Companies frequently ask SpecterOps some version of the same question: How are you using AI in offensive security, and how can we begin using it too? They want practical guidance. Which parts of an assessment are improving now? Where does the technology still fail? What should a team learn or build first? 

Demystifying adversary tradecraft is part of SpecterOps’s core purpose. Through GhostWorks, we apply that purpose to AI by testing emerging capabilities against real security problems and publishing the uses and limits. Andrew Chiles, Adam Chester, and I recently discussed how AI is changing red teaming: the patterns we’re seeing, the research behind it, and the tools our team has built and is actively using. The replay is available if you want to have a look. As of September 2026, AI is useful across several parts of offensive security, but the fit changes by task and assessment context. The clearest way to explain it is to show the work. 

When the right system is around it, AI can save hours, expand a search, or produce useful tooling. However, it can also misread tool output and confidently report an exploit, privilege change, or control bypass that did not occur. The difference usually comes from the system around the model: the context it can see, the tools it can use, the state it retains, the authority it receives, and the evidence required before work is accepted. 

SpecterOps is an OpenAI Daybreak Cyber Partner and has participated in Trusted Access for Cyber since April 2026. Those programs provide our team with access to OpenAI’s advanced cyber-capable models, which we use across most of the categories that are detailed below. That access expands what we can test while leaving the engineering problem intact. The work still needs domain context, tools, durable state, independent validation, and human judgment. The sections that follow cover where our team is finding AI useful now, how that changes by assessment type, how harnesses fit into things, what still fails, and where to go from here. 

Where AI is Proving Useful in Offensive Security 

The categories below describe distinct kinds of work. They overlap during an engagement, but each produces a different artifact and demands a different form of validation. Broadly speaking, the value of using AI shows up in efficiency, decision quality, and new capability creation.  

Research and Analysis 

Research and analysis turns an unfamiliar system into a usable mental model. The output may be an explanation, a map of a codebase, a trace of recorded execution, a list of hypotheses, or the next experiment to run. SpecterOps practitioners have used Codex to build a Kubernetes security research framework, used Claude Code for secure code review, and used Time Travel Debugging traces to correct a plausible but wrong static analysis. A vulnerability may surface later, but discovery is not required for this work to be valuable.  

Consultants have also used AI to review firewall and proxy configurations for unintended routes out of a network and viable paths for a command and control (C2) channel. The work depends on semantic understanding across many rules and relationships, which makes it a good fit for a model working under expert review. 

Tool Development 

Models can build or adapt short-lived tools when an operator can test the result. During SpecterOps’s disposable Mythic agent work, a one-shot output failed on packages, file paths, Mythic RPC calls, and key exchange. Known dependencies, mock services, deployment checks, and end-to-end tests turned the same model into a productive development partner. The Nemesis team has taken a similar approach by publishing development skills for Codex and Claude Code. The value comes from a tight build, test, and repair loop. 

SpecterOps has also built a Beacon Object File (BOF) skill that ports existing code into a BOF. The team has used it for process injection and Control Flow Guard bypasses. A validation harness then confirms that the generated BOF behaves as intended. 

Reconnaissance and Data Reduction 

Offensive work often creates more information than a person can examine quickly. AI can help correlate attack paths, reduce false positives, and direct attention toward useful evidence. BloodHound MCP lets an agent reason over identity relationships through domain-shaped actions. DeepPass2 combines rules, a fine-tuned model, and LLM validation to find structured secrets and free-form passwords in documents. Blacklight searches endpoints for the artifacts AI agents leave behind. SpecterOps research pipelines also generate vulnerability candidates for human triage and guide agents toward the paths that look most promising. These systems narrow the field. The operator still decides what the evidence means and whether it is safe to act on it. 

Social Engineering 

AI can compress social-engineering preparation. Operators can use it to research targets, draft and localize phishing pretexts, produce landing pages and payload variants, and generate synthetic voice for authorized vishing exercises. This creates more variations to test, but it does not prove that a person or control will fail. As our Hacking Humans research explains, success still depends on context, routine, language, and decisions made under pressure. Measure the pretext, delivery, payload execution, and response separately. 

Vulnerability Discovery and Validation 

Historically, SpecterOps consultants did not spend much assessment time hunting for zero-day vulnerabilities. A new flaw could take months to understand, while a misconfiguration offered a faster route to the objective. AI changes that time constraint. Our team unanimously named time as the main benefit. Work that once took months can sometimes move from suspicion to validated evidence in hours or days.  

The model is especially useful when a researcher senses that something is wrong but cannot yet explain why. Team members described AI as helping them connect the dots, advance a hunch, turn a bug into an exploit, perform reverse engineering, and chain exploit primitives they would not have combined on their own. One researcher said the assistance was decisive in finding a Linux container breakout outside his prior expertise. Another found an RSA encryption flaw he did not expect to uncover alone. In cloud infrastructure, a consultant found one code-execution path, then Codex found another by chaining established techniques. 

