AI Hackers Are Off the Leash. Here’s How to Hook Them

A little over a decade ago, Snehal Antani asked his IT staff to miss their kids’ basketball games to patch flaws he knew attackers could not exploit.

He was a chief information officer at GE Capital, and his scanners had flagged roughly 100,000 vulnerabilities as must-fix. “The hardest part of my job as CIO … was deciding what not to fix,” he told me in Singapore during the Singapore International Cyber Week. He called it “flying blind, throwing random darts.”

Antani knows why. “I didn’t really understand how cyberattacks happened,” he says. He saw the SolarWinds breach as the whole story, when it was only the front door. The damage came after, as attackers moved from system to system. “And I was a very experienced technologist at the time.”

In close to three decades in enterprise technology, I have met few vendor CEOs who start an interview with what they got wrong. Antani built a company on his.

He went on to serve as chief technology officer of Splunk and then as the first chief technology offcer of Joint Special Operations Command, a U.S. military command whose missions include counterterrorism. There, a commander told him: “Don’t tell me we’re secure. Show me and then show me again tomorrow and then show me again next week.”

Horizon3.ai is his answer. Its product, NodeZero, is an AI penetration tester: software that breaks into your live network the way a criminal would, links weak credentials and misconfigurations into a working attack path, then tests again to confirm your fix held.

Investors are buying this pitch. Horizon3 raised a USD250 million Series E in August at a valuation above USD2 billion, roughly triple the USD650 million it was worth 14 months earlier. It claims more than 7,000 customers, including the U.S. National Security Agency and the Cybersecurity and Infrastructure Security Agency. Those figures are Horizon3’s own.

Behind them sits a bigger bet. Antani wants no human approving what his machines do. For security leaders, the question is whether that makes a network safer, or only breaks it faster.

Fundamentals at machine speed

Ask what AI has changed for attackers, and Antani skips the Terminator or WarGames version. “These things are not doing novelty,” he says. They execute “the fundamentals flawlessly,” faster and at a larger scale than before. In an exercise with the NSA, NodeZero took control of a target in 77 seconds. Speaking as the attacker, Antani is direct: “If they can’t stop me in 76 seconds, it’s game over.”

Outside evidence points the same way, but with a catch. In November 2025, Anthropic reported that a Chinese state-sponsored group used AI agents to do 80% to 90% of the work in a spying campaign against about 30 targets. But the AI also “frequently overstated findings and occasionally fabricated data,” so humans had to check its work. Singapore’s Cyber Security Agency warns that agentic AI, meaning AI that plans and acts on its own, could shrink multiday attacks into hours.

Proof, not theory

Speed is half of Antani’s argument. The other half is about decisions, and he learned it in counterterrorism. Terror networks, he says, operated across the borders between military commands. They “live at the seams,” where “the coordination tax creates an opportunity”: the delay when two teams must agree before either can act. Companies have the same seams between the teams that secure cloud, identity and applications.

The seams reach the C-suite. When a CISO finds a critical exposure and the CIO fears an outage, who decides? If the CISO reports to the CIO, the CIO does. If they are peers, Antani warns of “analysis paralysis.” His fix is what NodeZero sells: proof that an attack worked, with every step recorded.

He gives boards a three-part test. Is the exposure “confirmed exploitable”? Is it “proven to be used by a threat actor”? Do leaders agree on the consequence for the business? Boards should stop accepting “theoretical” risk, he says, the kind most legacy scanners report: possible flaws that nobody has shown can be used.

“Anyone that builds an AI system that is humans in the loop or humans on the loop is destined to fail.” — Snehal Antani @ Horizon3

Proof cuts both ways. If NodeZero cannot map the network, your network segmentation worked. If it cannot break into a computer, your endpoint security did its job. “Nothing being found is also insightful,” he says. But he concedes there is “no way to guarantee zero false negatives,” meaning attack paths the tool missed. So the tool must show “what it tried, what worked, what failed.” That record is the real product.

By Horizon3’s own measure, the confidence gap is real. Its April survey found 97% of CISOs trust their endpoint tools to catch an attacker. Only 12% of organizations had tested that in the past three months. Buyers also doubt the cure. In a June report , Cobalt, which sells competing penetration testing services, found that only 9% of organizations would rely on AI penetration testing, down from 29%.

The math against human approval

Those doubts lead to the hardest question: Who approves what the machine does? I pushed Antani on it, because regulators still want someone to hold accountable. His answer: nobody.

Horizon3 ran almost 2 million agent hours in July, he says. One human approval per agent hour would need a 24/7 operations center with almost 2,000 experts. And people rubber-stamp anyway. Anthropic found that users of its Claude Code tool approve 93% of permission prompts.

