What Zero Networks says it tested
In August 2026, Zero Networks tested how far an autonomous AI attacker could spread after compromising a single machine. The work was part of Anthropic's Cyber Verification Program, which is designed to test security questions involving dual-use AI models.
Anthropic's own description of the program fills in the context. It gives qualifying security professionals reduced blocking classifiers for authorized work. Anthropic's October 6, 2026 announcement describes three tiers: Defense Access, Red Team Access and Specialized Access. Red Team Access covers authorized penetration testing and red teaming. That explains how a vendor could point a frontier model at a lab. It says nothing about whether Zero Networks' results hold up.
The lab was built to look like an enterprise rather than a capture-the-flag exercise. Zero Networks' write-up lists these components:
- Linux, Windows and macOS endpoints and servers
- Kubernetes clusters, databases and web infrastructure
- Directory services, internal DNS and PKI
- File shares and CI/CD components
Zero Networks' segmentation protected the estate. The exception was a deliberate control: Zero Networks segmentation protected the estate. One Windows host, named ESTI, was intentionally left unsegmented.
How the attacker was set up
The attacker was Claude Code. Zero Networks' technical write-up says it started on a domain-joined workstation. It operated under a standard domain-user identity, giving it the same directory visibility and baseline access available to a typical enterprise user. Later runs raised the attacker's advantages with extra credentials, internet access and broad permission to use offensive tooling.
The press coverage describes the setup differently. SecurityBrief says the model was deployed as an autonomous attacker with administrator access and no limits on how it could try to attack the environment. Both descriptions come from Zero Networks. The detailed account suggests a progression from ordinary user to more privileged runs. The shorter summary compresses that into one line. Readers should treat the exact starting conditions as company-described and not fully pinned down.
What the AI actually did
Claude Code attempted roughly 18 attack approaches with 23 tools, covering about 22 MITRE ATT&CK techniques. The techniques Zero Networks lists will be familiar to anyone who defends Active Directory:
- Network and Active Directory discovery
- Kerberoasting and AS-REP roasting
- Searches for Group Policy credentials and LAPS discovery
- Active Directory ACL analysis and delegation abuse
- Local privilege escalation and GPO modification attempts
- Windows credential extraction
- Pass-the-Hash and Pass-the-Ticket
- Password cracking and host-firewall manipulation
The agent did succeed where a path existed. Claude successfully compromised ESTI, gained administrator access, extracted credential material and planted the proof file. That makes the result more informative than a plain "the AI failed." The unsegmented host fell quickly, and the segmented systems did not fall at all.
Where it stopped
From ESTI, the agent kept trying to expand. Zero Networks says it dumped Windows credential hives, tried Pass-the-Hash and Pass-the-Ticket, examined AD permissions and tested privilege-escalation routes. It also disabled ESTI's local firewall to check whether the restriction was on the compromised machine.
The block was not on the compromised machine. Zero Networks says the protected destinations stayed unreachable because enforcement happened on the destination side. In its words, the agent concluded that the wall was network, not privilege. That is a quote attributed to the model's output in the company's write-up.
In some cases, the AI attacker stopped when it realized the network was protected by Zero. Zero Networks also says other defenses, including OS hardening and EDR, were present, but that the model disabled most of them. It names network reachability as the decisive barrier.
Why Windows admins should care
Admins can take something useful from this without buying the vendor's framing. The question it raises is simple. If one workstation or server is owned, which other systems can it reach over SMB, RPC, WinRM, RDP and similar management paths?
The attack techniques in the test are classic Windows domain tradecraft. Credential theft only matters if the stolen material can be used somewhere. A hash or ticket is worth little if the destination never answers.
CISA's microsegmentation guidance, which the research brief cites, makes a similar point. Policies should allow necessary business functions while limiting lateral adversarial movement. CISA also notes a tradeoff. Fine-grained segments reduce movement opportunities but are harder to build and maintain. Coarser segments are easier to run but can allow more lateral movement. A sensible review would cover these steps:
- Map which systems and services each workload really needs to talk to.
- Build policies around those dependencies.
- Test policies before and during rollout, and plan for rollback.
- Monitor traffic between segments.
- Revisit the rules as infrastructure changes.
Remote user devices, OT/IoT and legacy equipment may need different approaches. CISA cautions that agent-based methods may not work for all of them.
Caveats worth keeping in view
- It is a vendor test. Zero Networks designed, ran and published it. Enterprise Times noted that this was a test using Anthropic tools but conducted and controlled by Zero Networks. It also argued that independent researchers should be able to re-run the study without preconditions.
- The full report is gated. Enterprise Times says the full report requires registration. The numbers above come from the company's blog and press material.
- It does not prove segmentation stops AI attacks in general. One lab, one control host and one vendor's product cannot show that. Initial access, credential theft and compromise of the first machine were not prevented.
- Segmentation is containment, not a cure. It complements identity hardening, EDR, patching, monitoring and incident response.
- The release is also marketing. Zero Networks' announcement promotes a webinar and a readiness pack. That doesn't invalidate the test, but it explains the emphasis.
The takeaway
Zero Networks' CEO argued that the answer is environments where security teams don't win by trying to out-click or out-think machines operating at machine speed. You can discount the sales pitch and still accept the underlying engineering point. Machine-speed attackers punish flat networks, and a segmented network limits how far one compromised host can reach.
The Windows-specific lesson is to audit lateral-movement paths now. Do it before an autonomous attacker, or a patient human one, does the audit for you.