Agentic AI
,
Black Hat
,
Events
Google’s Hultquist on Autonomous Attacks and Behavioral Defense
Artificial intelligence is giving cybercriminals the speed, scale and autonomy to run operations with less human oversight, said John Hultquist, chief analyst at Google Threat Intelligence Group.
See Also: Know Thy Enemy: Threats to Cyber Resilience
Threat actors have moved beyond using AI to create phishing emails and fake content. They now use models during intrusions to navigate networks, select attack paths and automate technical tasks. Agentic AI can carry out those actions independently, enabling criminals to expand operations through stolen or low-cost access to AI services.
This shift also challenges signature-based defenses. Attackers can use AI to rewrite malware, alter recognizable elements and reduce the value of indicators built from repeated behavior. Security teams will need to place greater emphasis on behavioral detection and use AI to identify unusual activity across networks.
“We’re not just talking about a smarter threat actor. We’re talking about a threat actor who can essentially walk away from the desk and let their operations run on their own,” Hultquist said.
In this video interview with ISMG at Black Hat USA 2026, Hultquist also discussed:
- How criminals use stolen AI access to scale cyber operations;
- Why AI-generated malware variants weaken signature-based defenses;
- How defenders can use AI for behavioral detection, vulnerability discovery and malware analysis.
Hultquist leads threat analytics at Google Threat Intelligence Group, having come to Google through its acquisition of Mandiant. He has more than 25 years of experience in intelligence and special operations, principally covering emerging threats in cyberespionage. His team found and first publicly exposed the Russian threat actor best known as Sandworm. Hultquist is the founder of CYBERWARCON and SLEUTHCON, and he teaches at Johns Hopkins University. He is also a U.S. Army veteran.
Click Here For The Original Source.
