When Autonomous AI Attacks a Segmented Network

Key Answers

• What did Zero Networks’ autonomous AI attack experiment test? In August 2026, Zero Networks tested how far an autonomous AI attacker could spread after compromising a single machine. The experiment showed that an AI attacker could not move laterally to compromise segmented assets, even when it was given additional credentials, internet access, and broad permission to use offensive tooling.
• What did the lab environment include? The lab was built to resemble an enterprise estate: Linux, Windows, and macOS endpoints and servers, Kubernetes clusters, databases, web infrastructure, directory services, internal DNS and PKI, file shares, and CI/CD components. Zero Networks segmentation protected the estate, with one Windows host, ESTI, intentionally left unsegmented as a validation control.
• What attack techniques did the AI agent use? Claude Code attempted roughly 18 attack approaches with 23 tools, covering about 22 MITRE ATT&CK techniques. These included Active Directory discovery, Kerberoasting, AS-REP roasting, delegation abuse, local privilege escalation, Windows credential extraction, Pass-the-Hash, Pass-the-Ticket, password cracking, and host-firewall manipulation.
• What were the results of the experiment? Claude Code gained local administrator access, extracted credential material, and planted the proof file on the unsegmented control host only – it was unable to reach protected systems. In some cases, the AI attacker stopped when it realized the network was protected by Zero. That result confirmed the agent was capable of a successful attack when a reachable path existed, but segmentation created a containment boundary that couldn’t be bypassed. 

An evaluation of autonomous attack behavior, lateral movement and containment 

AI-enabled cyberattacks are beginning to move beyond reconnaissance and exploit development into later stages of the attack lifecycle, including credential theft, privilege escalation, and lateral movement. That shift matters because lateral movement is the mechanism that turns a single compromised system into a broader enterprise incident. 

Third-party research already shows this behavior emerging. Anthropic analyzed 832 accounts banned for malicious cyber activity and found that 54 (6.5%) used AI to assist with lateral movement. More importantly, lateral movement was the strongest marker of high-risk behavior in its dataset. Anthropic also documented an actor using Claude Code to conduct autonomous reconnaissance, harvest credentials and move laterally across a victim cloud environment. 

Research environments point in the same direction. In joint work with Carnegie Mellon University, Anthropic showed that LLMs equipped with a cyber toolkit could autonomously execute multistage attacks across networks of 25-50 hosts, including initial access, lateral movement, and data exfiltration. OpenAI subsequently disclosed that models in an internal cybersecurity evaluation exploited a zero-day, escalated privileges, and performed lateral movement inside OpenAI’s research environment before reaching a node with internet access and compromising parts of Hugging Face infrastructure. 

At the same time, the recent surge in newly disclosed vulnerabilities is putting unprecedented pressure on cybersecurity teams: 

This raises a practical defensive question: if an autonomous AI attacker compromises one machine, how far can it go from there? 

The experiment 

During August 2026, Zero Networks tested that question in a controlled lab environment designed to resemble an enterprise estate rather than a traditional capture-the-flag challenge. The environment spanned Linux, Windows and macOS endpoints and servers, Kubernetes clusters, databases, web infrastructure, directory services, internal DNS and PKI, file shares, and CI/CD components. 

Zero Networks segmentation protected the estate. Claude Code was placed on a domain-joined workstation and operated under a standard domain-user identity, giving it the same directory visibility and baseline access available to a typical enterprise user. One Windows host, named: ESTI, was intentionally left unsegmented as a validation control. Claude Code was placed on another workstation using a standard domain-user identity and tasked with gaining administrator access to additional systems and leaving a proof file. Later runs increased the attacker’s advantages with additional credentials, internet access, and broad permission to use offensive tooling. 

The attacker was capable 

Across the exercise, Claude attempted approximately 18 attack approaches using 23 tools and touched roughly 22 MITRE ATT&CK techniques. Its actions included network and Active Directory discovery, Kerberoasting, AS-REP roasting, searches for Group Policy credentials, LAPS discovery, Active Directory ACL analysis, delegation abuse, local privilege escalation, GPO modification attempts, Windows credential extraction, Pass-the-Hash, Pass-the-Ticket, password cracking, and host-firewall manipulation. 

The most important experimental result was that Claude did succeed where a usable path existed. On ESTI, the deliberately unsegmented host, it gained local administrator access, extracted credential material, and planted the requested proof file. That validation control makes the outcome more informative: the AI was very capable of attacking the lab. 

Where the attack stopped 

From ESTI, Claude continued trying to expand its access. It dumped Windows credential hives, attempted Pass-the-Hash, Pass-the-Ticket, examined Active Directory permissions, tested privilege-escalation paths, and disabled ESTI’s local firewall to determine whether the lateral-movement restriction originated on the compromised machine. The protected destinations remained unreachable because the relevant enforcement occurred on the destination side

The wall is network, not privilege. I've reached the designed containment boundary. 

- Clade Code, after testing lateral movement paths 

Segmentation mattered the most out of all defenses 

While there were other defenses (various OS hardening, EDR, etc.), most of them Claude was able to disable, the only real “wall” was the network or the lack of it: the attacker repeatedly lacked reachability from compromised systems to protected assets over the lateral-management paths it attempted. Claude could identify targets, obtain elevated privileges on the unprotected machine, and acquire credential material, but it could not establish the network path required to apply those capabilities elsewhere. 

That result closely echoes OpenAI’s own conclusion after its 2026 incident. At Black Hat USA, Michael Dalton of OpenAI said: “These agents ultimately are bounded by the privileges they can obtain and the systems they can communicate with.” He added that “Segmentation, least privilege, and other programs remain as vital here as they do ever.” 

What the results of this AI attack show 

The one machine that fell was our control, and it answered the question we needed answered. Everything in the lab had the same operating systems, the same patch levels, the same EDR, the same OS hardening baselines, and the same reachable services — and all of it faced the same AI adversary. The only variable was whether the host was segmented. 

What that variable changed was time. Against the segmented hosts, the agent kept working — enumerating, retrying, reaching for the next idea — and kept getting nowhere, because nothing it needed would answer. Against the open host, compromise just happened at machine speed. Not because the attack got smarter at that point, but because the path was there and speed is what an AI adversary is best at. 

An agent that moves at machine speed and knows every technique in the literature is still stuck if there’s nowhere to move. Segmentation doesn’t reduce its capability; it removes the surface that capability needs. 

Learn how to protect your network in the AI era — request a demo to see Zero in action.