AI Agents Becoming Core InfoSec Skill Like Microsoft Office Proficiency
Proficiency with AI in information security is gradually becoming a standard expectation rather than a distinct skill. It is now treated much like knowledge of Microsoft Office, which would seem odd to list in requirements for a SOC analyst. The critical distinction is the price of mistakes. Incompetent use of Word merely wastes time, whereas clumsy interaction with an AI agent consumes rate limits and subscription fees, and in corporate settings, company money as well.
Four practical workshops on applying AI in information security, part of the Engineering October collection, will help newcomers gain hands-on experience with AI agents. The sessions range from using AI as a daily tool for junior specialists to securing the agents themselves. Foundational concepts are acquired quickly, including where AI tends to err and how to avoid harming oneself or the employer.
Model versus Agent: Understanding the Difference
A model operates simply: it receives a question and returns text. This is how ordinary chats with neural networks function. An agent combines the model with tools. It can execute commands, read and create files, access the internet, and open browsers. When asked to build a website, a model describes what it could look like, while an agent actually creates it, though the result may be mediocre without precise instructions.
Examples of agents include Claude Code, Codex, and the open-source OpenCode. Models can be run locally via Ollama, though performance on consumer hardware is noticeably slower than cloud versions.
Why Agents Forget Instructions
The central concept in working with AI is context. This encompasses everything the model knows in the current session: user messages, uploaded documents, command outputs, and intermediate reasoning. Context size is limited by the context window, which may reach 200,000 or one million tokens depending on the plan.
While the session stays within limits, operation remains reliable. Once the window fills, the agent compresses context and discards details. This leads to the common beginner complaint that an early instruction is ignored later because it was lost during compression. Quality also degrades before the absolute limit; practitioners note that a one-million-token window performs noticeably worse after 600,000–700,000 tokens.
Recommended practices include storing persistent rules in an instructions file such as AGENTS.md or CLAUDE.md. Agents read these files at the start of each session. The file should contain the technology stack, agreements, restrictions, and current status. Ask the agent to update the file at the end of major tasks so the next session avoids reprocessing the entire project. Start a fresh session when switching between unrelated tasks to keep context clean.
Skills, MCP, and Sub-Agents Explained
These three mechanisms help conserve context. A skill is best understood as a saved instruction. Instead of repeatedly explaining how to parse a report or format output, the text is written once into a Markdown file. The skill includes a short description so the agent knows when to invoke it. Until needed, the skill does not occupy context space. Ready-made skills are available in public catalogs and can be customized.
MCP provides agents with interfaces to external systems. It is essentially an API wrapped in a model-friendly format. Through MCP, an agent can open a browser to check UI layout across screen sizes or connect to SIEM platforms, vulnerability scanners, and asset databases.
Sub-agents assist with large tasks. The main agent creates a plan and delegates each item to a separate helper that receives only the minimal required context. Failed attempts stay with the helper and do not pollute the primary session. Overuse is discouraged because sub-agents consume many tokens and a single helper error can make the overall output chaotic.
Example: Analyzing a New Vulnerability
New CVE entries appear daily. Some affect all Linux distributions or all Windows versions and trigger widespread concern. A security specialist is given the identifier and asked to assess the risk quickly. The standard workflow involves reading the description and severity rating, locating a public exploit or proof-of-concept, understanding its operation, determining detectable traces in telemetry, and identifying patches or mitigations.
This sequence can be delegated to an agent. Given a CVE number, the agent searches open sources and returns a summary covering affected systems, exploit availability, detection methods, and recommended actions. When such requests recur, they are packaged into a reusable skill. The agent can be instructed to generate the skill itself, after which the user reviews and refines it. If an asset database with software versions exists, it can be connected via a skill or MCP so the agent immediately lists vulnerable hosts.
Where AI Makes Mistakes
Models answer confidently even when incorrect. Hallucinations cannot yet be eliminated entirely, so plausible nonsense must be distinguished from accurate results. A frequent pattern is an agent repeatedly declaring critical vulnerabilities. Counter-questions help: Is the issue actually exploitable? How can the finding be verified manually? Provide a minimal proof-of-concept. Most claimed discoveries fail such checks. Important conclusions should be validated two or three times, preferably with different models.
Agents work faster than humans yet may overlook important details. In one documented case, a specialist and an agent examined the same file in parallel. The agent finished first but missed a second executable hidden inside the first file, which the human discovered. AI is useful when the user understands what to delegate and what to verify afterward.
How to Avoid Harming Yourself or the Company
Agents request permission before executing commands, but users rarely read them line by line. Eventually an agent will ask to run a large script and the user will approve. Therefore agents should not run on work laptops. Use a virtual machine, Docker container, or isolated machine without corporate accounts. Some agents include hooks that mechanically block dangerous actions such as file deletion.
