Autonomous AI agents narrow exploit-to-fix gap
Human handoffs slow purple teams while AI-assisted attackers cut median CVE-to-exploit to about 10 hours; firms propose autonomous agents for continuous red-blue testing and fixes.
Security teams report that manual handoffs and slow approval processes are lengthening the time it takes to validate detections and deploy fixes, while AI-assisted attackers have reduced the median CVE-to-exploit interval to about 10 hours. Picus Security and other analysts examined 3,532 CVE-exploit pairs drawn from CISA KEV, VulnCheck KEV and ExploitDB and found the median time from public disclosure to a working exploit fell from 56 days in 2024 to 23 days in 2025 and to roughly 10 hours so far in 2026.
Analysts and practitioners describe routine defensive tasks that still take hours or days: copying hashes from PDFs into security tools, rebuilding red team scripts by hand so blue teams can run them, and waiting for change-approval windows before deploying patches. These steps create multiple handoffs between teams — SOC, red and blue teams, vulnerability management and IT operations — and produce a chain of tickets, reports and rework that delays remediation.
Researchers report that attackers using generative models can compress attack timelines. One study cited an AI-assisted attacker completing a compromise in about 73 seconds, while many organizations take at least 24 hours to deploy a confirmed fix. As a result, quarterly or monthly purple team exercises increasingly function as isolated tests rather than continuous validation of controls.
Security vendors and researchers are proposing an autonomous purple teaming model that uses chains of specialized AI agents to automate continuous red-to-blue testing while keeping humans in oversight roles. In the model described by Picus engineers, a threat intelligence agent ingests alerts and enriches them against the enterprise environment. A baseliner agent evaluates current exposure and posture using breach-and-attack simulation (BAS) and automated penetration test data. Red and blue agents run simulations in parallel and return a single action queue of prioritized responses.
Under the proposed workflow, low-risk fixes can be auto-deployed, moderate changes generate expedited tickets for human review, and complex remediations are flagged for human decision. A reporting agent produces both executive summaries and technical briefs. All steps are recorded for audit and can be overridden by human operators. Sıla Özeren Hacıoğlu, a security researcher at Picus Security, wrote that “When autonomous agents run the handoffs, the loop finally closes at machine speed.”
Picus engineers describe the approach as a progression: teams can begin with manual processes, add AI assistance for scheduling and enrichment, and move to end-to-end automation with human review for exceptions. Presenters plan to demonstrate architecture and operational details at the Autonomous Validation Summit on May 12 and 14, where practitioners from several enterprises and vendors will outline deployments and outcomes.
Companies promoting the model present three integrated components: continuous automated penetration testing from the red side, BAS-driven validation from the blue side, and AI-powered mobilization for orchestration and remediation. They report that the model produces faster validation of whether a vulnerability is exploitable against live controls, a prioritized actionable queue of fixes, and reduced manual ticketing.
Purple teaming originated as a collaborative practice to align offensive and defensive functions through iterative exercises. Practitioners report that coordination costs, tool fragmentation and organizational silos have limited adoption, and the acceleration of exploit development tied to generative AI has increased interest in automation aimed at reducing handoff delays.