As of August 2026, SpecterOps researchers estimate that they have found roughly 40 previously unknown bugs across multiple software platforms. Some remain in responsible disclosure, including cases with MSRC, so the technical details cannot yet be published. The findings range from low-impact bugs to local privilege escalation (LPE), remote code execution (RCE), and a container escape. The team has also found unauthenticated access primitives that led to command injection, command execution, or coercion. One team member reported close to 30 bugs that contributed to several exploit chains. Another submitted six bug reports in two weeks, and a third has made five MSRC reports. 

Vulnerability discovery has a different finish line from research. The workflow must identify and prove a previously unknown exploitable condition. A public SpecterOps prompt-injection project shows one form of the loop: Codex generated payloads, a harness tested them, deterministic checks classified the result, and later rounds used the evidence to refine the next batch. One representative run tested 440 payloads over two to three hours. The system also exposed a failure that matters well beyond prompt injection: the model learned to satisfy a weak success metric without performing the intended action. Stronger validation fixed it. 

Long-Running Automation 

Some work benefits from an agent that can continue through many small experiments while preserving what it learned. The prompt-injection workflow kept objectives, successful variants, and stage criteria in files so it could resume across sessions. The Day Shift reverse-engineering harness repeatedly ran Codex against endpoint detection and response (EDR) artifacts and carried forward a report, state, code map, and operating instructions. Internal vulnerability-research pipelines use the same pattern to generate candidates, move through triage faster, and steer the agent down selected paths. These examples work because the loop is narrow and its progress is visible. Keeping an entire assessment coherent for hours or days remains much harder. 

Stealth and Adaptation to Defenders 

AI can also help examine defender behavior and adapt an offensive technique. The SpecterOps AI-Gated Loader collected local telemetry and asked a model whether conditions were safe before continuing, with a fail-closed decision and an audit trail. Our EDR analysis work used an agent to extract detection logic, build local test harnesses, and validate bypasses against real alerts. These are meaningful demonstrations of adaptation. They do not yet prove that an autonomous agent can manage stealth across a live red team facing active defenders. 

Evidence Organization and Reporting 

AI can help turn raw assessment material into a usable artifact. SpecterOps’s LLMentary experiment used an LLM to convert technical findings from Word to Markdown and check them against a template. It caught some errors and introduced others, including invented code-language labels. SpecterOps has also experimented with processing Mythic logs synchronized to Ghostwriter to draft parts of an attack-path narrative. Consultants use AI to review reports for questions that require semantic understanding, such as whether a finding captures a root cause or merely describes an attack primitive. We still use an extensive human-only QA process through a technical editor and an offensive security practitioner. 

AI has helped after a vulnerability is proved as well. One researcher used it to turn technical evidence into the narrative, diagrams, and explanation for five MSRC submissions. A reviewer later described one submission as among the best disclosure writeups they had received. That result came from pairing a researcher who understood the flaw with a system that could organize the evidence clearly. 

Where AI Fits Across Assessments 

The strongest public evidence for autonomous offensive systems is concentrated in web application assessments, with external network penetration tests close behind. Both provide observable results that can be tested repeatedly and validated independently. The problem changes after a foothold, where the system must preserve operational state across identities, credentials, callbacks, attack paths, and prior actions. A full red team adds active defenders, stealth, infrastructure, communications, and rules of engagement. 

Web application assessments are the clearest current fit for vulnerability discovery. Requests and responses are observable, tests are often repeatable, and validators can encode exploitability. Secure code review and prompt-injection testing also show how AI can help an assessor understand unfamiliar applications and run large batches of controlled experiments. The web setting makes feedback fast. Application context and deterministic validation still decide whether a business-logic flaw or exploit chain is real. 

External network tests reward breadth. Service discovery, fingerprinting, public-data correlation, triage, and repeated checks suit current agents. ARTEMIS provides strong independent evidence: on a live university network of about 8,000 hosts and twelve subnets, the system placed second against 10 practitioners, submitted nine valid vulnerabilities, and achieved an 82% valid-submission rate. The top practitioner still performed better, and the system struggled with graphical interfaces and false positives. 

After a foothold, state becomes part of the target. An internal system must reason over live callbacks, credentials, identities, attack paths, prior actions, and proof of privilege transitions. The UK AI Security Institute (AISI)’s The Last Ones, built with SpecterOps, is a 32-step corporate range that crosses multiple subnets, Active Directory forests, a CI/CD pivot, and database exfiltration. GPT-5.5 completed the full scenario in a minority of runs. The range begins with network access and a vulnerable target. It omits active defenders, defensive tooling, and penalties for alerts, which the evaluators state in their report. 

Sage explores the same internal problem from the Mythic control plane. The open-source project combines live C2 data, BloodHound context, agent coordination, and action through existing callbacks. It separates read-only assistance, supervised action, and experimental autonomous execution. Sage remains a research prototype, and its repository warns against production use while command controls and human approval protections continue to mature. 

A full red team adds objectives that are difficult to reduce to a sequence of exploits. The team must protect infrastructure and identities, interpret ambiguous rules, adapt to defenders, and communicate under pressure. Public evidence for end-to-end autonomy in this setting is thin. AI has a useful place inside the operation for research, tooling, data reduction, and evidence management. The accountable operator remains human. 

