In May 2026, Google's Threat Intelligence Group reported that cybercrime actors built working exploits for a two‑factor bypass in an open‑source administration tool and assessed with high confidence that an AI model supported both the discovery and the exploit development.
From productivity aid to working exploit: the public arc
The public record traces a clear arc. In early 2025, Google’s Threat Intelligence Group (GTIG) observed state‑backed actors using generative AI for translation, scripting help, troubleshooting and research. By late 2025 GTIG documented malware that phoned a model during execution and an emerging underground market for illicit AI tools, and Anthropic disclosed shutting down an extortion operation that used AI across reconnaissance, credential harvesting and ransom drafting. In May 2026 GTIG said it disrupted activity around a two‑factor bypass and judged that an AI model had assisted both discovery and exploit development; GTIG worked with the affected vendor on disclosure and assessed that disruption may have prevented the exploit from being used.
Attack and defense as loops, not lines
The technical change is not a new magic capability so much as a compression of time, skill and cost in the middle of an intrusion. An attacker probes, reads the response, adjusts and retries; AI shortens that read‑explain‑fix cycle and lets both novice and expert adversaries run more experiments per day. Defenders are supposed to mirror the same loop—signal, context, hypothesis, scope, action, feedback—but too often queues, console splits and telemetry gaps interrupt the feedback. The environment answers an attacker’s experiment in seconds; the defender’s response often arrives only after a ticket is picked up. The article calls attention to “reconstruction interval” as decision latency that today’s SOCs rarely measure.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageThe lossy handshake and a worked example
Jonathan Waknin’s three‑part series maps the recurring transfer problem across five SOC functions—threat intelligence, threat hunting, detection engineering, investigation and remediation—and shows how each handoff strips context. The report enumerates five kinds of information that commonly vanish in transfer: entity identity; evidence and provenance; hypothesis and confidence; telemetry sufficiency; and decision ownership and constraints.
The consequence is visible in a concrete scenario. A finance account signs in from an unfamiliar hosting provider; MFA succeeds; a forwarding rule appears and the account begins accessing finance SharePoint files in an unusual pattern. Threat intelligence brings technique context; hunting discovers incomplete device‑compliance coverage and delayed SharePoint audit records; detection engineering encodes a rule that assumes partial device visibility; an analyst must rebuild the incident across four consoles and recommends disabling the account; and the identity team, knowing payroll is mid‑run, is handed a one‑line ticket. Each function “did its job,” the piece says, but the system forced everyone to reconstruct the story from scratch and left critical constraints, competing explanations and telemetry gaps behind.
What a stateful SOC remembers — and how agents fit
The remedy is architectural: move from amnesia to shared operational memory. Waknin prescribes five kinds of state every workflow must read and write: environmental state (identities, devices, owners and exposures); evidence state (observations, sources, timestamps and provenance); decision state (current hypothesis, alternatives, confidence and what would change the answer); control state (available actions, approvals, owners and preservation needs); and learning state (corrections, failed assumptions and whether fixes held).
The article warns that bolting agentic AI onto a stateless SOC simply speeds a broken model. Instead, bounded agent workflows should act from shared memory and respect an explicit separation between confidence and authority. The framework distinguishes four modes for any action: observe and gather more evidence; recommend an action to a human authority; execute only after explicit approval; or execute automatically but only when policy, confidence, entity type and impact rules are all satisfied. Learning likewise must be staged: a single analyst correction should not auto‑change production detection logic without gathering similar cases and routing a proposed change to the rule owner.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: measure where context is repeatedly reassembled by hand; record what could not be seen next to what was concluded; and version control the control state so automated actions carry an auditable mode and owner.
- Policymakers and regulators: updated federal guidance already points in this direction—NIST’s SP 800‑61r3 reframes response as part of wider risk management—and the GTIG disruption shows provider guardrails matter but do not substitute for internal boundaries.
- Affected enterprises and procurement leaders: insist that SIEM, EDR, identity and case systems contribute to a shared decision model; require evidence provenance, telemetry sufficiency and approval paths to travel with alerts so a business‑critical operation like payroll does not become a surprise containment veto.
The central choice is concrete: let investigation lessons evaporate as a closure reason, or build a stateful memory that names what could not be seen, assigns who must fix it, and hands the next analyst a memory instead of a queue. The finance account will be suspended either way; only one SOC will keep the lesson.
https://thehackernews.com/2026/09/the-soc-doesnt-need-to-start-over-with.html
