,000 compromised organisations from a single adversary-in-the-middle platform — demonstrates what that volume looks like in practice.

The defender response is not to match attacker AI with defender AI in a symmetric arms race. It is to redesign security architectures around the assumption that human-speed response is not available inside the attack window, and build automated response systems that contain damage before humans can even review the alert.

Frequently Asked Questions

Sources & Further Reading

• Supercharging Agentic AI Defense with Frontline Threat Intelligence — Google Cloud Blog, RSAC ’26
• Threat Actor Abuse of AI Accelerates: From Tool to Cyberattack Surface — Microsoft Security Blog
• Agentic AI: The 2026 Threat Multiplier Reshaping Cyberattacks — Barracuda Networks
• Agentic AI Cyber Attacks — Jazz Cyber Shield