Battle of the Clones: Why AI Agents Will Be the Next Battleground

Cybersecurity researchers are warning of the emergence of a new class of cyberattacks in which autonomous AI agents are the primary target.

Until very recently, the main threat posed by artificial intelligence was thought to be that it might one day replace humans. But while the world is still debating job losses, cybersecurity experts have already encountered a completely different problem.

Just a few years ago, a scenario like this would have seemed like the stuff of science fiction. Today, autonomous AI agents are already capable of writing code, managing servers, working with cryptocurrency wallets, analyzing data, executing transactions, and interacting with dozens of different services with virtually no human intervention.

And the more AI agents there are, the more often they start communicating not with people, but with each other

This is exactly where a whole new avenue for attacks emerges.

At DEF CON 34, researchers presented a new exploit scenario for autonomous AI systems called Cross-Agent Privilege Escalation (CAPE).

Unlike traditional attacks, an attacker no longer needs to gain full privileges on a single system. It is sufficient to compromise a single AI agent that is already part of the overall workflow.

Next, the architecture of the multi-agent system itself comes into play. Each AI has limited authority: one handles documents, another has access to GitHub, a third manages the cloud infrastructure, and a fourth interacts with the company’s internal services. Individually, they are secure.

However, researchers have shown that, given a specific sequence of requests, a compromised agent is capable of exploiting the capabilities of other system participants. In doing so, it does not directly obtain their privileges or hack into other services. It merely uses the existing mechanism for interaction between agents, forcing them to perform operations within the scope of their own authority.

The result is a chain of trusted actions. Each agent performs only the operations it is authorized to perform, each request appears legitimate, and each action complies with security policy. However, the resulting sequence of events leads to an attacker gradually gaining access to resources that were initially inaccessible to them.

The researchers have named this mechanism " Cross-Agent Privilege Escalation."

The main danger of such attacks lies not only in their effectiveness but also in how difficult they are to detect. Modern security systems analyze the actions of individual users, processes, or services. In the case of CAPE, there are virtually no suspicious actions. All requests are made through standard interfaces, and all commands are executed by agents that actually possess the necessary permissions. It is not a single operation that appears suspicious, but rather the entire chain of interactions between multiple AIs.

That is precisely why the first protection mechanisms began to be developed almost immediately after the study was published. Rule ATR-2026-00074, which describes the characteristics of Cross-Agent Privilege Escalation and provides recommendations for detecting such scenarios, has already been published in the Agent Threat Rules database.

This topic is of particular importance to the crypto industry. More and more projects are experimenting with autonomous AI systems that analyze the market, interact with smart contracts, manage digital assets, and automatically execute transactions on the blockchain. As their capabilities expand, the threat landscape is also changing.

While attackers used to target users and their wallets, in the future, AI agents themselves and the trust relationships between them may become the targets of attacks.