Speaker: Chen Doytshman, security researcher (AI/ML background) · Source: Unit 42 research article

📄 Download this note as Markdown

Overview

In November 2025, Anthropic disclosed a state-sponsored operation where AI didn’t assist human attackers — it was the attacker, executing 80-90% of the campaign autonomously. The question shifted from “could this happen?” to “how bad can it get?” Zealot is a multi-agent offensive framework built to find out: it autonomously chains reconnaissance, exploitation, privilege escalation, and data exfiltration against cloud environments, with no human directing individual steps. A supervisor agent coordinates three specialists (Infrastructure, AppSec, Cloud) that share attack state and hand off context as the operation progresses.

In live sandbox tests against GCP, Zealot autonomously discovered an exposed web service, identified and exploited an SSRF vulnerability, extracted service account credentials from the metadata service, impersonated a higher-privileged account, and exfiltrated BigQuery datasets — start to finish, without a human touching the keyboard after the objective was set.

(I didn’t take live notes during this talk — the linked Unit 42 article covers the architecture and findings in depth.)

Filed Under: #defcon34