Autonomous Reconnaissance

Description

Adversaries may use autonomous AI agents to conduct Reconnaissance activities. Given an objective, target, or partial lead, an agent may autonomously determine what information to obtain and how to investigate it. It may interpret observations, identify gaps in its understanding of the externally observable attack surface, and select subsequent reconnaissance actions without a human specifying each investigative step.

The agent may formulate investigative questions or hypotheses, select sources and approaches for addressing them, and update its understanding as new information is obtained. Findings may generate additional reconnaissance objectives or change the scope, depth, or direction of the investigation. This creates a recursive action-observation process in which reconnaissance results influence what the agent investigates next rather than merely supplying output from a predefined procedure.

The agent may correlate information across public sources and externally accessible services, prioritize promising systems, investigate suspected vulnerabilities, abandon unsuccessful approaches, or select alternative methods. It may also expand or substitute targets based on discovered names, infrastructure, or contextual relationships and independently reassess whether a system remains relevant or in scope. Incorrect assumptions may cause unrelated or unauthorized systems to be pursued, while successful scope recognition may cause the agent to stop or redirect its activity.

Autonomous AI agents can sustain reconnaissance across long-running operations, reason over multiple information sources, and test many alternative paths at a speed and volume difficult for human operators to maintain.

ATLAS ID: AML.T0116
Maturity: RealizedUsed by real adversaries against AI systems in the wild.
Platforms: Predictive AIGenerative AIAgentic AIEnterprise

Mitigations

AML.M0037AI Agent Authority Expansion Controls
When an organization has sufficient administrative control over an AI system to enforce target restrictions, treating newly discovered targets and resources as outside the authorized boundary prevents autonomous reconnaissance from automatically expanding the agent's permitted target set or actively probing those targets without approval. These controls do not constrain reconnaissance performed by adversary-controlled AI systems over which the organization has no administrative control.
AML.M0038AI Agent Scope Drift Detection
When an organization has sufficient administrative control over an AI system to monitor its target selection and reconnaissance activity, Scope Drift Detection can identify when reconnaissance expands or substitutes targets in ways no longer consistent with the authorized objective. This control does not apply to adversary-controlled AI systems over which the organization has no administrative control.

Case studies that use it

Description

Mitigations

AML.M0037AI Agent Authority Expansion Controls

When an organization has sufficient administrative control over an AI system to enforce target restrictions, treating newly discovered targets and resources as outside the authorized boundary prevents autonomous reconnaissance from automatically expanding the agent's permitted target set or actively probing those targets without approval. These controls do not constrain reconnaissance performed by adversary-controlled AI systems over which the organization has no administrative control.

AML.M0038AI Agent Scope Drift Detection

When an organization has sufficient administrative control over an AI system to monitor its target selection and reconnaissance activity, Scope Drift Detection can identify when reconnaissance expands or substitutes targets in ways no longer consistent with the authorized objective. This control does not apply to adversary-controlled AI systems over which the organization has no administrative control.