AI Is Attacking the Internet. Your SOC Needs a Control Tower

AI Is Attacking the Internet. Your SOC Needs a Control Tower

One weekend in July 2026, something moved through Hugging Face's infrastructure.

It came in through a poisoned dataset. It ran code on a processing worker. It escalated to node-level access, collected cloud and cluster credentials, and moved from one internal cluster to the next. Hugging Face later counted more than 17,000 recorded events.

Then Hugging Face published its incident report, with the line every security team now has to sit with. The intrusion was "driven, end to end, by an autonomous AI agent system."

Nobody was at the keyboard.

Attackers run on AI. Most SOCs still run on people.

Hugging Face wasn't the first sign. It was the loudest.

In September 2025, Anthropic caught a state-sponsored group pointing Claude Code at about thirty organizations. By Anthropic's account, AI did 80 to 90 percent of the campaign, sending thousands of requests, often several per second. People stepped in only now and then.

In October 2026, Reuters reported on one attacker who ran an army of AI agents on Cairn, an open-source agent framework. The agents broke into more than 100 company websites. Each successful break-in took about 23 hours. The researcher who found it, at the security firm NorForge, put the cost at about $50 in AI tokens per intrusion.

01One break-in

About $50

In AI tokens, per successful intrusion in the October 2026 campaign.

02Time to get in

About 23 hours

Per successful break-in, with no person at the keyboard.

03Time to fix

43 days

Median time to fully patch a vulnerability, per Verizon.

Put those side by side. Getting in costs about as much as dinner for two and takes a day. Closing the door takes six weeks.

The shift shows up three ways.

Speed. VulnCheck counted 495 newly exploited vulnerabilities in the first half of 2026, and 23.43 percent were exploited on or before the day their CVE went public. Verizon's 2026 report found that exploiting a vulnerability is now the most common way breaches start, ahead of stolen credentials.

Scale. Reconnaissance and phishing used to cost a person's time, so attackers picked their targets. Now an agent writes a personal lure for every employee and scans every endpoint you own, all night.

A new way in. Your own AI is now part of the attack surface. Prompt injection, poisoned tools and data leaking through LLMs and MCP servers are routes that didn't exist three years ago. Hugging Face was breached through a dataset.

What AI attackers already do

None of this is speculation. Every method below is documented in public reports from Anthropic and Google's threat intelligence team, which has also seen malware that asks a language model to rewrite its own code while it runs.

And here's the part most coverage misses. VulnCheck also looked at 1,061 vulnerabilities credited to AI-assisted discovery. Only 14 of them, 1.3 percent, have been exploited in the wild.

So AI didn't give attackers magic. It made trying cheap. A person picks targets and gets tired. An agent works the whole list, every endpoint, every forgotten subdomain, every leaked key, for the price of the tokens.

The attacker doesn't need a better key anymore. It tries every door.

Systems change every day. The SOC still works alert by alert.

Now look at how most security teams defend.

The deeper problem isn't any single row. It's that every tool watches its own slice. The scanner doesn't know what the pull request changed. The alert doesn't know what last month's test found. The analyst who knew why that service account exists left in March. That worked when the attacker was a person who needed sleep and tried one door at a time. It doesn't hold up against agents that try all of them at once.

The AIOps Control Tower

Think of your company as a fortress that never stops building. New code ships every day. New services open new doors. The walls are never finished.

You can't defend that by hiring more guards. You defend it by putting the right agent at every post, and your engineers in the tower.

01Continuous

Software delivery

Releases keep shipping. Every one passes the gate.

02At the gate

Review

Every change checked before production.

03On the towers

Cyber

Every release tested. Only proven risk reported.

04On the walls

SOC agents

Every alert investigated, with evidence.

05On duty

SRE agents

The team acts on a verdict in minutes.

06In the tower

Your engineers

They approve and act.

That's the AIOps Control Tower. CloudThinker builds it from Frontier Investigation Agents: AI agents that investigate what happens in production, find the cause and propose the fix for your team to approve. Agents carry the volume. Engineers make the calls.

One loop, every attack

The tower runs one loop, and every case feeds the next.

01Prevent

Review and Cyber

Risk fixed before release.

02Detect

SIEM and agents

What rules miss, caught.

03Investigate

Resolve for SOC

Every alert, a verdict.

04Respond

Your team

One approval, in minutes.

