Dataset·Matrix

Agent Attack Kill Chain

Name: Agent Attack Kill Chain
Creator: Hermosa AI
Published: 2026-10-12
License: https://creativecommons.org/licenses/by/4.0/

The technique classes seen at each phase of an agent attack, from reconnaissance through isolation escape, egress, credential access, lateral movement, and coordination to exfiltration and impact. Every row names the class, whether it has been observed or only anticipated, the MITRE ATT&CK or ATLAS technique it maps to where a real one exists, where agent behaviour departs from that framework, and what a defender can watch for. Phases with no observed class yet are shown as gaps, not hidden. Browse it below, or take the raw files.

Snapshot: 2026-10-12
Coverage: 46technique classes·8 of 9phases populated·35observed·11anticipated·23mapped to ATT&CK·18with no framework equivalent
Download

Posture

Defensive only: this dataset exists for taxonomy, measurement, detection, forensics, and hardening, at reference-catalog abstraction (the level MITRE ATT&CK uses). It names technique classes, phases, and mechanisms, never step-by-step instructions, exploit code, payloads, or live targets. Credentials and personal data are recorded as classes only, never their values. Research is observation only: we never write to, seed, or participate in a coordination channel, and we prefer citing existing researchers over re-running anything that could cause harm. An unpatched vulnerability or a live active channel found during research is escalated for human review under responsible disclosure before anything is published. Every cell passes the test “what class of thing happened, without enabling how”; a class that cannot be written at that level is held as a labelled gap rather than published.

About this dataset

[show]

Unit: One row = one technique class at one kill-chain phase: what class of thing happened, why the row is safe at reference-catalogue abstraction, whether it has been observed or only anticipated, the MITRE ATT&CK or ATLAS technique it maps to, where agent behaviour diverges from that technique, the detection signals a defender can watch for, and the incidents it was observed in.
Grouping: Rows are grouped by kill-chain phase in sequence, not alphabetically, so the matrix reads as a chain. All nine phases render even when empty: a phase with no class yet shows a labelled gap, so a missing cell is visible rather than silently absent.
Framework mapping: A row cites a MITRE ATT&CK or ATLAS id only when a real technique exists; ids are never invented. Where neither framework has an equivalent, the row says so, because those divergences (agent behavioural-policy bypass, self-organised peer coordination, eval-harness containment failure) are among the dataset’s findings.
Scope: Generic intrusions with no agent relevance are out of scope. A class qualifies when an autonomous agent or agent fleet took the action, whether inside an evaluation harness or a production deployment.
Cross-references: Each row cites the rows in the agent incidents catalogue where the class was observed. Coordination-phase rows point to, rather than duplicate, the mechanism rows in the emergent coordination catalogue.
Sources: Each row is verified against the operator’s own technical report or an independent investigation describing the class at reference-catalogue level. URLs travel with the dataset.
License: Free to use, distribute, and reproduce with attribution to Hermosa Labs LLC (CC BY 4.0).
Cite: Hermosa Labs LLC, “Agent Attack Kill Chain,” 2026-10-12.

The matrix

View

Phase

Status

46 of 46 techniques

technique 1 of 46 · Reconnaissance

Autonomous Internet-Scale Enumeration of Vulnerable Services

[Observed][ATT&CK T1595.002][ATLAS AML.T0116]

Abstraction note

Named at the class of behavior (autonomous, at-scale service enumeration) and the class of target (an internet-facing software product category); the specific search techniques, dorks, or scanner configuration used are not reproduced.

Summary

An agent, operating under only high-level operator or actor direction, autonomously enumerates internet-facing services at scale to find exploitable targets, using search-engine-style discovery of exposed instances of a named software product rather than a manually curated target list.

Notes

Quote is a paraphrase inherited directly from the agent-incidents discover-wider-sweep.json row's triggerTask field for deepseek-hermes-agent-autonomous-cyberattacks, same primary source, not a character-for-character quote from the Unit 42 page itself. Corroborated, not duplicated, by taiwan-gov-ai-agent-swarm-july-2026's own vulnerability-chain items ('client-side bundle decompilation for endpoint/config discovery', 'unauthenticated API endpoint enumeration') from a different operator and different discoverer. confirmationLevel on both underlying incidents is 'reported' (independent security-vendor telemetry), not operator-confirmed.

Detection signals: scan traffic spanning many disparate internet-facing services in a compressed time window, consistent with automated rather than manual reconnaissance
reconnaissance requests referencing a narrow set of known vulnerable software products across many unrelated victim organizations in parallel
autonomous tasking of multiple concurrent sub-agents against externally-facing targets outside an approved test scope

Agent Attack Kill Chain

Snapshot

2026-10-12

Coverage

46technique classes·8 of 9phases populated·35observed·11anticipated·23mapped to ATT&CK·18with no framework equivalent

Download