Traditionally software systems were built to withstand human attackers. Humans, whilst often using automations, were patient, limited in number, and working at human speed.
The main AI labs have over the past 6 months released frontier models that are capable of autonomous attaches, hacks and system breaches i.e. Mythos/Fable from Anthropic and GPT-5.6 Sol from OpenAI.
Agentic AI changes the game and we have seen numerous stories of agentic systems doing “unexpected” things to gain access to systems.
- AI agent hacks gym to get its user a spot in pilates class
- OpenAI and Hugging Face partner to address security incident during model evaluation
- Investigating three real-world incidents in our cybersecurity evaluations
AI can act autonomously to probe thousands of endpoints, chain together minor vulnerabilities, and run phishing campaigns at a scale and speed human security teams and systems were never designed to anticipate.
For many businesses both SME and Corporate day-to-day operations rely on multiple systems. That can be older ERP systems, bespoke line-of-business apps, or unpatched infrastructure. Unfortunately we now live in a world where the question isn’t whether AI-driven attacks will find the gaps it’s whether your defences can keep pace with the frontier model’s capabilities.
Here’s what hardening legacy systems against agentic AI actually looks like in practice.
Reduce the attack surface an agent can probe
- Audit every legacy system you operate to understand its exposed ports/interfaces, and any AI/LLM-based tools that touch it (chatbots, copilots etc). Agentic attacks often start by fingerprinting via error messages, banners, and verbose error responses. These are cheap for an AI to enumerate at scale.
- Strip out or make generic error messages, stack traces, and version banners from legacy UIs or endpoints.
- Put legacy systems behind a reverse proxy or API gateway rather than exposing them directly to the open web. This gives you a single hardened, monitored choke point instead of many old open ones.
Assume credential-stuffing and social engineering will be automated
- Enforce MFA (Multi-factor authentication) everywhere that you can, especially on anything with admin access to legacy systems. Agentic tools make credential-stuffing and phishing campaigns really easy to run automatically at scale.
- Train staff specifically on AI-generated phishing/vishing (deepfake voice, very fluent pretexting emails etc). Legacy systems are often breached via a human with valid credentials rather than a technical exploit.
- Rate-limit and monitor login attempts. Agentic tools can patiently probe over long periods to avoid triggering simple thresholds…you need to think like an agent to guard against them.
Patch management and compensating controls
- If legacy systems can’t be patched (common with older or bespoke line-of-business apps) you must isolate them using network segmentation, VLANs, and strict firewall rules so a compromised agent can’t pivot laterally across your systems.
- Virtual patching via a WAF (Web Application Firewall) / IPS (Intrusion Prevention System) in front of unpatchable systems. This approach blocks known exploit patterns even when the underlying code can’t be fixed.
- Agentic tools are good at chaining low-severity issues so please don’t deprioritise “minor” findings just because no single one is exploitable alone. The AI will find a way.
If you’ve added AI tooling on top of legacy systems
- Any chatbot/agent with access to legacy databases or APIs via an MCP connection or similar is a potential new attack surface via prompt injection. You need to sanitize inputs, constrain what actions the agent can take inside your systems, and never let an LLM-driven agent have full write/delete access without a human-in-the-loop check.
- Log and monitor agent actions distinctly from human actions so anomalous automated behaviour stands out. It’s not hard to do, but you will thank your future self if you do it now.
Detection tuned for machine-speed behaviour
- Traditional SIEM (Security Information and Event Management) thresholds are often tuned for human attack rhythms. Agentic attacks can run thousands of low-and-slow probes meaning anomaly detection (unusual request patterns, timing, sequencing) matter more than static rule thresholds.
- Honeytokens/honeypots on legacy systems are cheap and effective but an AI agent probing at scale is likely to trip them even when it wouldn’t trigger normal alerting.
IT / Organisation-wide governance
- Least privilege and regular access reviews: legacy systems often accumulate stale accounts and over-broad permissions over years. People leave the organisation, move between departments or get access to more systems and data over time. These are exactly what an agent will find and exploit.
- Incident response plans should explicitly cover “AI-accelerated” scenarios (e.g. an attacker using an agent to act within minutes of a leaked credential), since response times need to be faster than the old assumption of a human attacker at work.
Looking for help?
If all of this sounds a bit scary (it should btw) and you don’t know where to start simply pick up the phone to your current supplier or software vendor and start asking some uncomfortable questions.
Be aware that there will likely be costs to auditing and fixing any gaps found. That’s an investment you need to make. It’s simply not worth the risk of ignoring this.
Speak to Magnifica: We can audit, make recommendations and potentially fix your legacy systems and infrastructure.