Every arms race has a moment where offense and defense become the same technology. Gunpowder built walls and breached them. Radar detected bombers and guided them. Encryption protects secrets and hides attackers.
AI security just hit that moment. The same autonomous reasoning, tool use, and multi-step planning that power defense agents are, right now, powering attack agents. Same models. Same architectures. Same exponential improvement curve. The only asymmetry is that attackers get to move first.
I spent four years at Cloudflare watching the human-vs-machine traffic balance tip. In 2025, automated traffic crossed the majority threshold for the first time: 51% of all Internet traffic is now non-human. When machines generate the majority of traffic, your security model must be machine-first. AI agents accelerate this asymmetry dramatically.
Defense Is Real And Shipping
The agentic Security Operations Center is not a concept. It's in production.
CrowdStrike deployed seven production agents for autonomous security operations and reports near-total accuracy in detection triage, eliminating over 40 hours of manual analyst work weekly. Palo Alto Networks, Microsoft, and Google are all shipping agentic security tools of their own.
Anthropic just shipped Claude Code Security into research preview, and its early numbers are notable: the company reports 500+ zero-day vulnerabilities found in production open-source codebases, bugs that survived decades of expert review. The key is not the count. It is how it found them. Traditional static analysis matches code against known patterns. Claude Code Security reads a codebase the way a researcher does, tracing how data moves, understanding how components interact, catching the context-dependent vulnerabilities that rule sets miss. That is the thesis of this whole series applied to security: when the node has judgment, it finds things that lookup tables cannot. And notably, nothing gets applied without human approval, which tells you something about where even Anthropic's own confidence sits right now.
The direction is real. Agentic defense works. But it doesn't work fast enough.
Offense Is Accelerating Faster
The same capabilities that make defense agents powerful make attack agents terrifying.
Researchers demonstrated AI generating proof-of-concept exploits from CVE advisories in as little as 15 minutes. According to researchers at firms like Darktrace, the vast majority of phishing emails now show signs of AI generation, with personalization and quality that defeats traditional filters. Deepfake-as-a-Service has exploded: a finance employee at Arup wired $25M after a video call in which the CFO and every other colleague on screen was a deepfake. In September 2025, Anthropic detected what it called the first reported AI-orchestrated cyber espionage campaign. A group it assessed as Chinese state-sponsored used Claude Code to handle 80 to 90% of the hands-on work, from reconnaissance through data exfiltration. Humans stepped in only at key decision points.
The attack surface isn't just expanding. It's qualitatively different.
The Attack Surface Nobody Is Ready For
OWASP released a Top 10 for Agentic Applications in December 2025, identifying risks that don't exist in traditional software: agent goal hijacking, tool misuse, insecure inter-agent communication, and cascading failures.
The deeper problem is the infrastructure enabling agent interoperability.
MCP, the Model Context Protocol that's become the de facto standard for connecting agents to tools and data, was designed for capability, not security. The spec doesn't enforce authentication, sandboxing, or verification. MCP servers are the new npm packages: a malicious server in your agent pipeline can poison your entire workflow. The LLM routing requests is probabilistic and manipulable.
Prompt injection isn't a chatbot problem anymore. It's a system-level attack vector. An adversarial string embedded in a document your agent reads can redirect its behavior, exfiltrate data, or spawn unauthorized actions, all invisibly, with no error signal, inside a system that looks healthy from the outside.
The Machine Identity Crisis
Here's the number that should reframe how you think about AI security.
Entro Security puts the ratio of non-human to human identities at 144:1, and finds that 97% of those identities have excessive privileges. In heavily cloud-native environments, the ratio can reach 40,000:1.
We spent the last decade building Zero Trust for humans. We built MFA, conditional access policies, just-in-time provisioning, behavioral analytics. We assumed humans were the primary attack surface.
We were wrong about the ratio.
Zero Trust for agents isn't optional. It's existential.
If you've worked in infrastructure, you recognize what machine identity actually is: it's IAM at scale. The same identity-and-access-management discipline we built for cloud services (discrete credentials, least privilege, automated rotation, audit trails) now needs to extend to every agent in every pipeline. At Cloudflare, we learned that identity is the new perimeter. That lesson applies at 144:1 with a vengeance. Every AI agent needs its own discrete identity, with least-privilege access, conditional access policies, and continuous attestation. Not a shared service account. A discrete, auditable, revocable identity.
Microsoft's Entra Agent ID is a start, but that's table stakes.
The winning security stack for the multi-agent era combines three things: machine-identity-first Zero Trust, continuous semantic attestation of agent reasoning, and sandboxed MCP execution. That combination doesn't fully exist yet. The company, or open-source project, that ships it first will own the next decade of enterprise security.
What To Do Right Now
If you're building or deploying multi-agent systems today, you don't have to wait for the winning stack:
- Give every agent a discrete identity. Treat agents like service accounts, not users. Least privilege. Audit everything.
- Treat MCP servers like third-party dependencies. Vet them. Pin versions. Audit permissions before you grant tool access.
- Build critique loops. One agent checking another's work isn't just about quality. It's a security primitive that catches semantic hijacking.
- Assume prompt injection. Any agent that accepts external input should treat that input as potentially adversarial. Sanitize, scope, and contain.
- Instrument reasoning, not just outputs. You can't detect semantic failure if you're only watching error rates.
Zero Trust for humans took a decade to build. We don't have a decade this time.
Next: the orchestration wars. Who wins, how, and what the Kubernetes of agent systems actually looks like.