The Vault Test No Longer Takes a Night

A locksmith hired to test a bank vault once needed a crew, a night, and a stack of paper notes. Give that locksmith a thousand tireless interns who can try every key combination simultaneously, and the value of the engagement stops being the number of keys tried. It becomes the judgment to say which lock actually guards the money. That is the position of the offensive security industry in late 2026.

The structural shift is that adversarial and defensive language-model agents now operate inside the same application layer that red teams are contracted to assess. The documented anchors for that claim are OWASP ranking prompt injection as LLM01 in its 2025 Top 10 for LLM Applications, NIST codifying prompt injection and data poisoning in AI 100-2, and Google DeepMind's Big Sleep disclosure of 20 previously unknown software defects — not an unverified same-day intrusion headline.

The Pricing Unit Is Collapsing

Pentesting has always been sold as labor: person-days, a scope letter, a PDF. Agent-assisted fuzzing and exploit synthesis destroy that cost basis. In July 2024, Google DeepMind and Project Zero reported that Big Sleep identified 20 previously unknown vulnerabilities, including a use-after-free in SQLite — a result produced by an agent pipeline, not a billing schedule. The commercial consequence is that a finding count is becoming a commodity input, while the scarce product is a reproducible, business-impact-ranked exploitation path that survives developer scrutiny.

Expect procurement to follow. Fixed-scope, annual engagements reward volume. Continuous authorization testing against an LLM agent's tool grants rewards something else entirely: evidence that a support chatbot can be induced to invoke a refund endpoint with another customer's tenant context. That is a logic flaw, not a CVE, and it will not appear in a scanner's severity dashboard.

What the Morris Worm Actually Taught Us

In November 1988, the Morris worm consumed six percent of connected internet hosts. The institutional response was not a contest to build a faster worm; it was the creation of the Computer Emergency Response Team at Carnegie Mellon and, eventually, coordinated disclosure as a discipline. The transferable lesson is that when exploitation outpaces manual triage, the winning intervention is an information pipeline, not a taller wall.

Today's equivalent is a shared, evidence-backed vocabulary for agent compromise: which tool was reachable, which credential was scoped, which policy was bypassed. MITRE ATLAS and the OWASP LLM risk taxonomy serve that function imperfectly, but they are the institutional answer to the same problem CERT/CC solved in 1989 — converting individual incidents into repeatable defensive knowledge.

The Automation-Replace-The-Red-Team Claim Does Not Hold

The opposite reading — that agent-assisted testing makes human testers obsolete — is not supported by the record. Big Sleep's 20 findings were memory-safety defects in a bounded target, not an autonomous end-to-end intrusion into a production enterprise. Agents still hallucinate exploitability, miss multi-tenant authorization boundaries, and generate false positives that consume engineering time. Rules of engagement, scope containment, proof-of-impact validation, and the legal authority to touch a live system remain human responsibilities. Automation compresses reconnaissance; it does not confer accountability.

The New Attack Surface Is a Permission Grant

NIST's AI 100-2 taxonomy describes prompt injection as "a vulnerability in LLM-enabled systems" arising when malicious instructions are supplied to override developer guidelines. Read operationally, that definition relocates the perimeter. The compromised asset is no longer a workstation; it is an agent holding an OAuth token with write access to a ticketing system, a browser session, or a payments API.

Traditional red-team methodology assumed a attacker lands code and then escalates. Agentic systems invert the sequence: legitimate capability is granted up front, and a paragraph of untrusted text redirects it. The offensive test therefore shifts from binary instrumentation to trust-boundary mapping — what the model reads, what it may call, and which actions require an out-of-band human approval. Identity governance has become the primary payload-delivery problem.

Evidence Is the Only Durable Deliverable

The third underreported effect is on the internal politics of remediation. When an agent produces two hundred candidate findings, the security team's bottleneck becomes adjudication, not discovery. NIST SP 800-218A, its secure software development guidance for AI-enabled systems, is directionally right here: provenance, evaluation, and lifecycle controls matter more than a static attestation.

Practically, this means a red team's deliverable must be a replayable session trace — the exact untrusted input, the tool invocation, the tenant boundary crossed, and the minimal patch. A narrative risk rating without a reproducible trace is already losing budget to engineering teams that can generate narrative risk ratings themselves.

The Attestation Trap

There is an equally weak counter-narrative: that mandating framework compliance or restricting open-weight model access will contain the risk. A completed OWASP checklist does not stop a cross-tenant authorization bug, and documentation requirements do not remove a mis-scoped service token. Meanwhile, compliance overhead falls disproportionately on small vendors who cannot fund continuous testing, while well-resourced adversaries face no such paperwork. The defensible position is narrower and less comfortable: frameworks organize work, they do not substitute for adversarial testing against the deployed configuration.

What to Change Before the Next Quarter

Local businesses should inventory every AI agent by the credentials it holds, not by its product name. Strip write access from anything that only needs to read. Require human confirmation for payment, deletion, and account-recovery actions, and verify those confirmations out of band. Commission a scoped agent-red-team exercise that tests prompt injection plus authorization bypass, and demand a reproducible trace for every reported issue.

Citizens should apply the same discipline: passkeys over reused passwords, a review of third-party OAuth grants, and no persistent inbox or banking write access for an autonomous assistant. The individual control that matters most is limiting the blast radius of a legitimate but misdirected action.

Six Months Out: A Market for Verified Exploits, Not Alerts

By April 2027, the most probable configuration is a two-tier offensive market. Commodity scanning and agent-generated candidate discovery will trend toward zero marginal cost; pricing will migrate to independently verified, business-impact-ranked exploitation paths and continuous testing contracts. Procurement language will begin demanding rules of engagement, trace retention, and human sign-off rather than tester headcount.

The downside scenario is equally concrete: a wave of agent-produced false positives deserializes remediation queues, followed by a credibility correction for vendors selling autonomous "full-stack compromise." The firms that survive will look less like penetration-testing shops and more like forensic evidence providers. Speed is now abundant. Judgment is the asset being priced.