Elastic's Threat Report Reveals Attackers Are Turning Trusted AI and IT Tools Against the Enterprises That Deploy Them
CIO Influence, Thursday, November 5th, 2026
Elastic report finds attackers abusing AI tools, agents and signed remote monitoring software, logging in about eight minutes after infection.
A new report from Elastic Security Threat Command finds attackers are abusing the trust and deep system access enterprises grant to AI tools and agents.
Based on live intrusions and research from April to September 2026, it shows attackers logging in with stolen credentials an average of eight minutes after infection, executing commands through AI applications and abusing legitimately signed remote monitoring tools.
Elastic's Mike Nichols says an agent holding credentials and internet access is a new attack surface whose malicious activity looks like the employee who installed it.
The report publishes artifacts and detection logic so defenders can hunt for the same activity.