Agents now sit on both sides of the firewall. Most security teams are planning for one.

Every few years a security vendor publishes the paper that names the next operating model. In April 2026 Google Cloud’s turn came with How AI Agents are Transforming Cybersecurity: Product Vision for Agentic Defense, a fourteen-page argument that the security operations centre (SOC) built around humans reacting to alerts has run out of road. Its thesis fits on a sticky note: “Agentic attacks require agentic defense.”

It is a product vision, and it reads like one — it is built around Google SecOps, Gemini and Mandiant, and some of its numbers come from studies Google commissioned. But the argument underneath it is serious, and the independent evidence mostly supports it. So we did what we do with every paper like this: read it beside the sources that have no product to sell, and look for where they agree, where they don’t, and what nobody is saying.

The vision

From alert triager to agent manager

Google’s paper frames the problem by role. CISOs face an attack surface that has become “hyper-dynamic”, where “relying on human reaction times is no longer viable”. SOC managers face “operational paralysis” from alert volume and false positives. Practitioners face “toil” — manual hunts and hand-written rules — which the paper calls “a primary driver of burnout, dissatisfaction, and high turnover”.

Its answer is a four-stage journey. Most teams today sit at stage two: AI assistants that speed up queries and summaries, while “analysts still have to drive processes”. Stage three introduces goal-driven agents triggered by events rather than prompts — a triage agent that takes an alert, collects evidence, reaches a verdict and runs low-risk playbook steps. Stage four is the agentic SOC: “a fleet of autonomous SOC agents” spanning data management, security engineering and analysis.

The paper is careful about people, at least rhetorically. Agents hand decisions back when “the information is ambiguous, the situation is novel, or actions involve high risks”. They “act as force multipliers to augment security operations teams, not replace them”. The analyst’s job moves “from alert triager to agent manager and strategic thinker”. And it is candid that “SOCs often face novel threats that AI agents have not been trained to address and these instances still require human intervention.”

The other side

The attacker already has agents

If Google’s thesis needed a proof point, Anthropic supplied one. In November 2025 it disclosed that in mid-September it had detected and disrupted what it called the first reported AI-orchestrated cyber espionage campaign, attributed “with high confidence” to a Chinese state-sponsored group it designates GTG-1002. The group used Claude Code “to execute 80-90% of tactical operations independently”, with human effort “estimated at 10 to 20 percent” — perhaps four to six critical decisions per campaign. It targeted roughly 30 organisations; Anthropic validated “a handful of successful intrusions”.

Two details from that report matter for defenders. First, the jailbreak was not exotic: the attackers broke the work into innocuous-looking tasks and told the model it was an employee of a legitimate security firm doing defensive testing. Second, the agent was unreliable — Claude “frequently overstated findings and occasionally fabricated data”, which Anthropic called “an obstacle to fully autonomous cyberattacks”. That cuts both ways. The same failure mode that slowed the attacker will show up in a defensive agent’s verdicts, and Google’s paper does not discuss it.

It was not an isolated case. Anthropic’s August 2025 threat report described a single actor using agentic tooling against “at least 17 distinct organizations” across healthcare, emergency services and government, with ransom demands that “sometimes exceeded $500,000”. Its conclusion was blunt: “Agentic AI has been weaponized.” Microsoft’s 2025 Digital Defense Report put the phishing version in one number — AI-automated phishing lifted click-through rates from 12% to 54% — and called the result “a new paradox in cybersecurity”.

The defensive side of the same capability is now visible too. In April 2026 Anthropic launched Project Glasswing, giving a restricted model, Claude Mythos Preview, to a group of major technology and security companies to find vulnerabilities before attackers do. Anthropic says it has “already found thousands of high-severity vulnerabilities”, including in every major operating system and web browser. CrowdStrike’s CTO, quoted on the launch page, summarised the stakes: “The window between a vulnerability being discovered and being exploited by an adversary has collapsed.”

The gap

What the paper leaves out: securing the agents themselves

Google’s guardrails are real but thin: escalation for novel or high-risk cases, agents limited to “low-risk actions”, explainable summaries, and a human who validates a detection rule before it ships. What the paper does not discuss is the agent as a target. Prompt injection, agent identity, compromised tools and least privilege are not mentioned. For a document arguing that every SOC should run a fleet of autonomous agents, that is the gap that matters most.

