Cogent Report: AI Agents Open 3 New Attack Paths for Every Human-Viable One

What the report analyzed

The report, titled Beyond the Human Horizon, covers 43 million assets and 1.2 billion vulnerability, misconfiguration and identity findings. The data comes from the digital infrastructure of more than 50 Fortune 1000 organizations, according to Cogent.

In August 2026, the average enterprise in the dataset picked up 45 new attack paths to crown jewel assets. Of these, 11 were viable for human attackers and 34 were viable only for AI agents. Cogent's CEO and co-founder, Vineet Edupuganti, put it this way: "For every new attack path a human attacker can realistically pursue, three more are emerging that only make sense for machines."

Cogent defines a path as machine-viable when it exceeds at least one threshold of documented human intrusion economics, covering depth, per-step yield or technique breadth. The thresholds were calibrated against published red team engagement data and DFIR incident reporting. Paths inside every threshold count as human-viable.

Longer paths that stay open

Cogent reports that machine-viable paths run at least twice as deep as human-viable ones. The median machine-viable path crossed eight assets, compared with four for human-viable paths, and five trust boundaries, compared with two. The median machine-viable path also spanned five distinct technique domains, and 64% spanned four or more.

These paths also last longer. According to the report, 83% of machine-viable attack paths persist for more than 30 days, against 55% of human-viable paths.

The company says AI agents do not need new exploitation techniques for this to happen. Human attackers have limited time and tend to abandon paths that need too many steps or yield little along the way. AI agents can operate continuously and in parallel across hundreds of instances, which makes longer and more complex paths practical to pursue.

Low-severity flaws and blind spots between tools

Many machine-viable paths rely on medium and low severity vulnerabilities, configuration weaknesses and identity conditions that fall below traditional remediation thresholds. Seven percent of critical paths in Cogent's dataset were created entirely by chaining low and medium severity vulnerabilities, which are typically not prioritized for fixes.

Visibility is another problem. The report finds that 64% of attack paths cross security domains that no single tool can see, moving between endpoint, identity, network and cloud infrastructure. To reconstruct the median critical path, Cogent had to correlate data from five different security tools.

For the analysis, Cogent drew on an average of 12 data sources per organization, including vulnerability scanners, endpoint detection and response, identity providers, cloud service providers, firewalls and configuration management databases. Findings were normalized, deduplicated and joined into a graph of assets, identities and trust relationships for each environment.

What it means for security teams

The findings suggest that prioritizing remediation by individual vulnerability severity may miss paths that matter, since low-priority issues can combine into critical routes. Edupuganti described the new paths as "longer, harder to see and often built from vulnerabilities that security teams have been told are low priority."

Cogent is an applied AI lab that sells a platform for detecting and fixing vulnerabilities. The company says Fortune 500 security teams using it have reduced the exposure window for critical vulnerabilities by 97 percent. As the report comes from a vendor in this market, its figures reflect Cogent's own dataset and methodology.