Artificial intelligence is changing cybersecurity from both sides of the battlefield.

Security teams are using AI to analyze alerts, investigate suspicious activity, detect threats and automate parts of incident response. At the same time, threat actors are increasingly using AI to automate parts of phishing, reconnaissance, social engineering and other cybercrime operations.

Recent research from Google Threat Intelligence found that some threat actors have moved beyond simple AI prompting toward agentic AI workflows and AI-enabled automation. Google reported observing a 2026 campaign in which attackers compromised a cloud resource and then planned, built and executed an agent-enabled credential-harvesting operation in less than six hours.

Microsoft is also adapting its security strategy around AI agents. On September 23, 2026, Microsoft announced an Integrated Security Operations Center (ISOC) approach in Microsoft Defender designed to bring security information and event management together with threat protection for an environment where both humans and AI agents participate in security operations.

These developments make AI cybersecurity one of the most important technology security topics in 2026.

But AI is not automatically making cybersecurity either safer or more dangerous. Its impact depends on how the technology is deployed, controlled and monitored.

This article explains the latest AI cybersecurity developments, emerging risks, defensive technologies and practical steps organizations and individuals can take.

What Is AI Cybersecurity?

AI cybersecurity refers to the use of artificial intelligence and machine learning technologies to protect computers, networks, applications, identities and data from cyber threats.

Traditional cybersecurity often depends on predefined rules, signatures and manually created detection systems.

AI can add another layer by analyzing large volumes of information and identifying patterns that may be difficult to detect manually.

AI can be used for tasks such as:

• Threat detection
• Security alert analysis
• Malware classification
• Phishing detection
• Vulnerability analysis
• Threat intelligence
• Incident investigation
• Security automation
• Identity monitoring
• Security operations

However, AI can also become part of the threat landscape.

Attackers can use AI to make scams more personalized, automate repetitive tasks and reduce the amount of human effort required for certain operations.

That creates a cybersecurity environment in which defenders and attackers can both benefit from automation.

Why AI Cybersecurity Matters in 2026

The security environment is becoming increasingly complex.

Organizations now operate across:

• Cloud platforms
• SaaS applications
• Remote devices
• APIs
• Mobile devices
• AI applications
• Developer environments
• Connected services
• Automated workflows

AI agents add another layer.

An AI agent may have access to applications, files, APIs or business systems in order to perform tasks.

That can improve productivity, but it also creates security questions.

What can the agent access?

What identity does it use?

What data can it read?

What actions can it perform?

How are its decisions monitored?

Microsoft’s September 2026 security updates specifically address the need to discover and control local AI agents, extend Zero Trust controls to agent traffic and protect sensitive data from being sent to unsanctioned AI services.

This shows that AI security is moving beyond protecting AI models alone. Organizations increasingly need to secure the entire environment in which AI agents operate.

AI-Powered Cyber Threats Are Becoming More Automated

One of the major cybersecurity developments in 2026 is the increasing use of AI-assisted automation by threat actors.

Google Threat Intelligence reported that forward-leaning attackers are transitioning from basic prompting toward agentic AI workflows. According to Google, this can reduce the amount of human intervention required during certain operations.

This does not mean every cyberattack is now autonomous.

Human involvement remains important in many attacks.

However, automation can allow attackers to process information, adapt messages and perform repetitive activities at greater scale.

For defenders, this creates a challenge: security operations also need to become faster without sacrificing accuracy or human oversight.

AI-Powered Phishing Is a Growing Security Concern

Phishing remains one of the most important cybersecurity risks.

AI can make phishing messages more convincing by helping attackers generate text that matches a target’s role, industry or situation.

Microsoft’s September 2026 research into the EvilTokens phishing-as-a-service platform found that its operators used AI capabilities to customize phishing lures and analyze compromised inboxes. Microsoft said the operation compromised more than 12,000 inboxes across more than 10,000 organizations worldwide.

Microsoft also reported that EvilTokens abused device-code authentication and was designed to automate multiple parts of the phishing process.

The incident illustrates an important lesson:

Multifactor authentication alone does not eliminate every form of identity attack.

Organizations also need to protect authentication flows, monitor unusual sign-in behavior and apply appropriate access controls.

What Is Device-Code Phishing?

Device-code authentication is a legitimate mechanism designed for devices that may not provide a conventional browser-based sign-in experience.

The problem occurs when attackers manipulate users into completing a legitimate authentication process for an attacker-controlled session.

Microsoft recommends blocking device-code flow where possible. For organizations that genuinely require it, Microsoft recommends tightly scoped exceptions and appropriate Conditional Access controls.

For ordinary users, the broader lesson is simple:

Never approve an authentication request that you did not intentionally initiate.

