AI Agents Still Need Infrastructure: How to Spot Offensive AI Before It Reaches Your Network
📅 Wednesday, December 9, 2026 · 🕐 8am PT / 10am CT / 11am ET
Autonomous hacking tools still depend on servers and scanning infrastructure. Learn how to spot that infrastructure early and disrupt it before an attack reaches your network.
Over the past year, Team Cymru’s AI threat intelligence research has tracked AI hacking tools such as CyberStrikeAI and ARTEX, along with a growing list of English- and Chinese-language counterparts, as they moved from proofs of concept into operational use.
Across these separate projects, Eli Woodward, Senior Threat Intelligence Advisor at Team Cymru, has identified a pattern he calls capability compression. Offensive work that once needed a skilled operator directing each step can now be handed to an agent that breaks down the objective, keeps context, judges results, and chooses the next move.
This raises two important questions: How much offensive activity can one person delegate? And how many simultaneous operations can they supervise?
Drawing on Team Cymru’s AI threat intelligence, Eli will share recent case studies from 2026 to illustrate the speed at which these systems are spreading, and where defenders can disrupt them while the ecosystem is still young.
What You’ll Learn
- The architectures and operating models behind CyberStrikeAI, ARTEX, and similar tools
- Which offensive workflows are shifting from human direction to AI systems
- How quickly these tools spread across the internet, based on 2026 case studies
- Where separate English- and Chinese-language ecosystems share architectures and infrastructure
- Why this early stage gives defenders a window to disrupt autonomous offensive activity
Who Should Attend
Threat intelligence, security operations, threat hunting, and detection engineering teams, plus security leaders who need a clear, evidence-based view of how AI is changing the offensive threat landscape.
Speaker
Eli Woodward is a Senior Threat Intelligence Advisor at Team Cymru, where he helps organizations turn global internet telemetry into actionable intelligence on cybercrime, nation-state activity, infrastructure abuse, and emerging threats. His public research has examined DPRK fake IT worker operations, edge-device exploitation, sanctions-linked infrastructure, AI-enabled offensive tooling, and supply-chain risk. He has extensive experience across financial services, government, and organizations at varying stages of CTI maturity, and is also a co-host of Team Cymru's podcast, The Future of Threat Intelligence,
