The Evolving Role of the Red Team in the Era of Agentic Security

At Google, our Red Teams have always operated on the cutting edge of security. We’ve shared our journey in the past: from the high-stakes operations showcased in our Hacking Google series and how we do Red Teaming at scale, to meeting the team that hacks us, and the creation of Google’s AI Red Team. The core mission of our Red Team has always been to prepare organizations for real-world attackers.

That mission hasn't changed. But how the team achieves it is undergoing a profound transformation.

Artificial Intelligence (AI) is reshaping the information security landscape. While it equips defenders with powerful new capabilities, it also hands adversaries a formidable new toolkit. We are entering an era where autonomous attacks are executed by agents on behalf of threat actors. This shift represents a unique opportunity for Red Teams to deliver unprecedented value to their organizations.

The Agentic Shift: Sophistication, Scale, and Speed

Historically, scaling cyberattacks was limited by human constraints. The strategic incentive to adopt agents depends largely on what attackers stand to gain by scaling without being held back by human constraints. Highly targeted actors are hesitant to delegate critical attack chains to unpredictable AI agents. Doing so would introduce unnecessary noise and risk burning expensive tools or hard-gained access.

In contrast, groups operating at scale, such as ransomware operators and initial access brokers, have every reason to embrace AI automation. Because these cybercriminals value volume and speed above all, a slight loss in surgical precision is an incredibly cheap trade-off. For actors who already launch highly indiscriminate attacks against vulnerable targets like healthcare organizations, AI agents provide a massive boost to scale, speed, and overall operational throughput while drastically reducing human labor costs.

With this divergence in mind, we see AI altering the threat landscape across three critical dimensions:

• Sophistication is increasing: We are seeing a rapid democratization of offensive capabilities, as evidenced by many more vulnerabilities reported through bug bounty programs. Lower-tier actors lacking deep subject matter expertise can now more easily acquire weaponized zero-day vulnerabilities or leverage highly customized Tactics, Techniques, and Procedures (TTPs) that were previously strictly the domain of elite groups.
• Scale without extra human effort: Where mid-tier threat actors were once bottlenecked by the number of human operators they could deploy, AI significantly reduces the need for manual intervention, allowing attacks to be executed concurrently and at massive scale.
• Speed is approaching machine time: Dwell time – the window between gaining an initial foothold and moving on objectives – is collapsing. Agents parse network and system documentation to massively accelerate reconnaissance, meaning "security through obscurity" is largely dead. After gaining an initial foothold, AI agents can autonomously move on objectives so rapidly that even if a detection triggers, the agents often accomplish their goals before a human analyst has time to review the alert. We should also remember that all of the tooling and infrastructure being put in place for agents to operate efficiently in your environment equally benefit malicious agents.

While frontier AI labs are diligently building safety mitigations into their models to prevent abuse, the reality of the broader ecosystem is more complex. We anticipate that over the next 6 to 12 months, open-weight models will match today's cybersecurity capabilities of frontier models. Because these open models can be easily modified by malicious actors (through processes like "abliteration" to remove safety guardrails), defenders must prepare for a landscape where sophisticated AI tools are freely available to threat actors.

Predicting Malicious Agent Usage

Because this space is so new, concrete threat intelligence on exactly what real-world actors are building is currently limited. However, we have a crucial, albeit short, window of time to prepare before adversaries fully operationalize their own agents. Extrapolating from current trends, we can predict how threat actors will likely utilize agents for malicious purposes:

• Industrialized Social Engineering: AI makes creating and managing sock-puppet personas incredibly cheap. We expect to see highly personalized, long-con spear-phishing campaigns where an agent slowly builds trust with a target over time before finally dropping the hook.
• Automated Attack Chains: Attackers will leverage heavy automation to rapidly triage compromised hosts. We expect to see them using on-device AI models – avoiding the noise of sending large amounts of data over the network – to facilitate autonomous lateral movement.
• The Cheapening of Supply Chain Attacks: Historically, complex operations like the xz-utils backdoor required immense human effort and patience. AI makes executing these sophisticated supply chain compromises, as well as crafting malicious skill files for agents, much more affordable.
• Low-Cost Offensive Tooling: Custom attack tools and implants are now cheap to produce. Because vulnerability discovery is increasingly automated, attackers may show a higher risk tolerance for "burning" their toolkits.
• Exploiting Security Hygiene at Machine Speed: Software vulnerabilities aren't the only targets. Most organizations struggle with existing security hygiene issues: weak passwords, credentials left on disk, or over privileged accounts. Agents excel at instantly identifying these flaws and weaponizing them for lightning-fast lateral movement.

Leveraging the Defender's Asymmetry

The narrative so far seems to favor the attacker, however defenders hold structural advantages that we should leverage:

• Home-field knowledge. You know your environment. The strategic task is to instrument that knowledge before an adversary maps it faster than you have.
• The same tools, pointed inward. Every capability available to the attacker is available to you first — for detection, triage, and response. The side that operationalizes agents first sets the tempo.

The teams that lose won't be the ones with fewer resources. They'll be the ones who treated this as a future problem while their adversaries treated it as a present opportunity.

Evolving the Red Team

What does this mean for the role of a Red Team? In the past, Red Teaming meant conducting manual exercises to simulate actors of varying sophistication. Today, the biggest blind spot for defensive (Blue) teams is defending against threat actors utilizing agents.

Defenders are now grappling with difficult questions:

• Can we distinguish between the noise of legitimate AI agents used by our employees and malicious agents used by attackers?
• Are our detection pipelines close enough to real-time to catch malicious agents?
• Do our corrective controls block on humans-in-the-loop to take action?

The best way for a Red Team to prepare an organization for this future is to build its own Red Teaming agent that simulates the exact tools and techniques real-world attackers are developing.

The good news is that Red Teams don't need to build a fully autonomous, end-to-end agentic system overnight. The transition can be iterative.

Red Teams should start by leveraging AI to automate specific, isolated pieces of their classic manual exercises—whether that's reconnaissance, initial access, or lateral movement. Every time the team runs an exercise, they can develop new capabilities as modular "subagents." Additionally, by connecting the afore-mentioned modules via an orchestrator, the team would be able to run autonomous simulations of agentic attacks. After a handful of operations, the Red Team will have built a robust system capable of simulating end-to-end agentic attacks that gets better with every exercise.

We are in the early days of this paradigm shift. While the transition from manual to agentic attacks could happen rapidly, going from 0 to 100 very quickly, we have the time right now to get ahead of the curve. This is an incredibly exciting opportunity for Red Teams to set the terms of the fight against agentic attackers.