“Anyone that builds an AI system that is humans in the loop or humans on the loop is destined to fail,” Antani says. In the loop means a person approves each action. On the loop means a person watches and can step in. Either way, a human approving an action “means you have a fundamental flaw in the design of your AI system.”

Humans review results instead. Where the payment card standard PCI DSS requires an independent, qualified tester, Antani says that tester can run NodeZero underneath and sign off on the findings. Safety, he argues, must be built into the system, not left to a reviewer.

The gullible machine

The AI that attacks at machine speed is also easy to fool.

Horizon3 tested 21 AI models against decoys, such as a fake password file planted to trap intruders. Human hackers fell for the traps about 37% of the time. The AI models fell for them about 78% of the time. Often a model flagged a file as a likely trap in its own reasoning, then opened it anyway.

Antani blames the training data. Public AI models learned hacking from capture-the-flag contests and published research, not from real corporate networks. “Last I checked, JPMorgan didn’t publish their network configurations,” he says.

So “well-placed deception is the cheapest, fastest, most effective way” to catch AI hackers, he argues. A year ago, he thought defenders had no chance against AI attackers. Now he believes the opposite, provided someone contains the attacker as soon as a trap goes off. Outside reviewers note the tests were narrow, and one independent replication conflicted. Still, one fake file is a cheap experiment.

What the machine sees

AI agents also open new doors. Antani showed NodeZero pulling Microsoft Teams sign-in tokens from a compromised computer’s memory, then using them to reach everything that user could access. AI coworkers and MCP servers, which connect AI tools to company systems, share the weakness, making agents “an extreme version of insider threat.” At Disney, one infected computer and stolen Slack credentials led to 1.1 terabytes of leaked data.

“Everything works in PowerPoint. Only results do the talking.” — Snehal Antani @ Horizon3

For chief data officers, Antani’s map of what attackers hunt is a checklist: the known crown jewels; forgotten copies of them, such as an export on a shared drive or a report left in a printer’s memory; and data that is dull alone but valuable together, such as credentials and privilege maps.

Horizon3 collects data of its own. “I’m a data company, pen testing is my sensor,” Antani says. Every test sends Horizon3 anonymized data about the attack, from the edge cases NodeZero exploited to how security controls were set up. It does not open financial files by default, he says. Still, your network’s weaknesses, minus your name, help improve a product your competitors may also use. CDOs should put the terms in the contract: how the data is anonymized, where it is stored and when it is deleted.

Where autonomy gets risky

Finding flaws is one thing. Fixing them is where the zero-human bet gets harder. When an attack fails, the result is a line in a report. When a fix fails, production systems can go down.

Horizon3 is spending Series E money on autonomous blue-team agents, defensive AI that fixes NodeZero’s findings without human approval. Antani’s design rule is a “constrained action space.” Give an agent too many tools and “it hallucinates, it gets distracted, and it fails very quickly.” Give it only a Phillips screwdriver, for the jobs that need one, and it performs. Ten security controls means ten narrow agents.

The logic holds. But these agents are still in development, and Horizon3 has not shown them working at the scale it claims for attack. Until it does, CISOs have a short list of questions for any vendor. When you find nothing, what exactly did you try? What will your agents never do? Where does my data go? How do you prove the fix? And when your agent changes my network, who owns the rollback?

The Singapore test bed

Antani’s next proving ground is Singapore. Horizon3 named the city its ASEAN headquarters last week, with support from the Economic Development Board and EDBI, which also invested in the Series E. Its Asia Pacific chief, Gareth Cox, has nine people here and expects 21 by year-end; Antani expects “maybe north of 200” across Asia next year.

His reveal: Antani wants Singapore as a test bed for maritime and port security and for advanced manufacturing security, citing “the advanced research we can do together as I scale up my team.” In those sectors, a badly chosen exploit could stop a crane or a production line. That makes them the hardest test yet of Horizon3’s claim to be “production safe.”

What Singapore does not have yet is a home for the data. In August, Horizon3 opened a sovereign NodeZero instance in Sydney, so Australian test data stays in Australia. Antani called data sovereignty “a strategic requirement for any platform.” The Singapore announcement does not mention a local instance. For banks and critical infrastructure operators here, that is the first question to ask.

Which brings the story back to GE Capital. If Antani is right, next year’s CIO will not ask an admin to miss a basketball game for a flaw nobody can exploit. The machine will have proved which flaws matter. If he is wrong, the admin misses the game anyway, cleaning up after an agent that did not ask.

Image credit: iStockphoto/YuriyGreen