When Autonomous AI Attacks a Segmented Network

Publisher preview

- What did Zero Networks’ autonomous AI attack experiment test? In August 2026, Zero Networks tested how far an autonomous AI attacker could spread after compromising a single machine. The experiment showed that an AI attacker could not move laterally to compromise segmented assets, even when it was given additional credentials, internet access, and broad permission to use offensive tooling. - What did the lab environment include? The lab was built to resemble an enterprise estate: Linux, Windows, and macOS endpoints and servers, Kubernetes clusters, databases, web infrastructure, directory services, internal DNS and PKI, file shares, and CI/CD components. Zero Networks segmentation protected the estate, with one Windows host, ESTI, intentionally left unsegmented as a validation control. - What attack techniques did the AI agent use? Claude Code attempted roughly 18 attack approaches with 23 tools, covering about 22 MITRE ATT&CK techniques. These included Active Directory discovery, Kerberoasting, AS-REP roasting, delegation abuse, local privilege escalation, Windows credential extraction, Pass-the-Hash, Pass-the-Ticket, password cracking, and host-firewall manipulation. - What were the results of the experiment? Claude Code gained local administrator access, extracted credential material, and planted the proof file on the unsegmented control host only – it was unable to reach protected systems. In some cases, the AI attacker stopped when it realized the network was protected by Zero. That result confirmed the agent was capable of a successful attack when a reachable path existed, but segmentation created a containment boundary that couldn’t be bypassed.

A saved ApplyDjinn digest is not available for this story yet.

This preview is supplied by the publisher. The complete publication remains at its original source.