395 Organizations Breached by AI-Powered Attack Using Stolen Human Credentials

A coordinated attack leveraging autonomous AI agents has compromised 395 organizations worldwide, exposing a critical gap in enterprise security: most organizations allow AI agents to operate using shared human credentials without adequate identity controls or lifecycle management. The mass-exploitation campaign, documented by security researchers on September 9, 2026, deployed hundreds of AI agents built on large language models to exploit known vulnerabilities and harvest Active Directory credentials from victim networks.