Agentic AI is an AI model that doesn’t just answer questions — it takes actions on its own. You give it a goal, and it plans the steps, runs them, checks the results, and adjusts. Standard chatbots wait to be told what to do next. Agentic AI works more like a junior staff member who can be sent off on a task and come back with the outcome. The reason the term is suddenly everywhere is that Google’s Threat Intelligence Group has just confirmed that China-linked attackers are deploying agentic tools like Hexstrike AI and Strix to automate vulnerability discovery against real corporate targets — and used an AI model to write the first known zero-day 2FA bypass intended for mass exploitation.

This matters because it changes the maths on cyber attacks. Where a human attacker might spend weeks probing a network, an agentic system can do similar work in hours, day and night, across thousands of targets. As The Hacker News reported, Google’s analysis caught the first AI-written exploit before it could be deployed. Australian businesses don’t have to be the specific target of a skilled human attacker any more — they just have to be running the same software the agent happens to scan. That widens the net dramatically compared to the old model where you had to be valuable enough for someone to bother with.

The practical takeaway for your business is not that AI is coming for you tomorrow, but that the speed of attack has shifted. Patching windows that used to be “this month” are now “this week.” Default settings on internet-facing tools matter more, because attackers now scan for them at scale. Multi-factor authentication is still essential, but the rest of the defences — monitoring, network segmentation, fast patching, decent endpoint protection — finally have to keep up with what attackers can run automatically. If your current IT setup quietly assumes attackers move at human speed, that assumption needs an update. Talk to your IT provider about whether your patching cadence and monitoring are keyed for the new tempo, or have a look at our cybersecurity page for what good looks like.