If a login request suddenly appears while you are not trying to sign in, stop and verify it.

AI Agents Are Creating a New Security Challenge

AI agents are different from traditional software because they can reason about tasks, use tools and adapt their actions.

This creates a new security model.

A traditional application might have predictable behavior.

An AI agent can potentially make different decisions depending on the information it receives.

That means security teams need to consider:

Identity

Every agent should have an identifiable and controlled identity.

Permissions

Agents should receive only the permissions necessary for their tasks.

Data Access

Sensitive information should not automatically be available to every AI system.

Tool Access

Organizations need to control which applications and APIs an agent can use.

Monitoring

Agent activity should be logged and monitored for unusual behavior.

Human Approval

High-risk actions may require human approval before execution.

Zero Trust Is Becoming Important for AI Agents

Zero Trust is based on the principle that access should not automatically be trusted simply because a user or system is inside an organization’s environment.

The same idea is becoming relevant to AI agents.

An AI agent should not automatically receive broad access because it is an approved application.

Instead, organizations can apply controls based on:

• Identity
• Device
• User
• Application
• Data sensitivity
• Requested action
• Context
• Risk

Microsoft said its September 2026 security updates extend Zero Trust principles to agent traffic and allow organizations to enforce data security controls on traffic generated by agents acting on behalf of users.

This is particularly important as employees increasingly use AI tools for documents, coding, research and business workflows.

AI Is Also Strengthening Cyber Defense

The story is not only about attackers.

AI can provide significant benefits to security teams.

Modern Security Operations Centers can receive thousands or even millions of security events.

Human analysts cannot investigate every event manually.

AI can help organize and prioritize this information.

Possible applications include:

• Alert summarization
• Threat investigation
• Security event correlation
• Malware analysis
• Threat intelligence
• Incident reporting
• Vulnerability prioritization
• Detection engineering
• Threat hunting

Google has been developing AI agents for security operations, including agents designed for threat hunting and detection engineering.

Microsoft is also integrating AI capabilities into security operations, including AI-generated investigation summaries and specialized security agents.

AI Can Help Security Teams Respond Faster

One advantage of AI in cybersecurity is speed.

A security analyst may need to review:

• Login information
• Endpoint alerts
• Network activity
• Email events
• Identity signals
• Cloud activity
• Threat intelligence

AI can help summarize relationships between these signals.

This can reduce repetitive work and allow security professionals to spend more time on complex investigations.

However, AI-generated conclusions should still be validated when the consequences of an incorrect decision are significant.

Software Supply Chain Security Is Another Major Risk

Cybersecurity is not limited to websites and email accounts.

Modern organizations depend on thousands of software components, libraries, development tools and third-party services.

That makes software supply chains an attractive target.

Google Mandiant reported on September 24, 2026 that recent campaigns have increasingly targeted trusted security tools, programming tools and AI developer tools because these systems can have elevated privileges within software development pipelines.

This is particularly important as AI coding assistants become integrated into development environments.

Organizations should therefore consider security controls for:

• Source code
• Dependencies
• Build systems
• CI/CD pipelines
• Developer devices
• AI coding tools
• API keys
• Cloud credentials
• Software packages

AI Coding Tools Need Security Controls Too

AI-assisted programming can improve developer productivity, but it introduces additional security considerations.

Developers may use AI tools to:

• Generate code
• Explain code
• Debug applications
• Create tests
• Review changes
• Work with documentation

However, organizations should consider what information is being sent to an AI service.

Sensitive source code, credentials, private keys and confidential data should not be shared with an AI tool unless the organization’s security and privacy policies allow it.

Google’s security research also highlights risks involving developer workstations, malicious extensions and AI developer tools within software supply chains.

AI-Powered Cybersecurity: Benefits and Limitations

Benefit	Limitation
Faster security analysis	AI can make mistakes
Automated alert summarization	False positives remain possible
Faster threat investigation	Requires quality data
Detection of unusual patterns	Attackers can adapt
Security workflow automation	Excessive permissions can create risk
Threat intelligence analysis	Human validation remains important
Faster incident response	Automation can amplify mistakes

The key point is that AI should generally complement security professionals rather than remove the need for them.

How Businesses Can Improve AI Cybersecurity

Organizations adopting AI should consider a layered approach.

1. Inventory AI Systems

Know which AI applications and agents are being used.

Shadow AI can create visibility problems when employees use unapproved services.

2. Apply Least Privilege

Give AI agents only the permissions they need.

An AI assistant that summarizes documents does not necessarily need permission to modify company databases.

3. Protect Sensitive Data

Use data-loss prevention and access controls to prevent confidential information from reaching unauthorized AI services.

4. Monitor Agent Activity

Log important AI-agent actions and investigate unusual behavior.