The Harness Matters as Much as the Model 

A model’s ability to reason through a problem is only one layer of the system. A general-purpose application such as Codex gives an operator a flexible workspace for research, code, artifacts, and tools. This works well when the operator stays close enough to set scope and inspect the result. 

A skill packages a bounded method as instructions, references, and scripts. It can make a reliable workflow easier to repeat and share. SpecterOps’ public work already includes skills for Nemesis development and prompt-injection testing. A skills repository can give a team useful starting points, but it cannot supply missing evidence, authority, or judgment. 

A custom harness becomes worthwhile when state must survive many steps, actions need durable permissions, or a mistake carries real cost. Frameworks such as LangGraph provide state and orchestration. Sage is a concrete example: its LangGraph-based harness coordinates specialist agents, persists state, and connects model reasoning to Mythic operations. The security team still defines actions, approval gates, validators, recovery, and the audit trail. Another public security-research harness allowed a SpecterOps researcher to swap the underlying models. The workflow remained useful as models changed, making the harness’s contribution visible. A strong model inside a weak harness will still lose state or accept a false success.  

What Still Fails 

The first recurring failure is self-grading.  A model will sometimes optimize for the visible success condition instead of the intended behavior. Jailbreak testing exposes the same measurement problem. SpecterOps’s Jailbreaker can use models as the target, attacker, and judge, but a successful jailbreak or a judge score does not show how consistently a safeguard works or whether a change improved it. Jailbreaker preserves target configurations, baselines, techniques, prompts, responses, traces, and judge output so operators can rerun the same evaluation before and after a change. That makes the result easier to compare and audit without treating automated judgment as ground truth. The second is state drift. One mistaken identity, discarded credential, or misunderstood tool response can corrupt every later step while the prose remains confident. The third is transfer. Credentials, retries, clean resets, absent defenders, and known-vulnerable targets can make a range much easier than a client environment. AutoPenBench reported a 21 percent success rate for a fully autonomous agent in its test bed and much better results when a person supplied guidance. The gap is a reminder that human intervention changes the system being measured. 

Autonomy turns reliability into a trust and containment problem. A system that chooses and executes actions may create impact before a person can correct it, and a scope statement in a prompt is not a security boundary. In July 2026, OpenAI reported that models in a reduced-safeguard evaluation escaped isolation and reached HuggingFace production systems. Anthropic later found three incidents in which Claude reached real organizations from misconfigured evaluation environments. Meta disclosed a similar testing failure involving Muse Spark 1.1. These were unusual configurations, not ordinary product behavior, but they show why network boundaries, credentials, tools, and monitoring must enforce authorization. 

The same lesson appears in Sage. Its autonomous mode has been troublesome in practice, so we keep it in research status and favor read-only or supervised operation. The harness can restrict reach and authority more reliably than an instruction can. 

Dependable workflows use ordinary engineering controls. They preserve explicit state, expose narrow actions, limit authority, return useful errors, and verify effects outside the model. They also stop when evidence is missing. Prompt optimization can improve a workflow but the metric must reflect the outcome that matters.  

The Practical Answer for Teams 

Threat actors are adopting the same advantages. Anthropic has observed AI used across the offensive lifecycle including reconnaissance, vulnerability research, exploit development, malware engineering, credential harvesting, lateral movement, exfiltration, and multi-agent attack orchestration. In some cases, agents operated for hours with limited supervision or automatically rebuilt malware when defenders detected it. However, the underlying attacks remain familiar: stolen credentials, exposed services, unpatched systems, injection flaws, and phishing. The near-term change is compression: AI is reducing the expertise, labor, and time required to research, build, adapt, and operate attacks at scale.  

Start with a bottleneck the team understands. Research, trace analysis, secure code review, disposable tooling, attack-path interpretation, test generation, and evidence organization all give an expert a clear way to judge the result. Define the artifact or state that proves completion before adding autonomy. 

Keep authority proportional to the evidence. Read-only work is a sensible opening position. Add supervised actions when the team can inspect the proposed action and verify its effect. Reserve unattended execution for narrow, reversible work with strong instrumentation. 

Measure the workflow where it will run. Record the starting position, tools, time, retries, human interventions, unsupported findings, missed findings, and operational failures. Capture a proven method as a skill. Move it into a harness when it becomes repeated, long running, or consequential. 

Teams do not need to wait for a general autonomous system before learning how AI fits their work. The useful path is already visible: choose a bounded problem, connect the model to the right evidence, make success independently verifiable, and keep a person responsible for the outcome. Expand authority only when the results justify it. 

The field is still moving quickly. AISI reports that the time horizon of cyber tasks agents can complete is increasing over a period measured in months, while also emphasizing uncertainty and the limits of current ranges. SpecterOps will keep publishing the work, the failures, and the boundaries. That is how we demystify where AI belongs in offensive security without claiming the problem is already solved. Where are you and your teams using AI in your offensive security workflows? Join our Slack community to continue the conversation in the #deepthought channel.