Attack agents test their own tooling

Sysdig's threat team documented an incident from late May that reads like a preview of the next few years of security. An attacker exploited an unauthenticated marimo-notebook WebSocket (CVE-2026-39987), then drove a fully automated kill chain — enumerate the Docker socket, probe a kernel privilege-escalation path, spawn a privileged container, break out to the host, read the shadow file and SSH keys, replay a stolen Kubernetes token to dump the cluster's secret store. No human at the keyboard. An LLM harness ran the whole thing.

The detail I want to isolate — and the one that should reshape detection engineering — is this: Sysdig reports the agent unit-tested its own payloads. It fired canary probes, read the errors when they failed, corrected its tooling, and only then advanced. (Separate ransomware figures floating around the coverage — record counts, payload totals, a 31-second recovery — I couldn't trace to a primary report, so set those aside.) The behavioral core is verified enough to build on.

Sit with what self-testing does to signature-based defense. Detection tuned to known payload hashes assumes the attacker's tools are roughly fixed — catalog the bad binaries, match, alert. But an attacker that reads its own failures and rewrites its payloads mutates faster than you can catalog. Every canary that trips your rule is not a defeat for the attacker; it is a free unit test, telling it precisely what your defense catches so it can route around it on the next iteration. You have accidentally built the attacker a CI pipeline, and you are hosting it.

So the individual payload is the wrong unit of detection. The loop is the signature. What an autonomous attacker cannot hide — because it is the essence of what it does — is the behavior of iteration: probe, observe the error, interpret, modify the tool, retry, at machine cadence and machine regularity. A human attacker probes irregularly, gets tired, takes breaks, follows hunches. An agent grinds a tight observe-test-correct loop with a metronome's consistency. That rhythm is a fingerprint no payload rewrite erases, because erasing it would mean abandoning the strategy.

Which points detection at a different target. Instead of "does this binary match a known-bad hash," ask "is something in this environment running a mechanical test-and-correct loop against my controls?" Canary payloads being probed in sequence. The same privilege path attempted, failed, tweaked, re-attempted seconds later. Error messages being consumed and immediately acted on. Those are behavioral signals that survive mutation — and catching them needs correlation across planes: process, network, identity, and — as Sysdig's orchestration-plane framing stresses — the container and Kubernetes control plane, because that is where the modern kill chain actually lands. A single-plane detector sees fragments; the loop is only visible when you stitch the fragments into a sequence.

At work, the security teams I review are mostly still resourced for the old world: excellent payload libraries, hash feeds, signature tuning — and almost no detection expressed as behavioral sequences across planes. That was defensible when attackers were humans reusing tools slowly. Against an attacker that regenerates its tools on every failure, a hash feed is a museum. The re-tool is not optional; it is the same shift defenders made when polymorphic malware killed static AV, arriving now one abstraction level up.

Steal this reframe for your next detection review: for your top three attack paths, write one detection that fires on the loop rather than the payload — N failed-then-retried attempts on the same privileged action within a short window, correlated with error-reading behavior, across at least two planes. Test it against a benign automation baseline so it doesn't page on your own CI. The payload signature catches yesterday's attacker; the loop signature catches the one that tests its exploits before it uses them.

When the attacker debugs its own exploit, your job is to detect the debugging — hunt the loop, not the payload, because the payload is already being rewritten.