After more than a decade in offensive security, I thought I understood the craft. The methodology becomes second nature—you develop intuition for which paths to explore, how to chain findings, when to pivot. It's pattern recognition built on thousands of hours of breaking things. Then I tried to teach that intuition to an AI agent. This talk is the result of that experiment. I took the 7-phase attack methodology I've refined over years of red team engagements and built an autonomous agent that executes it end-to-end: reconnaissance, vulnerability discovery, exploitation, privilege escalation, credential harvesting, lateral movement, persistence. Not a wrapper around existing tools. An agent that actually reasons about what it's seeing, decides what to try next, and adapts when things don't work. Watching it operate was a turning point for me. Some things it does better than I expected—it doesn't get tunnel vision, it's relentless, it tries combinations I wouldn't have considered. Other things revealed how much of red teaming is still deeply human. But the overall result is clear: autonomous offensive agents aren't a future threat. They're a current reality, and the security industry isn't ready. I'll walk through how the agent thinks, how it chains vulnerabilities the way an experienced attacker would, and what the full kill chain looks like when executed at machine speed. More importantly, I'll share what this means for defense—where detection breaks down, what assumptions no longer hold, and what security teams should be doing now. This is original work that hasn't been presented elsewhere. It combines over a decade of hands-on offensive security experience with the emerging reality of agentic AI. The talk is technical enough to be valuable for practitioners but accessible enough that security leaders will walk away understanding why this changes the game.
