An Agentic Attack Has Five Steps.
You Need One.

An agentic attack runs in five steps, and the attacker has to win all of them. A defender only has to notice at one. Here are the five steps, drawn from the first documented AI-orchestrated espionage campaign, and where a defender’s best chances sit.

The five steps

1. The jailbreak. The attacker has to get the AI to cooperate. In the documented 2025 campaign, the group broke the work into small, harmless-looking tasks and told the AI it was doing authorized defensive testing. Who catches it: the AI provider, mostly. Defenders can raise awareness but cannot see it.

2. Reconnaissance. The AI inspects the target’s systems and picks out the highest-value databases. Anthropic reported the AI did this in a fraction of the time a human team would need. Who catches it: network and exposure monitoring, if the scans are visible.

3. Exploitation. The AI finds weaknesses and writes its own exploit code to test them. Who catches it: vulnerability management, patching, and endpoint detection.

4. Credential harvesting and escalation. With a foothold, the AI gathers usernames and passwords, identifies the most powerful accounts, and creates backdoors. Who catches it: not a login-time control, which the attacker has already passed. Only a check on the person inside the session.

5. Data extraction. The AI pulls out private data and sorts it by value. Who catches it: data and network monitoring, often after the fact.

What the scale looked like, and the caveats

The campaign targeted roughly thirty organizations and succeeded in a small number of cases. Anthropic estimated the AI performed 80 to 90 percent of it, with humans needed at perhaps four to six critical decision points. At its peak the AI made thousands of requests, often several per second. That is a pace no human team could match.

Two honest caveats from the same report. The AI sometimes invented results, such as credentials that did not work. And humans still directed it at key points. Neither changes the direction: the cost of attempting a sophisticated attack has dropped.

Why steps four and five are the best place for a person-based check

By step four, the attacker is inside, using valid credentials in a live session. Everything built around the login has already passed. Two assumptions behind most controls have broken: that the attacker moves at human speed, and that a human is behind each action.

This is where Mimoto fits. It does not claim to stop the jailbreak, the scanning, or the exploit. Those belong to other tools. Mimoto works once an attacker or an agent is operating inside a session. It checks continuously whether the session is a real human and the right human, from how the person types and moves, how they use their apps, their device and connection, and the context of the session, using advanced pattern matching and anomaly detection. It never captures what someone types. When the session stops matching, Mimoto recognizes it and responds in real time, through native enforcement and signals to the SIEM and other SOC tools you already use, ahead of the data leaving.

A practical read of your own chain

1. For each of the five steps, write down which tool or team would notice.
2. Mark the steps where the honest answer is “nothing until after the damage.”
3. For steps four and five, ask what would tell you, during the session, that the person using a valid credential is not the person it belongs to.