The AI picked the targets. People did the breaking in.

The reference list on a CVE record is usually vendor advisories and a patch note. On CVE-2026-33824, a Windows remote code execution flaw CISA gave federal agencies until August 21 to fix, NVD also cites a Unit 42 report about an autonomous AI attack campaign [2][4].

That is not where you expect to find one, so I went and read it.

What is in the report is genuinely new. What is in the headlines about it is not quite what the report says.

What happened

Unit 42 published an analysis on July 30, 2026 of a campaign run by a Chinese-speaking operator who wired a commercial reasoning model into an agent framework and pointed it at the internet [1]. The agent had terminal access, a Telegram channel for commands, and a set of custom skills.

Working from a single instruction, it enumerated targets through an internet-wide scanning service, searched public code hosting for proof of concept exploits, ranked product families by severity and how widely they were deployed, and attempted exploitation. No human in the loop for any of that [1].

Then the interesting part. Unit 42 separates what the agent did unattended from what the operator did by hand, and the two columns do not read the same way.

The autonomous attempts failed. The agent went after Langflow and n8n, and Unit 42 records no success from those runs [1].

The confirmed compromises are all manual. A human operator using custom Python scanners and refined parameters got data out of three organisations through a NetScaler flaw, executed commands on eleven Marimo notebook instances, and established reverse shell callbacks against three endpoints through CVE-2026-33824, the Windows IKE flaw [1]. Across both modes the actor attempted more than 460 targets.

The campaign came to light because the agent started a file server in its own working directory and left it reachable. That exposed configurations, API keys, exploit scripts, target lists, shell history and session logs [1]. Nobody caught this on a victim network. The automation published its own case file.

Why this matters

The headline claim is doing work the evidence does not support. An AI agent ran an attack chain end to end without a human, and the end of that chain was failure. Every compromise in the report has a person in it. That distinction matters because your response to “AI can now breach you unattended” is panic, and your response to “AI made target selection nearly free” is an exposure review. Only one of those is supported here, and it is the second.

What actually got cheaper is triage. The agent evaluated ten product families, enumerated 84 Langflow instances, and identified 647,017 n8n instances globally [1]. That is reconnaissance and prioritisation work that used to cost analyst hours per product, and it now costs a prompt. The scarce resource in opportunistic attacks was never the exploit, which is usually public. It was deciding which of a thousand public exploits is worth your afternoon.

The target list is almost entirely CISA’s. This is the part I did not expect, and I only found it by checking rather than reading. Of the eight CVEs named across the campaign, seven were already in the Known Exploited Vulnerabilities catalog when I looked, several of them since March [4]. The model prioritised by severity and deployment scale and converged on the list CISA publishes for free.

That is either reassuring or damning depending on where you sit. If your patching tracks KEV, this actor’s entire target set was on your list. If it does not, an agent that reads faster than you do is now working through the same public information.

Technical breakdown

The sequence below is the campaign shape, not a single intrusion. Steps one to four ran unattended. Five onward had a person driving.

The Windows flaw at the end of that chain

CVE-2026-33824 is a double free in the Windows IKE extension, ikeext.dll, triggered during reassembly of fragmented IKEv2 messages. Zero Day Initiative’s analysis describes the same heap allocation being freed twice, once during work item processing and again during cleanup [5]. It reaches over UDP 500 and 4500, needs no authentication, and executes in the context of the IKEEXT service, which is SYSTEM [5].

The scoping question is the one worth answering, because “affects all supported Windows versions” is true and close to useless. The extension ships everywhere. What decides your exposure is whether inbound UDP 500 or 4500 reaches the machine [5]. Microsoft’s guidance is the same: block those ports where IKE is not in use, restrict to known peers where it is [6].

Two things I checked that did not match

I ran every CVE in the report against NVD rather than trusting the summary. All seven resolve, and product and score match Unit 42’s figures exactly. One does not sit comfortably with the description around it.

CVE-2026-34486, the Apache Tomcat entry, is scored 7.5 with a vector of confidentiality high, integrity none, availability none. It is a bypass of the EncryptInterceptor introduced by the fix for an earlier issue [2]. A flaw with no integrity or availability impact does not produce a reverse shell. Unit 42 associates reverse shell attempts against nine Tomcat servers with this CVE [1], and those two statements do not fit together. The likeliest reading is that the attempts were made against Tomcat servers rather than through this specific flaw. I could not resolve it from the report, and it does not change the campaign’s shape, but it is the kind of detail that gets repeated as fact once it is in a summary.

The second is a live disagreement between two authorities. Microsoft’s advisory for CVE-2026-33824 still records exploitation status as No and rates it Exploitation Less Likely, which I pulled from the MSRC API on August 19, 2026 [3]. CISA added it to KEV the day before with a three day deadline [4]. Reporting noted Microsoft had not updated its advisory [6]; the API confirms it and adds the exploitability rating, which is the part that would actually shape a patch decision. If you rank patches by vendor exploitability ratings, this one told you to relax.

What defenders should do Monday morning

Immediate, within 24 hours. Determine whether inbound UDP 500 or 4500 reaches any Windows system from untrusted networks. Where IKE is not in use, block them. Where it is, restrict to known peer addresses [6]. Apply the April 2026 update if you have not [3].

Near term, this week. Take the campaign’s target list as a worklist, because it is a reasonable proxy for what opportunistic agents will try next: NetScaler, Langflow, n8n, Marimo, Tomcat, PAN-OS. Confirm your exposure for each and confirm your patch level rather than assuming. Then check your KEV coverage honestly, since that catalog described this actor’s choices better than any threat feed did.

Structural, this quarter. Run external attack surface discovery on your own ranges on a schedule and treat unexplained listening services as incidents. Assume the reconnaissance advantage is gone: anything internet-facing and enumerable will be enumerated promptly, by something that does not get bored. Then revisit any patch prioritisation that leans on vendor exploitability ratings, given one of them currently reads “less likely” for a flaw with a federal deadline attached.

Checklist

• Inbound UDP 500 and 4500 blocked where IKE is not used
• Where IKE is used, those ports restricted to known peer addresses
• April 2026 Windows update applied
• Alerting for IKE_SA_INIT traffic from non-peer addresses
• Exposure confirmed for NetScaler, Langflow, n8n, Marimo, Tomcat and PAN-OS
• KEV coverage reviewed against your actual patch state
• External attack surface discovery running on a schedule, against your own ranges
• Patch prioritisation no longer resting on vendor exploitability ratings alone

The word doing the most work is “autonomous”

There is a real finding in this report and it is not the one in the headline. An operator handed a model a task and it ran reconnaissance, triage and tool collection across hundreds of targets without supervision. That is a genuine change in the economics of opportunistic attack, and it deserves attention.

It also failed at the last step, every time, and a person had to finish the job.

The industry has a habit of pricing a capability at its most dramatic possible description and then building a response to that description. We did it with polymorphic malware and with fileless attacks, and both turned out to be real techniques wearing an oversized name. The cost of the oversized name is that defenders spend on the imagined version and skip the boring control that would have worked, which here is knowing what of yours is reachable from the internet and patching the list CISA already publishes.

If an agent can find your exposed NetScaler faster than your own team can inventory it, the problem worth funding is the inventory. That was true before any of this and the automation only shortened the deadline.