AI agents for reconnaissance and expect this trend to accelerate rapidly.

cybersecurity experts and threat intelligence reports confirm that attackers are already using AI agents for reconnaissance and expect this trend to accelerate rapidly. This shift moves the threat landscape from human-assisted AI tasks to highly autonomous, AI-orchestrated operations capable of executing entire attack chains at machine speed.

Key Ways Attackers Use AI Agents for Reconnaissance

Automated Information Gathering: AI agents autonomously perform persistent scanning, correlate employee data from social media, discover cloud misconfigurations, and analyze large volumes of public data (OSINT) to map out target networks and identify vulnerabilities.

Hyper-Targeted Social Engineering: Generative AI crafts highly personalized and context-aware phishing messages and lures in native languages, using information gathered during the reconnaissance phase (e.g., job titles, recent company news, communication patterns) to increase success rates.

Vulnerability Discovery: AI models can analyze codebases, predict zero-day vulnerabilities with high accuracy, and generate exploits faster than human analysts can respond.

Autonomous Execution: In documented cases, an AI agent was used to perform 80-90% of a cyber espionage campaign's tactical work, including identifying high-value databases, testing vulnerabilities, writing exploit code, and harvesting credentials, with human oversight only at key decision points.

Fortinet’s 2026 Cyberthreat Predictions Report forecasts cybercrime evolving into a fully industrialised ecosystem driven by AI, automation and specialised tools, where the speed of converting intelligence into action will determine the effectiveness of both attacks and defence.

Fortinet has released its 2026 Cyberthreat Predictions Report, warning that the coming year will mark a dramatic shift in the global cyber landscape. According to FortiGuard Labs, cybercrime is rapidly evolving into an organised, AI-driven industry where attackers will prioritise speed and throughput over novel techniques.

The report says that advances in automation, artificial intelligence and a maturing cybercrime supply chain will allow attackers to launch multiple campaigns simultaneously, drastically shrinking the time from intrusion to impact. Attackers are expected to use AI agents for reconnaissance, intrusion, credential theft and ransom negotiations, transforming cyber operations into high-volume, industrial-scale processes.

The Next Generation of Offense

FortiGuard Labs expects a rise in specialized AI agents built to assist cybercriminal operations. Although these agents will not yet operate fully independently, they will automate critical phases of the attack chain such as credential theft, lateral movement, and data monetization.

AI will also accelerate how quickly stolen data can be monetized. Once attackers access a database, AI tools will instantly classify, prioritize, and identify the most profitable victims while generating personalized extortion messages. As the underground economy becomes more advanced, the coming year will see tailored botnet rentals, curated credential packages, customer-service-like features, reputation scoring, and automated escrow mechanisms—all signs of a cybercrime ecosystem evolving toward full industrialization.

 By - Aaradhay Sharma