05Learn

Memory

Sharper every day.

Attackers use AI at every step. Now you answer with AI at every step too.

Prevent: Review at the gate, Cyber on the towers

Plenty of holes start as an ordinary change merged on a Friday afternoon, and more code than ever is written by AI assistants and merged on trust.

Review checks every change before production. It reads the diff, the linked ticket, your team's convention files and, if you keep one, a BUSINESS.md that says which rules your product must never break. So a new handler that returns an invoice by ID without checking whose invoice it is reads as what it is: a broken rule, flagged with a severity and a suggested fix before it merges. Cyber's Code Audit follows the branch too, flags exposed secrets and watches dependencies for new library advisories.

Cyber is our Frontier Security Agent. It hacks you before hackers do: it tests your running apps and APIs the way an attacker would, with test users in different tenants so it can ask the question scanners can't. Can one customer read another customer's data? When it can reproduce a problem, the finding is Confirmed, with the exact request and response attached. Illustrative:

GET /api/invoices/2207 HTTP/1.1
Host: staging.billing.example.com
Authorization: Bearer <tenant-b-test-user>

HTTP/1.1 200 OK
Content-Type: application/json

{"id": 2207, "tenant": "tenant-a", "amount": 1840.00}

Every request is well formed, so no signature matches it. That's broken access control, number one on the OWASP Top 10:2025. What Cyber only suspects, it labels Needs verification. What it proves, it drafts a fix for as a pull request, then replays the proof against the merged change. In our own published test on OWASP Juice Shop, one black-box run confirmed 38 vulnerabilities in 27 minutes for about $57.

Detect: your SIEM, connected

Your SIEM stays. CloudThinker connects to it alongside your cloud, identity, endpoint, network and app sources, so every alert lands in one place and goes straight to investigation. Detection rules become code: written, tested and mapped to MITRE ATT&CK, so you can see where your coverage has gaps. Agent detectors watch for what static rules miss: low-and-slow activity below every threshold, odd patterns, and things that quietly stop working.

Investigate: every alert, a verdict with evidence

This is where most SOCs drown, and where the tower earns its keep.

Resolve for SOC takes each alert from your SIEM, EDR or cloud and works it the way your best analyst would. It checks identity, network, endpoint and cloud logs, and it looks for similar past cases. Then it reaches a verdict: real threat or normal business, with the evidence and the blast radius. A false positive is closed with the evidence written down. A real threat arrives with a plan.

Respond: your team makes the call

Your engineers get a confirmed root cause, what's affected and what isn't, and fix steps ready to apply. They review, approve and act. On the public SREGym benchmark, CloudThinker is one of three agents to score 100 percent end to end, diagnosis and mitigation. Amela, a software company running on AWS, went from hours to under 30 minutes from alert to root cause and a validated fix.

Learn: every case makes the next one faster

Evidence, verdicts, fixes and analyst feedback go into company memory. Detections get tuned, so false positives fall. Runbooks stay current, drafted by agents and reviewed by engineers. Similar alerts resolve from memory. And Automation turns the follow-up work, patching, key rotation, hardening, into runs on a schedule or an event, so known gaps close without anyone having to remember.

The knowledge that used to leave with people stays with you.

One attack, four minutes

Here's one of the most ordinary AI attacks there is, from a fintech customer. An AI-written phishing page steals an admin's login, then floods the admin's phone with MFA prompts until one gets approved.

0102:10

Attack

A phishing page steals an admin login. 14 MFA prompts follow.

0202:14

Detect

Impossible travel: two countries, 24 minutes apart.

0302:14

Investigate

Sign-in, email, HR and audit logs. Four sources in 45 seconds.

0402:16

Root cause

Phishing email, approved MFA prompt, account takeover.

0502:18

Access denied

Sessions revoked, MFA reset, sender blocked. One SOC approval.

Alert to containment: four minutes. Human step: one approval.

The same customer saw a different 3 a.m. alert: 48 GB leaving the customer database. It checked the scheduler, the flow logs, the storage target and recent changes, found the nightly backup going to the company's own encrypted storage, closed the alert and tuned the rule. Two minutes. Nobody was paged.

That's the other half of the job. A tower that cries wolf gets ignored. This one investigates every alert, and it only wakes you for the real ones.

Engineers in the tower

Speed without control is just a different risk, so the tower answers to you.

