Attackers let an AI agent drive their break-ins at schools and colleges. It reached domain admin in 3 to 4 days

Kaspersky's researchers say they caught attackers using an AI agent to run real intrusions at educational organisations in Latin America and Africa, between September and October 2026. They published the findings on 2 November 2026.

What happened

The attackers used CyberStrikeAI, an open-source penetration-testing framework that bolts a large language model onto a command-and-control server. A human operator sets the goals. The model picks tools, writes the commands and reads the results. A small implant on the hacked machine just runs whatever it's told and reports back.

The AI lived on the attackers' server, not on the victims' computers. The implant itself made no calls to any AI service, so on the victim's side it looked like an ordinary remote-control tool.

How fast it moved

In one break-in Kaspersky pieced together, the attackers started by hand through a compromised SQL Server, spending nearly a day on reconnaissance and preparing tools. Then they waited two weeks. Once the CyberStrikeAI implant went in, persistence and local reconnaissance took about two minutes and mapping the domain took about five hours.

From implant to the takeover of domain administrator accounts took three to four days. The final run of moving between computers, collecting credentials and exporting a database took no more than an hour.

Same old tricks, just faster

Nothing in the toolkit was new. Kaspersky lists familiar steps: scheduled tasks and Run keys for persistence, credential dumping from memory and the registry, Kerberoasting, DCSync and Golden Ticket attacks with a renamed Mimikatz, and lateral movement over SMB and WMI. The model's job was chaining them together quickly.

Kaspersky's head of threat exploration said the attackers used an AI agent based on CyberStrikeAI "to carry out a full attack chain and adapt their next steps within compromised networks", but that well-configured security tools can still detect the techniques.

Who did it

Unknown. Kaspersky found Chinese-language comments in scripts but says that doesn't establish who the attackers are or where they are. It couldn't tie the activity to a known group or confirm that one operator ran all of the infrastructure. It didn't name the victims or their countries.

Our take

This is our opinion. The open-source agents built to test your defences are now being pointed at real ones. The upside is that the AI didn't invent new moves, so the old alarms still work: watch SQL servers that can reach the rest of the network, new scheduled tasks, and anything touching LSASS. But the gap between first alert and full takeover is shrinking, so somebody has to read the alerts out of hours too.