When AI Runs the Operations: Autonomous Agents and the Future of Cyber Competition

(Jam Kraprayoon and Shaun Ee – Just Security) On March 6, the White House released President Donald Trump’s Cyber Strategy for America. Among its commitments, the strategy pledges to “rapidly adopt and promote agentic AI in ways that securely scale network defense and disruption.” That sentence signals how far U.S. cyber policy has shifted—from AI as a cybersecurity tool to autonomous agents as instruments of both defence and offensive disruption. The United States is not alone in recognizing the potential of agentic cyber capabilities. In November 2025, Anthropic assessed that a Chinese state-sponsored group had jailbroken Claude Code to launch cyber operations against roughly thirty global targets. Even though they risked exposure, Chinese actors used Anthropic’s software coding agent with custom scaffolding to automate eighty to ninety percent of the operation, marking the first known incident of a large-scale cyber campaign planned and executed primarily by an AI system rather than human operators. As agentic capabilities advance, nation-states and other threat actors have powerful incentives to push towards what we, in a new report from the Institute for AI Policy and Strategy, term “highly autonomous cyber-capable agents” (HACCAs), or systems that independently conduct end-to-end cyber campaigns at the level of the most sophisticated criminal groups and nation-state hackers. Policymakers face three questions: how to assess a capability still taking shape, how to defend against it, and how to ensure their own use does not create new risks. – Autonomous Agents and the Future of Cyber Competition