Confidential and personal data should not be sent to cloud models. Providers may claim they do not train on queries, yet verification is impossible. Free aggregator models are likely to collect data. LLM gateways can mask tokens, passwords, and personal information before transmission, reducing but not eliminating risk. Account suspension is another concern; some providers are wary of cybersecurity use cases and may ban accounts, including those from Russia. Responsibility for the agent’s actions remains with the person who launched it.
What AI Will Not Replace
Tasks performed strictly according to instructions will eventually be automated. The professional who uses neural networks will replace the one who does not. Foundational knowledge of network protocols and operating systems remains essential because compatibility depends on them. When an agent encounters an unfamiliar problem, the user must fall back on personal expertise. AI multiplies existing skills but does not create them from nothing. The human retains responsibility for deciding the next investigative steps and for the final result.
Getting Started
- Install one agent inside a virtual machine and create an instructions file for it.
- Solve CTF challenges both manually and with the agent, then compare outcomes to identify model errors and human strengths.
- Select a recurring task and build the first skill for it.
Materials from the Engineering October collection, which includes four AI workshops plus access to SOC Analyst, Information Security Engineer, and Penetration Testing Fundamentals courses, provide practical demonstrations on real tasks.
Related articles
NYU Researchers Find 86% of Chatbot Responses on Digital Abuse Contain Errors, Gaps or Safety Risks
A study by New York University’s Tandon School of Engineering examined four chatbots answering 193 questions about spyware, location tracking, and account control. Researchers identified problems with accuracy, completeness, or safety in 86 percent of responses. Even specialized assistants Aimee and Ruth performed no better than general models GPT-4o and Claude 3.7 Sonnet. Approximately 74 percent of Aimee’s answers, 65 percent of Claude’s, 61 percent of Ruth’s, and 55 percent of GPT-4o’s were deemed unsafe. In 60 percent of cases the models omitted critical warnings that could alert an abuser or destroy evidence. All four systems could be prompted to assist potential stalkers, with Aimee and Ruth complying with roughly two-thirds of such requests.
Cloudflare Engineer Releases KillSwitch Language Designed to Trip Up AI Code Models
Dominic Pichet, an engineer at Cloudflare, has created an experimental programming language called KillSwitch specifically engineered to cause large language models to fail when interpreting or generating code. The language turns programs into narrative-style text where most content is ignored by the interpreter, hiding actual commands inside stories and using distance-based references to extract values. Rules for identifiers rely on letter counts and anagrams, while the language deliberately incorporates phrases such as “ignore previous instructions” that carry functional meaning inside KillSwitch itself. Pichet added misleading statements in the documentation and wording crafted to trigger model safety filters, creating a hostile environment for coding agents. In tests involving writing Hello World, explaining program output, and converting temperatures, Claude Opus 5 achieved the highest score of 66.8 points. The full source code and specification are available on GitHub, and the author plans to increase difficulty if models improve.
Zscaler Report Details How Generative AI Accelerates Custom Malware Creation and Social Engineering
Zscaler published an analysis on October 16 examining the use of generative AI by attackers for social engineering, data discovery, and malware development. Principal security researcher Phil Hagen notes that the report focuses on broad methods rather than naming specific malware families or confirmed campaigns. The core observation centers on the dramatically increased speed at which malicious scripts can be written and iteratively revised. Traditional detection that relies on matching files or traffic against known patterns loses effectiveness when code is frequently altered while preserving the same functionality. The analysis clarifies that observed rapid creation and revision does not equate to fully autonomous self-mutating malware that changes on every execution. Another impact is the disappearance of classic indicators such as spelling and grammar errors in phishing messages, which previously helped identify malicious intent. Zscaler recommends focusing on behavioral analysis of what programs actually do rather than solely relying on matches to previously catalogued samples.
AI Agents Using Claude and Grok Fully Automate Attacks on 400 Latin American Financial Institutions
A Straiker investigation has revealed that the CyberCartel hacking group built an AI agent network driven by multiple large language models to conduct fully automated attacks against more than 400 Latin American banks and payment applications. The system incorporates models from Anthropic and xAI, with CrowdStrike confirming additional use of DeepSeek. The AI agents independently perform reconnaissance across hundreds of targets, steal credentials through adaptive techniques, take over accounts while mimicking human behavior to evade detection, and monetize stolen data with minimal human intervention. This development marks a sharp drop in attack costs, allowing scalable operations that were previously impractical due to high manual effort. Defenders are advised to deploy dynamic behavioral baselines, enforce zero-trust architectures, strengthen multi-factor authentication and transaction monitoring, and incorporate AI adversary simulations into red-team exercises. The report is described as one of the first detailed public records of such end-to-end AI-driven financial attacks.