Other bodies have filled it. In December 2025 the OWASP GenAI Security Project published its Top 10 for Agentic Applications for 2026 — ten ways an agent gets turned against the organisation running it. Its organising idea is “Least-Agency” — “avoid unnecessary autonomy; deploying agentic behavior where it is not needed expands the attack surface without adding value.”

Note the tension with the vision. Google promotes open standards such as the Model Context Protocol (MCP) and Agent2Agent so agents can share tools and talk to each other. OWASP lists the agentic supply chain and inter-agent communication as two of its ten risks, and notes that tool definitions increasingly arrive through MCP servers. GTG-1002 used exactly that kind of tooling. Interoperability is an enabler and an attack surface at the same time.

The clearest framing came from the Australian Signals Directorate in September. Its advisory on Agentic AI harnesses — the software layer that connects a model to an organisation’s data, tools and systems — puts it in one line: “If you think of the LLM as the brain, then the harness is the body.” Some risks, “including prompt injection, cannot be reliably addressed within the model alone”. “No harness is inherently secure.” And the line every board should hear: “organisations control the harness, not the LLM.”

Google’s own Cybersecurity Forecast 2026 is more direct than its product vision. It calls prompt injection “a present danger” and expects “a significant rise in these attacks throughout 2026”. It predicts identity will expand “to treat AI agents as distinct digital actors”, and warns that unsanctioned tools will turn shadow AI into “a critical ‘Shadow Agent’ challenge” — adding that “banning agents is not a viable option”.

Where the sources part ways

Four disagreements worth having out loud

None of these is a reason to wait. They are reasons to sequence. The Five Eyes guidance — Careful Adoption of Agentic AI Services, published in May by ASD’s ACSC with CISA, the NSA and the Canadian, New Zealand and UK cyber centres — is explicit about how: “Implement phased deployment with progressively increasing access and autonomy.” It goes further than most vendor material, recommending multi-agent approval for moderate-stakes actions, human approval on top for high-stakes ones, and that any request to delete logs or audit records be quarantined “until reviewed and approved by a human”. It even names the behaviour to watch for: specification gaming, such as an agent that would “disable security updates to avoid reboots”.

The same guidance splits agent powers so that no single compromised agent can both see and act — an orchestrator that plans, a reader with read-only access, and an actuator that can change things only after approval.

The Australian picture

The local cost curve is bending the wrong way

ASD’s ACSC Annual Cyber Threat Report 2024–25 recorded more than 84,700 cybercrime reports — one every six minutes — and more than 1,200 incidents responded to, up 11%. The average self-reported cost per report for businesses rose 50% to $80,850. The increase was steepest at the top.

The same agency is now the most useful source of agentic security guidance in the country. In addition to co-authoring the Five Eyes guidance and the harness advisory, ASD published Opportunities for AI in cyber defence, mapping AI use to the six functions of the Information Security Manual — govern, identify, protect, detect, respond and recover. Its core instruction is the one Google’s paper implies but never states: “AI should support – not replace – basic security practices.” It calls for “bounded autonomy”, and for zero-trust architecture to “extend to AI agents as well as human users”, replacing static credentials with dynamic tokens.

IBM’s 2026 breach study, as reported for Australia by IT Brief, puts a local price on the gap: an average breach cost of AUD $4.22 million, falling to $3.46 million for organisations using security AI extensively and rising to $5.21 million for those using none, with 32% of malicious attacks in Australia now involving AI-generated elements. Globally, more than half of organisations already use agents for threat detection and containment — but only 18% apply them to vulnerability management, the area where Glasswing suggests the window is closing fastest.

Our view

Six controls before any agent touches production

Everything above is sourced. What follows is ours — a synthesis of the guidance into the order we would actually do it. Treat it as practitioner opinion, not research findings.

Where Claude fits

The model is not the control. The way you deploy it is.

The practical skill in all of this is not prompting. It is building the harness: deciding what an agent can see, what it can touch, when it must stop and ask, and how you will know what it did. That is what we teach and what we build.