Google Urges Modular Red-Team Agents as Cyberattacks Move Toward Machine Speed

Google Red Teams wants defenders to prepare for agentic attackers by building agents of their own. Its proposed path is not a fully autonomous system from day one, but a collection of modules for reconnaissance, initial access and lateral movement that can eventually be coordinated into an end-to-end attack simulation.

An uneven incentive to automate

The argument is not that every intruder will hand critical operations to an unpredictable agent. Google says highly targeted actors have reason to preserve precision and avoid exposing costly tools or hard-won access. Ransomware operators and initial-access brokers, by contrast, can accept a loss of precision when automation delivers greater volume and lower labor costs.

That split shapes Google’s threat model. It identifies three expected effects of agentic attacks: more widely available offensive sophistication, campaigns that scale without equivalent human staffing, and a shrinking interval between an initial foothold and action on an objective. The last is a direct challenge to security operations built around an analyst reviewing an alert before a consequential action occurs.

A forecast with a thin intelligence base

Google explicitly concedes that concrete threat intelligence on what real-world actors are building with malicious agents is still limited. The scenarios that follow are forecasts, not a catalog of confirmed operational deployments. That qualification matters: the company is asking security teams to invest against a fast-moving capability gap before there is a mature record of adversary behavior.

One part of the forecast concerns access to capable models. Google expects open-weight models to reach the cybersecurity capabilities of today’s frontier models within six to 12 months. It also warns that open-weight systems can be modified to remove safety guardrails, a process it calls abliteration.

Projected uses

• Long-running, personalized social engineering built around cheap fake personas.
• Automated triage of compromised systems and lateral movement inside a network.
• Cheaper supply-chain compromises and malicious skill files for agents.
• Rapid creation of custom offensive tools and implants.
• Machine-speed exploitation of weak passwords, exposed credentials and excessive privileges.

Simulation rather than instant autonomy

Google’s answer is to use the attacker’s operating model as a test case. A red team would automate isolated pieces of its existing work, retain each as a subagent, and connect the modules through an orchestrator. Repeated exercises would add capabilities over time, with the intended result being an autonomous simulation rather than an immediate leap to a complete agentic system.

The proposed method also tests a different defensive problem: whether an organization can tell its legitimate employee agents from malicious ones, detect activity close to real time, and act without waiting for a person at every corrective-control step. Google argues defenders retain advantages because they know their own environments and can direct the same agent capabilities toward detection, triage and response.

The unresolved test is whether those advantages can be operationalized faster than attackers adopt the tools. Google describes autonomous attacks carried out by agents as an emerging shift, while acknowledging the available intelligence is early. Its red-team blueprint is therefore a preparation strategy under uncertainty: build a controlled version of the threat, then find where the organization’s response still depends on human-speed decisions.