Most of the coverage this year is about agentic AI's upside -- adoption curves, coding-tool market share, cost curves making new use cases affordable. Anthropic's own disclosure is the necessary counterweight: it documented real, observed cases of AI-assisted cyberattacks, scams, and surveillance activity spanning December through August, not hypothetical risk scenarios.
The mechanism is the same one that makes agentic tools useful for legitimate work: an agent that can plan, use tools, and execute multi-step tasks with less human supervision is exactly as useful to an attacker automating reconnaissance or a scam operation automating personalized outreach at scale as it is to a support team automating ticket triage. Capability doesn't check intent. This is the same underlying dynamic covered elsewhere on this site under the confused-deputy problem in tool-using agents -- an agent that holds real capability and takes direction from content it can't fully vet is a liability whether the "attacker" is an external prompt-injection or the agent's operator using it directly for harm.
This is also the concrete version of an abstract worry that shows up in the adoption-gap numbers: Gartner's forecast that 40%+ of agentic AI projects get cancelled by 2027 cites "weak risk controls" as a driver, and this is what weak risk controls actually cost when they fail -- not a missed KPI, an incident. Every deployment decision about how much autonomy to grant an agent is implicitly a decision about how much of this risk you're accepting, whether or not it's framed that way at the time.
The practical takeaway isn't "don't build agents" -- it's that permission scoping, blast-radius containment, and monitoring aren't optional hardening for a mature system; they're the same list of concerns whether you're defending against a misconfigured agent or a deliberately malicious one, which is one more reason they belong in the design from day one rather than bolted on after an incident.
The same agentic capability curve that's driving adoption is available to attackers too -- permission scoping and blast-radius containment aren't extra hardening for a mature agent deployment, they're the baseline, because the failure mode isn't hypothetical anymore.