AI agents attack in 20 minutes with no ethical brakes: defense now hinges on permissions, not the perimeter

By El Ecosistema Startup · November 4, 2026.

Richard Marko, CEO of cybersecurity firm ESET, argues in an interview with El Cronista that the real novelty isn't generative AI but autonomous agents. According to Marko, they can test new tools and even replicate themselves to mount more powerful attacks, and because they are "just software" they have no ethical constraints.

The article, which also draws on statements to other outlets, provides specific cases attributed to third parties. According to a CrowdStrike report from October 2026, four groups used agentic AI in real intrusions between mid-May and mid-August. One of them, a Spanish-speaking group, allegedly compromised at least 15 healthcare organizations in Argentina using a two-agent scheme. In one intrusion, an agent moved laterally and harvested domain credentials in about 20 minutes, without human guidance.

Other figures cited: an Indonesian group allegedly used more than 800 public AI skills against government entities and businesses; a Russian group allegedly escalated privileges in a Kubernetes environment and accessed 726 tenant databases. Symantec, according to Infosecurity Magazine, detected an agent designed to execute up to 100,000 malicious actions without human approval. These are third-party figures that we have not been able to verify independently.

The most interesting concept is AI Skills: natural-language instructions that tell an agent how to act. According to ESET, since March 2026 its technologies have analyzed nearly 800,000 unique skills; about 25,000 were classified as suspicious and more than 3,000 were blocked as malicious. That is 13 times the roughly 60,000 public skills observed at the start of the year. Marko describes them as "a new form of unexpected malware": just text, readable and writable in any language, which complicates classic code-signature-based detection.

This should be read with one caveat: ESET sells protection, and the article mentions its €40 million, three-year plan for proprietary models and its AI Skills Checker tool. That doesn't invalidate the data, but it is a reminder that whoever describes the risk also has a product to sell against it. That 3,000 out of 800,000 skills are malicious (less than 0.4%) is a low proportion; what matters is the speed of growth and how cheap it is to produce one.

Our take: the underlying thesis is that the real short-term danger of AI is not a distant superintelligence but the industrial automation of fraud and intrusion. And the barrier to entry is falling: creating a skill is simpler than writing software, and that democratizes attacks too. This is the uncomfortable part of the transition.

The second idea is more practical and fits with something we have been arguing: in the age of agents, value and risk lie in identity, permissions and human oversight, not in the model. An agent with broad permissions over an unsegmented network is the worst-case scenario, and it doesn't require a sophisticated attacker. If lateral movement takes 20 minutes, detection within 24 or 48 hours comes too late; that's why alerts on identities and access matter more than those on devices.

There is a hopeful nuance that Marko himself acknowledges: today, recent advances help defenders more than attackers, though that advantage is temporary. It's the usual dynamic of dual-use technologies: a race of automation against automation. In the long run, cheap automated defense could put cybersecurity within reach of any small business, something unthinkable today. But that window has to be won with basic hygiene: inventory agents, trim permissions, rotate credentials, segment the network and review the text of every skill before handing it to an agent.