How AI agent orchestration, local models, and frontier-model escalation let one operator scale offensive security work.
Humans can only do so much.
Advanced Persistent Threat. When we hear those words, we think of resources. People reconing. People developing tooling. People managing infrastructure. People finding and exploiting vulnerabilities.
And even when we imagine the lone, super skilled attacker, there’s still one limitation humans face…
Humans have a finite number of hours.
What if one super skilled hacker could delegate code review, recon, data processing, exploit development, infrastructure management, and validation to an AI team that doesn’t sleep?
Well, in the spring of 2026 Anthropic discovered just that… a French-speaking threat actor targeting European think tanks, media organizations, political parties, and even the software vendors that support those targets using AI agents (subagents to be exact) to recon, code review, and validate other AI models findings.
Claude helped them develop/debug a novel WordPress exploit (previously undocumented)
Agents autonomously probed WordPress endpoints, developing/debugging exploits, and discovering novel vulnerabilities
Developed custom tools when needed
Installed backdoors/persistence
Exfiltrated databases and mailboxes
Intercepted credentials
Built a search tool to search exfiltrated data (tens of millions of records)
And yes, Anthropic tracked 42 targets… at least 14 had internal access gained…
All this tooling, exfil, pivoting, exploitation, and even a privacy attack platform… Anthropic stated was created by one person.
My prediction… we’ll see a real One Person APT within the year. And it’ll be nasty.
The System Is the Team
Now… before you start envisioning a giant AI hacking away autonomously in a terminal… there’s an important detail here.
The human directs. They pick targets. They decide what’s important. They create the platform to exfiltrate/process all that data.
And under that? Specialized AI agents doing recon, processing data, triaging, reviewing code, validating each other’s work…
This isn’t hypothetical. Microsoft has detailed how their multi-model agentic vulnerability research system (MDASH) uses over 100 specialized AI agents (a mix of distilled and frontier models) to analyze code, hunt for vulns, validate, etc. Recently, this system found 16 vulns in Windows networking/authentication software (4 critical RCEs).
MDASH isn’t just throwing everything at one behemoth model and hoping for the best. Different models play different roles (frontier as the expensive heavy reasoner, distilled models for high volume debate/validation, a separate frontier model to provide counterpoints, etc), use different tools/prompts/stopping conditions, etc. As Microsoft so succinctly stated,
“The model is one input. The system is the product.”
Your Laptop Hired a Red Team
Which means if you’re envisioning a One Person APT… don’t just envision one big AI hacking autonomously. Envision a human directing operations at the top. Envision a frontier model serving as their expensive analyst/helper/planner/code analyzer/ad-hoc situation solver. And then under that… envision teams of AI workers (recon, triage, code review, validation, output processing, etc). Envision hierarchy.
And the good news is, you don’t even have to envision it anymore. That’s because there are frameworks (like CAI) which can help you orchestrate complex agentic workflows (specialized agents, agent handoffs, hierarchical/swarm/parallel structures, mixing models, etc).
And yes… it even supports running agents powered by your own models with Ollama.
So envision this: you have a frontier model orchestrating the overall workflow. But then you have 10 enumeration agents running locally on your machine. 5 code review agents running locally. Another set of agents locally triaging information. Yet another agent locally validating the work of other agents.
Of course there are limits to what local models can do. But they don’t need to be the smartest model on Earth. They just need to be good enough, relatively cheap, persistent, and tireless.
Watch the project demo: PentAGI overview, linked by VXControl in the official repository.
Anthropic even called out this PentAGI offensive agent framework (which also supports Ollama) by name recently, saying that it and other similar open source projects replicate many aspects of the “sophisticated” autonomous offense systems they’ve encountered (and yes… some threat actors were using PentAGI or derivatives of it).
So yeah… if you’re envisioning a One Person APT in the future… envision hierarchy. Envision teams. Envision systems… not just one model.
Big Brain, Cheap Hands
Earlier this year, a developer pointed an 8-billion-parameter model at a CTF challenge and let it loose on a target.
Running locally on a single RTX 5090 with no access to frontier-model APIs, the little model autonomously explored the target for around fifteen minutes. Enumerating endpoints, inspecting security headers, trying multiple attack strategies, adjusting course after dead ends, and finishing with a structured vulnerability assessment.
It did not capture the flag. 😵
That’s the part worth sitting with, because it lines up exactly with what we’d expect from a smaller model: strong at enumeration, persistence, and procedure, but weak when a problem calls for a flash-of-insight step.
Now put that behaviour inside a hierarchy.
Run that model for fifteen minutes, or twenty instances of it in parallel. Enumerate. Triage. Gather evidence. Cut off dead ends. Summarize. Escalate the one weird anomaly that warrants deeper thought.
Only then do you spend your frontier-model inference.
Cheap hands do the grunt work; big brain handles the interesting anomaly.
Conceptual routing for authorized testing. Escalating to a stronger model does not expand the agent’s permissions.
This isn’t just my aesthetic, it reflects where the research is heading. A 2026 study of pentesting agents found that model quality does matter, but the residual losses concentrate in planning, state management, and attack-path allocation; by restructuring the architecture around the models they pushed CTF-benchmark completion to as much as 91 percent and took over four of five machines in a simulated Active Directory lab.
Same model family; better surrounding machinery; materially better outcomes.
Read the research: What Makes a Good LLM Agent for Real-world Penetration Testing?, Deng and colleagues. The results come from CTF benchmarks and a simulated Active Directory environment, so treat them as lab performance rather than a production compromise rate.
The through-line keeps recurring: architecture.
Try it yourself
Pick a toy codebase you control, a deliberately vulnerable lab, or a CTF box, and run three narrow agents against it — one recon, one code review, one verification-only — then run the same target through a single generalist agent. Compare coverage, duplicate findings, time wasted, and false-positive rate.
Local brains for throughput, frontier brains for judgement. That’s the shape of it.
For the containment side of long-running work, see Let It Run: Agent Loops You Can Walk Away From.
The Scarce Resource Is Becoming the Human
Historically, offensive scale tracked pretty linearly with headcount. More recon meant more hands doing recon. Another reviewer meant another human reviewer. Ten concurrent operations meant, at some point, confronting the inconvenient fact that people are only so many people.
That coupling is fraying. Anthropic’s September report on AI-enabled threat actors documented campaigns against multiple victims that a year ago would have demanded a team being carried out by noticeably leaner crews, with AI folded into reconnaissance, exploitation, post-exploitation tooling, data wrangling, and overall orchestration.
My read of where this lands: the uncomfortable scenario isn’t a single omniscient hacking model. It’s a single skilled operator who delegates most of the labor, and manages the parts that still need judgement: picking targets, sanity-checking surprises, unblocking stalled agents, spending expensive inference where it pays off, and routing everything else to the cheaper tier.
Before unleashing a swarm:
For the ownership behind those decisions, see The Agent Made the Call. Who Owns the Outcome?.
Are the agents constrained to the engagement and task you actually sanctioned?
Can any of them exfiltrate data, persist, pivot, or touch credentials beyond their remit?
Is escalation to your expensive model logged with the triggering reason?
Is there an independent verifier for critical-severity claims before they become “real”?
Can you audit every consequential step back to the actor — model, tool, or human — that authorized it?
Each layer compounds: cheaper local inference, smarter frontier models, smoother tooling, better planning and memory. None of those has to mature uniformly for the whole arrangement to start biting.
That’s also why “one-person APT” is the formulation I keep circling back to. The bottleneck in advanced cyber operations may stop being how many skilled operators you can field, and start being how much automated work a single operator can effectively direct.
