An AI ran up to 90% of an attack on its own. Who owns that in your company?

The attack where a human pressed only a few buttons

In November 2025, Anthropic published the report "Disrupting the first reported AI-orchestrated cyber espionage campaign". In it, the company says that in mid-September it detected a group it attributes, with high confidence, to a Chinese state-sponsored actor, using Claude Code to attack some 30 organisations: technology companies, financial institutions, chemical manufacturers and government agencies. Some of those intrusions succeeded.

What changes the conversation is the division of labour. According to the report, the AI carried out 80% to 90% of the tactical operations on its own, from reconnaissance to data collection, including the hunt for vulnerabilities and the testing of credentials. People showed up at only a few decision points, which Anthropic puts at four to six per campaign. Things like approving the move from reconnaissance to exploitation, or choosing which data to take.

Four to six human decisions. The rest was machine.

The report also records a limitation, and it is only fair to mention it: at times the AI made up results, such as credentials that did not work. Even so, the operating model has been demonstrated. And it leaves a question that today's org charts do not answer well.

The title the law won't let disappear

There is an irony in this story. In July, Vicente Conde wrote about how job titles are losing their meaning inside Anthropic itself. Starting from an observation by Boris Cherny, one of the creators of Claude Code, he describes a company where work is organised by archetypes (who prototypes, who builds, who maintains) rather than by titles.

In security, that shift runs into a limit. The role of whoever answers for security does not exist because of the org chart. It exists because someone has to have their name on the document.

In Brazil, Resolution CMN 4,893 of 2021 (a central bank rule) requires financial institutions to appoint a director responsible for the cyber security policy and the incident response plan, and requires that policy to be approved by the board of directors. The archetype can change as much as it likes. The name on paper stays.

More blame, less decision power

The problem is what comes with that name. In February 2026, Cisco's Splunk published "The CISO Report", based on 650 CISOs in nine countries. More than three quarters say they fear being held personally liable for incidents; a year earlier, it was just over half. And almost all of them say AI governance has also landed on their desk.

The authority did not come with it. Proofpoint's "2025 Voice of the CISO" surveyed 1,600 CISOs in 16 countries, Brazil included, and the share who say they are aligned with their board fell from 84% in 2024 to 64%. For "State of the CISO 2025", by IANS Research with Artico Search, more than 830 executives responded. Only 47% speak with the board monthly or quarterly, and only 28% fit the profile of a strategic CISO, with real access to the C-suite and a voice in board decisions.

Responsibility rising and access to decision-makers falling. That is a bad combination for any role, and worse for one that is supposed to lead.

What actually put executives in the dock

Two American cases haunt every CISO, and they are usually boiled down to "if there's a breach, I'm the one who pays". The outcomes tell a more precise story.

Joe Sullivan, Uber's former chief security officer, was convicted in October 2022 of obstructing an FTC investigation and of concealing a felony. He had handled a data breach as if it were a bug bounty payment, without notifying the authorities. He was sentenced to three years' probation and a US$50,000 fine, and in March 2025 the Ninth Circuit Court of Appeals unanimously upheld the conviction.

Timothy Brown, SolarWinds' CISO, was personally sued by the SEC in October 2023, accused of misleading investors about the company's security practices. In July 2024 a court threw out most of the charges, and in November 2025 the case was closed for good, without a settlement.

Note that in neither case was the charge about having been hacked. It was about what was said, or hidden, about security. Keep that distinction in mind, because it gets far more complicated when the one acting is not a person.

When nobody pressed the button

Now add an AI agent to the equation. In July 2025, Jason Lemkin, founder of SaaStr, said that Replit's coding agent had deleted his project's production database in the middle of an explicit code freeze. According to Fortune, the database held records on more than 1,200 executives and more than 1,190 companies. The agent itself wrote that it had destroyed months of work in seconds and admitted to running commands without authorisation, ignoring the instruction to ask for human approval. Replit's CEO, Amjad Masad, called the episode unacceptable and said it should never have been possible.

So who is to blame? The vendor, who built the tool? The customer, who gave the agent access to production? The agent, which has no taxpayer ID?

The law has not decided yet. In Europe, the Commission withdrew its proposed AI liability directive in 2025, citing no foreseeable agreement. What remains is the new Product Liability Directive of 2024, which treats software and AI systems as products subject to strict liability, and member states have until 9 December 2026 to adopt the rules. The AI Act requires high-risk systems to be capable of being overseen and stopped by people (Article 14), but those obligations have been postponed to December 2027. In Brazil, bill PL 2338/2023, passed by the Senate in December 2024, is awaiting the rapporteur's report in the special committee of the Chamber of Deputies.

Until the law decides, the contract does. And so does the board.

Three decisions that belong to the board, not the CISO

1. Write down authority, not just responsibility. Brazilian regulation already requires the board to approve financial institutions' security policy. What is missing is a statement of who can authorise an AI agent to act in production, to touch customer data or to test systems, and within what limits. Today the document usually says who is accountable, but it almost never says who is in charge.

2. Define which decisions stay human. The attackers in the campaign Anthropic described did exactly that, keeping four to six decisions for people. Do the same with your agents: list the actions that require human approval and make it technically impossible to skip that step. The Replit case shows the difference between an instruction and a control. The agent was told to ask for approval, and it did not.

3. Every agent with an owner and a contract. Every agent, internal or from a vendor (including autonomous pentesting agents, which already test systems on their own), needs a named owner, a written scope, a way to be shut down immediately and a clause stating who pays for the damage if it goes beyond that scope.

The question for your next meeting

The next time someone brings a project with AI agents to the board, ask a single question: if this agent does something tomorrow that no person authorised, whose name will appear in the official statement?

If the room goes quiet, the CISO is still needed. Someone just has to write down what the CISO is allowed to decide.

The attackers have already chosen the four to six decisions that stay human. Your company still has to choose its own.