AI Agents Explained: What They Are and How Attackers and Companies Are Using Them

Artificial intelligence has spent the past few years answering questions. AI agents are the next step: software that gets things done.

Give an agent a goal, and it works out the steps, uses other software to carry them out and checks its own progress, whether the job is clearing an inbox, writing and testing code or resolving a customer query.

Because they can handle whole tasks rather than single prompts, agents have become one of the most talked-about trends in technology, and businesses are already handing them real access to finance systems, email and internal code.

That access is exactly what makes them a security story.

The UK's National Cyber Security Centre (NCSC), working with counterparts in the United States, Australia, Canada and New Zealand, has urged organisations to go carefully.

But attackers have taken notice too. Researchers at the Israeli firm Dream say a suspected China-linked group used free, open-source AI agents to run a four-day intrusion into Taiwanese government systems with as many as eight agents working in parallel.

What Are AI Agents?

In technical terms, an AI agent is software that uses an artificial intelligence model, usually a large language model, to pursue a goal with little step-by-step instruction.

A chatbot answers a question and waits for the next one. An agent is handed a job and does it, which might mean reading an inbox, querying a database, running code or updating a customer record.

That ability to act, rather than only talk, is why the term agentic AI has caught on.

The UK's National Cyber Security Centre (NCSC) describes these systems as combining language models with external tools, memory, data feeds and automated processes, and says they present a different kind of security problem from generative AI because they take actions instead of only producing output.

How Do AI Agents Work?

Most agents share four parts.

The first is the model, which does the reasoning: it reads the request, breaks it into steps and decides what to do next.

The second is a set of tools, meaning connections to other software that let the agent search the web, open files, run code or send messages.

The third is memory, so that step five can build on what happened in step two.

The fourth is the loop.

The agent plans, acts, looks at the result and then either acts again or reports back, repeating until the goal is met or something tells it to stop. Some agents work in teams, with one handing parts of a job to others.

Each part adds capability, and each adds something an attacker can try to exploit.

How Attackers Are Using AI Agents

The Taiwan campaign is the most detailed public example so far.

According to reporting by Tom's Hardware, summarised by Slashdot, Dream found evidence of it in an online archive of 1,395 files while tracking threat actors.

The operation ran for four days, mapped 21 government systems and compromised at least 85 accounts. It reportedly stole more than 2,500 personnel records, and the attackers later extended their reach to Taiwan's nuclear safety agency, at least seven energy companies and government suppliers.

What set it apart was how the agents behaved.

The tool kept assessing evidence, ranked possible attack paths and re-ranked them as conditions changed. When a technique failed, it assigned another agent to search the internet for an alternative. Up to eight agents ran in parallel.

Two details deserve attention.

The first is how the attackers got around the model's safeguards: they reportedly presented the intrusion as an authorised penetration test rather than a real attack, a simple piece of social engineering aimed at the AI itself.

The second is the toolkit.

Neither of the open-source systems used, Hermes and OpenClaw, was built for offensive work, yet the operators combined them into a capable attack tool.

Dream's researchers could not tell which language model powered the agents, and they stress that the components are freely available, so others could assemble something similar.

The claim of a 'first' is presented with caution in the reporting, and it is worth keeping that caution. But the direction is clear. Agents lower the effort needed to run a multi-stage intrusion, and they do it with parts that cost nothing.

How Companies Are Using AI Agents

Businesses are putting agents to work in much the same way.

Common uses include writing and testing software, resolving customer queries, fixing routine IT faults, researching and summarising information, and sorting security alerts for human analysts. The attraction is plain: routine, multi-step work done faster and at lower cost.

The NCSC's concern, set out in guidance produced with counterparts in the United States, Australia, Canada and New Zealand and reported in May 2026, is how much access agents are being given.

It points to organisations that have granted agents reach into finance systems, email and internal code repositories.

An agent built to solve problems on its own may also download packages, scripts or tools when it lacks a built-in way to finish a task. Each of those choices adds to what a compromised agent could do.

Why AI Agent Security is Different

A chatbot that is fooled says something wrong. An agent that is fooled does something wrong, using the access it holds.

The NCSC lists the main risks as prompt injection, where hidden instructions in an email, web page or document steer the agent, along with privilege misuse, impersonation and cascading failures that spread through connected systems.

Overprivileged agents are a particular worry, because an attacker who takes over an agent's identity inherits all of its access.

The behaviour of agents can also be hard to predict because of advances in model design and long chains of reasoning across several systems.

Outside experts quoted in the coverage add further points.

Rajeev Raghunarayan of the security firm Averlon argues that agents change the risk model precisely because they act, so organisations need to ask what an agent can reach and do, what inputs can influence it and who is accountable, and he stresses that internet reach, API connections and code execution matter as much as permissions.

Steven Swift of Suzu Labs warns that treating a model's output as trusted input is a common failure, since agents feed their own output into later steps, and that a carefully written system prompt is not enough of a control on its own.

How To Use AI Agents Safely

The NCSC's advice is to treat agentic AI as part of existing cyber security practice, not a separate subject, and to apply established principles.

The first is least privilege: an agent should hold only the access its task needs. The second is defence in depth, which assumes any single control can fail.

The agency recommends starting with low-risk uses, maintaining strong human oversight, and prioritising resilience and reversibility over efficiency gains until standards and security tools mature. Its summary advice is to 'learn to walk before you can run'.

Swift adds a practical layer: build checks into the intermediate and final stages of an agent's work, and give the system a way to halt when a check fails.

The Taiwan case shows why that matters. An agent that takes instructions framed as a legitimate test and keeps going until it succeeds needs limits that don't depend on it making the right call.

Frequently Asked Questions

• What are AI agents?
  AI agents are software that use artificial intelligence models to pursue goals with minimal step-by-step instructions.
• How do AI agents differ from chatbots?
  Unlike chatbots that respond to prompts, AI agents can perform tasks autonomously by acting on instructions.
• What are the security concerns with AI agents?
  AI agents pose security risks such as prompt injection, privilege misuse, impersonation, and cascading failures.
• How can organizations use AI agents safely?
  Organizations should apply cybersecurity principles like least privilege, defense in depth, and maintain human oversight.