Photo by Ales Nesetril on Unsplash
Most of the conversation about AI and cyber attacks has focused on criminals using AI tools to write more convincing phishing messages or generate malicious code faster. That threat is real. But something more significant has emerged recently, and it deserves a direct conversation rather than being bundled in with the usual AI scare stories.
Security researchers have publicly demonstrated AI agents that can handle multiple stages of an attack independently. Finding an exposed service. Probing it for known weaknesses. Working out how to exploit what they find. Attempting to move deeper into a network. All without a human directing each individual step. That is a different kind of capability to AI helping a criminal write better emails, and it matters in a practical way for any business running systems connected to the internet.
We have written before about how criminals use AI tools in their attacks. This is the next step along that path, and it is moving faster than most people outside security research circles realise.
What makes an autonomous AI attack different
When a criminal uses an AI tool to help craft a phishing message, a human is still making the decisions at every stage. They choose the target, review what the AI produces, and decide what to do with it. Autonomous AI agents are different because they chain steps together without that human check at each point.
Think of it as the difference between a criminal who uses a calculator to do maths faster and a criminal who hands the entire job to a system that figures out what maths needs doing, does it, and acts on the result. The first is faster. The second is fundamentally different in how it scales.
To be precise about where this currently sits: the demonstrations of this capability have come from legitimate security researchers testing what AI systems can do. Criminal toolmakers are not the same as academic researchers. But the history of security research is consistently clear on one point: the gap between a documented capability and a tool available in underground markets has been narrowing for years. What researchers demonstrate publicly, others replicate privately.
Why small businesses end up in the crosshairs
Large organisations attract more press attention when something goes wrong, but they also invest far more in staying protected. Dedicated security teams, continuous monitoring, fast response capabilities. Small businesses rarely have any of that. What they do have is the same software, the same operating systems, and many of the same vulnerabilities as bigger organisations.
Automated scanning tools do not skip small businesses because the reward seems modest. They just scan. A small accountancy firm or a regional manufacturer with unpatched systems and loosely configured accounts is a viable target regardless of its size, because the work of finding and testing that vulnerability now costs an attacker very little effort.
The businesses most exposed to this kind of threat tend to share a few characteristics. Software and systems that are not kept current with security updates. Staff accounts with wider access than the actual job requires. No monitoring in place to catch unusual activity before it becomes a serious incident.
What to actually do about it
The practical response to autonomous AI attack capability is not exotic or expensive. It is the same set of security fundamentals that protect against opportunistic attacks of any kind. What changes is the urgency of actually having them in place, because the window between a vulnerability appearing and something automated probing for it has shortened considerably.
Patch consistently, not occasionally
An AI agent scanning for known vulnerabilities cannot exploit one that no longer exists. Patching is the single most effective thing a small business can do to reduce its exposure to automated attacks. The challenge is that it requires consistency rather than occasional attention, which means it tends to slip in busy periods. Automated patch management removes that reliance on someone remembering to do it and makes consistent patching a process rather than a task.
Limit what each account can actually reach
If an attacker, or an AI agent operating on their behalf, gains access to one account, the privilege level of that account determines how far they can go from there. An account that can only access what the role genuinely requires is a much narrower foothold than one with broad administrative rights across a system. Reviewing and tightening account privileges is one of the most straightforward ways to reduce the damage that any successful breach can do. Privilege elevation management gives staff access to what they need, when they need it, without leaving permanent wide-open access in place.
Find your own gaps before something else does
Automated tools scanning for vulnerabilities are doing exactly what a vulnerability scan does, except the scan works for you rather than against you. Running regular vulnerability assessments means you are identifying weaknesses on your own schedule rather than discovering them at the same moment as something that just found them and is deciding what to do next.
A sense of proportion alongside the action
This is not a prediction that every UK small business will face a sophisticated autonomous AI attack before the end of the year. It is an observation that the capability is real, that it is advancing, and that the businesses best placed to handle it are those who have already dealt with the basics. Patch management, account privilege limits, and visibility into your own vulnerabilities are not advanced defences against a futuristic threat. They are table stakes for being connected to the internet in 2026.
If you are not certain where your current gaps are, a vulnerability assessment is a sensible starting point. It gives you a factual picture of what is exposed, which makes every subsequent decision about where to focus your security spending considerably easier. Get in touch to find out what that looks like for a business of your size.