In a controlled exposure test, Unit 42 published a live AWS access key to a public GitHub repository on December 19, 2025, and AWS's AWSCompromisedKeyQuarantineV3 managed policy was attached to the affected IAM user within 10 seconds, per the CloudTrail record Unit 42 published; GitHub's own secret-scanning notification arrived a full second after AWS had already acted.

The quarantine policy denies roughly 61 high-risk actions across 17 services — including launching EC2 instances, creating IAM users and roles, and invoking Bedrock models — without disabling the account outright, so any enterprise whose incident-response runbooks assume a human has minutes to react to a leaked cloud key is working against a containment window now measured in single-digit seconds on the defensive side.

Gambit Security recovered the staging server of a financially motivated operator running three off-the-shelf, open-source AI agent frameworks in concert — Strix for reconnaissance and vulnerability discovery, Cairn for autonomous end-to-end exploitation, and Hermes for orchestration — to compromise at least 27 of roughly 100 targeted retailers between July and September 2026, spending $12,000–$18,000 in total against a mean cost of $25.46 per target (range $3.13–$79.31), and stealing more than 600,000 credit card records from two of them.

This is a cost-economics data point, not a proof of concept: an operator with no custom tooling and a few thousand dollars of model-API spend reached admin-level access at a Fortune 500 hospitality company, a major US airline, and a large industrial distributor using publicly available agent frameworks, which resets the planning assumption that sustained, multi-target intrusion campaigns require a well-resourced operator.

Over six months of preparation for a Miden zkVM audit, Trail of Bits used AI agents under light supervision to build custom tooling from scratch — an LSP server, a decompiler, a static analysis engine, and a Lean formal-verification model — describing the shift as one that "completely changed the economics" of writing audit-support software that would not otherwise have been worth building for a single engagement. The tooling surfaced a high-severity bug: an underconstrained value in a modular-arithmetic procedure that would have let a malicious prover forge Falcon signatures and drain any Miden account secured by that key type, plus 400-plus locations needing stronger type validation and two further bugs caught by formal verification.

This is a documented answer to "what does a security function actually do with agentic AI," backed by a real outcome rather than a roadmap: a security firm used agents to build bespoke static-analysis and verification infrastructure it would not otherwise have built, and that infrastructure caught an exploitable signature-forgery bug a time-boxed manual review might have missed. The client team has adopted the resulting tools for its own future library updates.

Between roughly 00:48 and 05:25 UTC on September 23, 2026, an attacker who had obtained MemTensor's npm and PyPI publishing tokens by manipulating its GitHub Actions release workflow pushed malicious versions of MemoryOS — the persistent-memory library many AI agents use — and its OpenClaw integration plugin, embedding a cross-platform credential-stealing implant that activated during normal plugin initialization and memory-recall events rather than through a conspicuous install hook.

Because the compromised plugin sat directly in the OpenClaw agent's memory-recall code path, any secret a user or developer typed into an agent conversation while the plugin was active — not just credentials present in the build environment — must be treated as exposed; that is a materially larger blast radius than a typical dependency compromise, and it targets a component class, agent memory and persistence infrastructure, that most software composition analysis programs do not yet inventory as security-sensitive.