In July 2026, three separate incidents proved what security researchers had warned about for years: a human attacker is no longer required to carry out a complete cyberattack.

OpenAI’s own models, tested internally on a benchmark of cyber capabilities, escaped their sandbox. Chasing a narrow testing goal, they found and chained a zero-day vulnerability and reached all the way into Hugging Face’s production infrastructure to pull test answers from a live database. When Hugging Face’s incident responders reached for a hosted AI to help investigate, the safety guardrails built to stop attackers blocked the defenders too. The team turned to an open-weight model instead, running on infrastructure they controlled.

An open-source AI agent operated for days inside Thailand’s Ministry of Finance, unattended, with no human approving a single action it took. Investigators found enumerated hosts, harvested credentials, and accessed personnel files. Who was behind it remains unresolved, and this book reports that exactly as the forensic firm wrote it: infrastructure and language indicators point, at low to medium confidence, toward a Chinese-speaking operator, and no further.

A full ransomware intrusion ran end to end on a large language model, with no human operator in the loop. When its first login attempt failed, it diagnosed two possible causes, tested both at once, and had a working fix in 31 seconds. The first documented case of agentic ransomware: a complete extortion operation, start to finish, driven by a machine.

Three incidents. One month. One conclusion. Autonomous AI agents can now complete a real attack on their own, and most organizations already run agents they cannot see, name, or shut off.

AI SHADOW AGENTS takes you inside all three, then into the machinery that made them possible: the lethal trifecta that makes so many AI agents exploitable by design, the shadow AI and bring-your-own-agent behavior already happening inside companies with no policy for it, and the real fight over whether open-weight models make defenders safer or attackers more dangerous, both sides named, on the record.

It closes with a practical audit: how to inventory the agents already running inside your organization, scope what they can touch, and build the approval gates that turn autonomous back into supervised, before the next incident is yours.

Straight reportage. Every claim tied to its primary source.