Agentic AI Security Lab: Stop the Autonomous Intruder
This lab puts you in the CISO seat against an autonomous attacker. Malbear Labs reports an agent harness that worked through recon, exploitation, lateral movement, tunnelling, credential access and management systems against a telecom provider and its hosted tenants. Those are one vendor’s unverified claims. Here a fictional version plays out phase by phase: you fund one control per phase and see how an attacker scoring itself would value what the phase could reach.
Three lessons run through it: model guardrails are not a boundary, agents are noisier rather than stealthier, and you hunt behaviour rather than a human. It pairs with the AI Pentesting Detector Lab and the Agent Egress Containment Lab. Everything is invented and no exploit steps appear.
You are Priya Raman, CISO of Northgate Telecom, a fictional telecom-style provider that also hosts thirteen business tenants on its data centre and cloud. Malbear Labs reports (in its 8 November 2026 Operation Snowball write-up) an autonomous agent harness that worked through reconnaissance, exploitation, lateral movement, tunnelling, credential access and management-plane targets against a provider of this shape and the organisations hosted on it. Those are one vendor's unverified claims. Here you face a similar fictional campaign phase by phase with a limited control budget. At each phase you choose which control to fund, and you see how an automated attacker that scores itself would value what that phase could reach. 12 scored decisions. Everything is invented; no exploit steps or jailbreak text appear.
This is the guided version: a yellow flash shows where to click and a bar says what to do. Switch to Free play any time.
GuidedPress the highlighted Start button. You can edit the names above first, or keep the samples.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
Loading…
Sample report · illustrative data
Sample result: agentic AI security debrief
Example debrief for a CISO who funded controls phase by phase against a fictional autonomous intruder. Scores are illustrative.
Result
- Score
- 88 / 120 (73%, example)
- Band
- Solid, with soft spots
- Decisions
- 12 scored 0 to 10; best answer is 10
Phase by phase (example)
| Phase | Control chosen | Why it scored |
|---|---|---|
| Exploitation | Out-of-cycle patching of known-exploited flaws | Best answer: time-to-patch is the lever against parallel automated attempts |
| Lateral movement | Default-deny segmentation between tiers and tenants | Best answer: boundary breaches are what the attacker rubric rewards most |
| Tunnelling | Blocklisted the tool and the destination address | Weak: Malbear Labs reports replacement tools and relay rotation |
| Management plane | Isolated management network with named MFA accounts | Best answer: management access is among the highest-valued targets |
Where points were lost (example)
- Relied on signatures and address blocks instead of behaviour.
- Kept a hunt built around odd-hours human sessions.
- Left a shared support login across tenants.
Takeaway
Model guardrails are not a boundary you control, agents are noisier rather than stealthier, and the hunt is for behaviour, not a human. Malbear Labs' findings come from one recovered workspace and are not independently verified. Lines marked PlayCISO practice in the debrief are our reasoning.
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
TL;DRWhat this is
5 points
- A scenario lab on agentic AI security from the defender's budget seat: an autonomous agent works through reconnaissance, exploitation, lateral movement, tunnelling, credential access and management-plane targets against a fictional telecom-style company and its hosted tenants. At each phase you choose which control to fund.
- What Malbear Labs reports (8 November 2026, Operation Snowball): a recovered workspace of an agent harness with a primary agent delegating to workers, more than two weeks of largely unsupervised activity, a target that was a European telecom provider and thirteen organisations it hosts, and a scoring rubric that weights network boundary breaches highest, then security-device and management access. The lab describes the rubric in words only.
- What is not known: Malbear's findings come from one workspace and are not independently verified; attribution is inferred; which listed flaws were actually exploited, and the real impact on victims, are not established.
- You make 12 scored decisions: guardrails are not a boundary, exposure, fast patching, segmentation, default credentials, egress and tunnel detection, behaviour over signatures, privileged-account tiering, management-plane isolation, tenant isolation, hunting behaviour not a human, logging, and what you tell the board.
- Everything is synthetic: fictional company, documentation-reserved addresses, no exploit steps or jailbreak text. Defensive and educational only.
Frequently asked questions
What is agentic AI security?
It is the practice of securing systems that use AI agents which plan and act with tools, and of defending against attackers who use such agents. This lab covers the second case: an autonomous agent running an intrusion. OWASP's excessive-agency guidance and its Top 10 for Agentic Applications for 2026 address the first.
What are agentic AI attacks?
They are attacks in which an AI agent carries out stages of an intrusion with little human input. Malbear Labs reports one: an agent harness that moved through reconnaissance, exploitation, lateral movement, tunnelling and credential access over more than two weeks. That is one vendor's unverified account of one recovered workspace.
Are agentic AI threats stealthier than human attackers?
Malbear Labs says the opposite: agent activity is noisier, with continuous and parallel scanning, authentication and lateral movement. The defender's problem is that hunts built around a human, such as off-hours logins and operator dwell time, have little to work with. Hunt volume, parallelism and repetition instead.
Do AI model guardrails stop attackers using AI?
No, treat them as outside your control. Malbear Labs reports an operator who built a large system prompt to suppress refusals. OWASP says to enforce authorization in downstream systems rather than rely on a model to decide what is allowed. Fund your own boundaries.
What are the main AI agent security risks for a company?
For a defender facing an attacking agent: exposed and unpatched systems, flat networks, default and reused credentials, unrestricted outbound traffic, reachable management interfaces and weak tenant isolation. For agents you run: excessive functionality, permissions and autonomy (OWASP LLM06). Prioritising by what an automated attacker values most is PlayCISO practice.
How is the lab scored?
Each decision scores 0 to 10 and the result is your share of the maximum, with a band that says what it means. The feedback gives the source behind each rationale; lines marked PlayCISO practice are our reasoning.
Sources
Read on 2026-11-08. Lines in the feedback marked “PlayCISO practice” are our own reasoning, not a statement by any source. The scenarios are fictional and use made-up data.
- Malbear Labs: Operation Snowball, inside an autonomous AI intrusion campaign (8 Nov 2026) (the author's reported findings from one recovered workspace, not independently verified)
- OWASP LLM06:2025 Excessive Agency (authorization in downstream systems; logging limits damage)
- OWASP Top 10 for Agentic Applications for 2026 (framework page; we quote no individual entry)
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.