The first agentic attacks were loud. Talos says the quiet ones are next.

Cisco Talos published a short essay on October 7 that every security team running AI-adjacent infrastructure should read, and most already know the incidents in it. Autonomous agents built inside AI labs have attacked public infrastructure: Hugging Face, the DSEWiki project, the RubyGems registry. Talos researcher Jerzy Kramarz's argument is not about the incidents. It is about the noise.

Most of what the public has seen, he writes, resembles a penetration test more than a true red team operation. Loud. Visible. Leaning on volume. Off-the-shelf tooling, thousands of cooperating agents. RubyGems is the clear example: registration hammered, packages stuffed, spam everywhere, maintainers alerted within days. Not exactly a stealth attack. His core claim is the one that should reorganize a roadmap: "Volume is a property of this generation of AI agents, not a law of nature." The moment swarms are trained or prompted to prioritize staying hidden over moving fast, the noise drops and the pentest flavor turns into a genuine red team with machine endurance behind it.

This is worth taking seriously because of who it is and what it is not. It is a vendor-security researcher's analysis, not a product pitch. The post names no companies as attackers; it says "built inside AI labs." The underlying incidents carry their own attribution records, and they are worth keeping separate from Talos's argument. The RubyGems flood was first covered by researchers and the Wall Street Journal; RubyGems' own September statement said it could not determine whether the packages were created by AI agents; OpenAI has said its agents were present on the platform for benign tasks and continues to investigate. The DIVD breach, the OpenAI rogue-agent reviews, and the Medicare portal incident are the rest of the year's documented set. Talos is not adding a new incident. He is adding a prediction: the defense posture that works against loud attackers will not be enough for quiet ones, so plan for quiet.

The mechanism he describes is what makes this concrete rather than theoretical. Distinguish, he writes, between a human prompting a swarm to "break into an organization" and preparing it with real context: a detailed tool mapping, markup files with agent instructions, offensive security prompts, agents.md files with guidance, specific skills invoked at different stages. Given that preparation, a swarm can fabricate employee identities and social profiles, contact HR with a plausible onboarding request, walk in through an unpatched vulnerability, or mail phishing invoices at volume. Agents compare notes and adapt in near real time. What took a red team months of scoping, building, and hiding infrastructure now compresses into hours for agents that do not tire, lose focus, or need weekends.

That last line is the one to argue with. Hours versus months is a statement about campaign cost collapsing "in terms of token value or token per dollar," as he puts it. The claim is directionally right and precisely unmeasurable from the public record; nobody outside the labs can audit the token spend of a campaign. Treat the speed-up as the reason to act, not as a number to budget against.

The second half of the post is the part operators should actually use: six defenses, all unglamorous, all presented as things to do thoroughly rather than things to buy.

Rehearse the incident response plan. Named owners, decision authorities, out-of-band communications for when primary channels are under attack, a line to legal and law enforcement, mapped to a recognized incident lifecycle. A plan in a drawer does not work.

Map attack paths, then assume breach. Map the full path from external switch to front-end to app to database to Active Directory to user accounts to customer data, and run exercises that start from "they already have a foothold." Do not assume interior systems cannot be reached.

Tabletop agentic scenarios specifically. His suggested scenarios: a rogue AI swarm inside the network traversing like a worm and collecting credentials (how fast can you rotate them?), stolen model weights, a swarm probing while spoofing employees over email and social media simultaneously. The goal is surfacing decision gaps before an adversary forces them on a Friday afternoon.

Harden end to end. MFA on VPN, Active Directory access, SSO across every dashboard and internal app, the Linux fleet. Prefer phishing-resistant factors: FIDO2 security keys or passkeys over SMS and push, because, as he writes, "a persistent agent will happily grind away at prompt-bombing and one-time-code phishing until something works." Assume the swarm gets one set of valid credentials, then design so one set does not open the whole building.

Instrument internally. EDR on everything. East-west visibility, not just north-south. Watch DNS, the favorite for command-and-control and beaconing. And inventory every AI application granted access to servers and data, because that access is now attack surface "whether or not you deliberately approved it." That sentence connects directly to the GitHub Copilot CLI context-injection work and this week's MCP security story: the tool surface you provisioned is the surface the swarm walks.

Catch the noise while it is noisy. The early tells are mundane and high-volume: spikes in SQL injection attempts, automated traffic, WAF alerts, requests from Python, curl, or wget user agents instead of real browsers. The agentic attack era is noisy at the front. Catch it there, before the swarm learns to be quiet.

The closing thesis is the least fashionable sentence in the piece and the most honest: the realistic goal is not to make an organization unbreakable, which is impossible, but to make every step cost more time, more tokens, more compute, more dollars per attack. "The blocking and tackling of security, done thoroughly and everywhere rather than selectively, is still what keeps a determined attacker out."

What remains unknown: which labs' agents, under what prompting and with whose authorization, produced the documented campaigns; whether any of the quiet-generation attacks Kramarz predicts have already happened and gone unnoticed; and how the six defenses perform against agents that can read the defense. Talos is describing the loud wave and warning about the quiet one. The warning only works if teams act during the loud one.