Every change goes through Auto Mode, so you decide what runs on its own and what waits for approval. Your SOC and CISO set the policy and the autonomy, approve high-impact actions, and own the risk decisions. Agent commands run in CloudThinker's Sandbox. Secrets and personal data are swapped for placeholders before they reach the model, so the model never sees the real value. Cyber only tests domains you've proven you own, inside the scope you set.

And every action is on the record. When an auditor asks who changed what and why, or your board asks what happened on Tuesday night, the answer is already written down.

What the tower won't do

I'd rather you hear the limits from us.

• It won't see what it can't reach. Cyber tests apps on domains it can reach. Internal and VPN-only apps are out of scope today.
• It won't test production for you. Anything above the Safe intensity sends writes. Point those runs at staging with test accounts.
• It won't replace your SIEM or EDR. They keep detecting. CloudThinker investigates what they find and takes the next step.
• It won't make you unbreachable. Nothing will. It shrinks the window between a door opening and a door closing.

One more thing

You don't have to take any of this on faith.

The Security Risk Assessment is free. You connect one read-only role, which takes about fifteen minutes. Agents map what an attacker can see, safe checks prove what's actually exploitable, and a security engineer walks you through it in a 30-minute readout. You get the report the same day: an attack-surface map, proven findings with the evidence attached, and fix plans for your top three. No obligation.

If you run a SOC, ask us for a 14-day replay instead. We connect read-only, replay your own recent alerts, and you judge the verdicts yourself. And when you're ready for the whole tower, Frontier Governance for Cyber Defense shows how Review, Cyber, Resolve and Automation work together under one set of rules.

Or just ask CloudThinker:

"Investigate last night's GuardDuty findings and tell me which ones touched production."

"Run a Safe test on staging.example.com and show me only what you can prove."

"Every Monday, check our repositories for leaked keys and prepare a rotation for anything you find."

Somewhere tonight, an agent is working down a list of websites. It doesn't know your name, and it doesn't need to. It needs one open door.

Every alert, investigated. Your team makes the calls. Make sure your tower sees it first.

Questions people ask

What is an AIOps Control Tower for SOC?

CloudThinker's AIOps Control Tower is end-to-end AI security operations for the era of AI-powered attacks. It puts an AI agent at every post: Review checks every code change before production, Cyber tests running apps and APIs and reports only proven risk, Resolve for SOC investigates every alert to a verdict with evidence, and company memory makes each case faster than the last. Engineers stay in the tower and approve high-impact actions.

How do you defend against AI-powered cyber attacks?

Match the attacker at every step. AI lets attackers scan, phish and try leaked keys at machine speed for a few dollars, so a yearly pentest and an alert queue that waits for morning are too slow. Fix risk before release, test exposure on every release, investigate every alert in minutes, and keep people in charge of high-impact actions. CloudThinker runs this as one loop: prevent, detect, investigate, respond and learn.

What is an AI SOC analyst?

An AI SOC analyst is an AI agent that investigates security alerts the way a human analyst would. It checks identity, network, endpoint and cloud logs, compares similar past cases, and returns a verdict with evidence. CloudThinker's Resolve for SOC does this for every alert from your SIEM, EDR or cloud, closes false positives with the evidence written down, and brings real threats to your team with a plan.

Does CloudThinker replace a SIEM or EDR?

No. Your SIEM and EDR keep detecting. CloudThinker connects to them, investigates what they find, and proposes the next step for your team to approve.

How fast can CloudThinker contain an attack?

In one fintech customer's production case, an AI phishing attack that led to an account takeover was contained four minutes after the alert: sessions revoked, MFA reset and the sender blocked, with one SOC approval.

How can I try CloudThinker for security?

Start with the free Security Risk Assessment: connect one read-only role in about fifteen minutes and get proven findings the same day. SOC teams can ask for a 14-day replay on their own recent alerts, read-only, and judge the verdicts themselves.

Sources

• Hugging Face, Security incident disclosure, July 2026
• Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, November 2025
• Google Threat Intelligence Group, Threat actor usage of AI tools, November 2025
• Security Boulevard, the NorForge findings reported by Reuters, November 2026
• Help Net Security, Verizon 2026 DBIR findings, May 2026
• VulnCheck, State of Exploitation 1H 2026, July 2026
• OWASP, Top 10:2025