5. Strengthen Identity Security

Use strong authentication, Conditional Access and appropriate identity controls.

6. Keep Systems Updated

Security updates remain one of the most important defensive measures.

CISA’s 2026 guidance emphasizes prioritizing security updates based on risk rather than treating every vulnerability identically.

7. Secure Software Development

Review dependencies, developer tools, CI/CD pipelines and third-party components.

8. Maintain Human Oversight

High-impact actions should have appropriate human review and approval.

What Individuals Can Do to Stay Safe

Consumers do not need advanced cybersecurity knowledge to improve their security.

Start with these basic practices:

Use Strong, Unique Passwords

Avoid reusing passwords between important accounts.

Enable Multifactor Authentication

MFA adds another layer of protection, although users should still carefully review authentication requests.

Do Not Approve Unexpected Login Requests

If you did not initiate a login, do not approve it.

Be Careful With AI-Generated Messages

AI can make scam emails and messages look more professional.

Check the sender, context and requested action instead of judging a message only by its grammar.

Keep Devices Updated

Install operating-system and application security updates.

Be Careful With Links

Do not automatically trust links simply because a message appears professional.

Protect Recovery Methods

Make sure account recovery email addresses and phone numbers are secure.

The Future of AI Cybersecurity

The future of cybersecurity is likely to involve AI on both sides.

Attackers can use AI to increase automation and personalization.

Defenders can use AI to analyze larger volumes of security data and respond faster.

This creates an ongoing technological competition.

The organizations that benefit most from AI cybersecurity will not necessarily be those that automate everything.

Instead, effective security programs are likely to combine:

• AI
• Strong identity controls
• Zero Trust
• Human expertise
• Threat intelligence
• Security monitoring
• Data protection
• Secure software development
• Regular security updates

Microsoft’s latest security work reflects this broader approach by combining AI agents with security operations, threat protection and Zero Trust controls rather than treating AI as a standalone security product.

What Users Should Know About AI Security

AI cybersecurity is developing quickly, but users should avoid two extremes.

The first is assuming that AI will automatically solve cybersecurity.

The second is assuming that AI automatically makes every cyber threat unstoppable.

Neither is accurate.

AI is a tool.

Its effectiveness depends on the quality of its data, system design, permissions, monitoring and human oversight.

For businesses, the most important step is understanding where AI is being used and what access it has.

For individuals, basic security practices remain extremely valuable.

Strong authentication, software updates, careful handling of suspicious messages and good password hygiene continue to form an important foundation.

Frequently Asked Questions

What is AI cybersecurity?

AI cybersecurity is the use of artificial intelligence and machine learning to detect, investigate, prevent and respond to cyber threats.

How are hackers using AI in 2026?

Threat intelligence organizations have reported AI-assisted phishing, automation and agentic workflows being used by threat actors. Google reported observations of attackers moving toward agentic AI workflows, while Microsoft documented AI-assisted phishing capabilities in the EvilTokens operation.

Can AI completely prevent cyberattacks?

No. AI can improve detection and response, but cybersecurity still requires layered controls, secure architecture, identity protection, software updates and human oversight.

What are AI agents in cybersecurity?

AI agents are systems designed to perform security-related tasks such as investigating alerts, hunting for threats or assisting with detection engineering.

Is MFA enough to stop phishing?

No security control is perfect. MFA significantly strengthens account security, but attackers can target authentication workflows themselves. Device-code phishing is one example documented by Microsoft.

How can companies secure AI agents?

Organizations should control agent identities, permissions, data access and tool access while monitoring agent activity and requiring human approval for appropriate high-risk actions.

What is Zero Trust for AI agents?

It means applying identity, access and security controls to AI agents rather than automatically trusting an agent simply because it is an approved application.

What is the biggest AI cybersecurity challenge?

One major challenge is maintaining security and visibility as AI systems become more autonomous, connected to business applications and capable of taking actions on behalf of users.

Final Thoughts

AI is changing cybersecurity in 2026 from both directions.

Threat actors are using AI-assisted automation to improve phishing and other operations, while security teams are using AI agents to investigate threats, analyze security data and accelerate response.

Recent Microsoft and Google research shows that the security industry is moving toward an environment where AI agents are becoming part of both attacks and defense.

The answer is not simply to use more AI.

Organizations need to secure AI itself.

That means controlling agent identities, limiting permissions, protecting sensitive data, monitoring activity, strengthening Zero Trust controls and maintaining human oversight.

For individuals, the fundamentals still matter: strong passwords, multifactor authentication, software updates and caution around unexpected messages and login requests.

As AI becomes more deeply integrated into software, cloud systems and everyday devices, cybersecurity will increasingly become a shared responsibility between intelligent technology and the people who operate it.