September 3, 2025

From PowerShell to Payload: Darktrace’s Detection of a Novel Cryptomining Malware

Cryptojacking attacks are rising as threat actors exploit hard-to-detect cryptomining malware. Learn how Darktrace detected and contained a cryptojacking attempt in its early stages using Autonomous Response, with expert analysis of the malware itself revealing insights into a novel cryptomining strain.

No items found.

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

No items found.

Sep 2025

What is Cryptojacking?

Cryptojacking remains one of the most persistent cyber threats in the digital age, showing no signs of slowing down. It involves the unauthorized use of a computer or device’s processing power to mine cryptocurrencies, often without the owner’s consent or knowledge, using cryptojacking scripts or cryptocurrency mining (cryptomining) malware [1].

Unlike other widespread attacks such as ransomware, which disrupt operations and block access to data, cryptomining malware steals and drains computing and energy resources for mining to reduce attacker’s personal costs and increase “profits” earned from mining [1]. The impact on targeted organizations can be significant, ranging from data privacy concerns and reduced productivity to higher energy bills.

As cryptocurrency continues to grow in popularity, as seen with the ongoing high valuation of the global cryptocurrency market capitalization (almost USD 4 trillion at time of writing), threat actors will continue to view cryptomining as a profitable venture [2]. As a result, illicit cryptominers are being used to steal processing power via supply chain attacks or browser injections, as seen in a recent cryptojacking campaign using JavaScript [3][4].

Therefore, security teams should maintain awareness of this ongoing threat, as what is often dismissed as a "compliance issue" can escalate into more severe compromises and lead to prolonged exposure of critical resources.

While having a security team capable of detecting and analyzing hijacking attempts is essential, emerging threats in today’s landscape often demand more than manual intervention.

This blog will discuss Darktrace’s successful detection of the malicious activity, the role of Autonomous Response in halting the cryptojacking attack, include novel insights from Darktrace’s threat researchers on the cryptominer payload, showing how the attack chain was initiated through the execution of a PowerShell-based payload.

Darktrace’s Coverage of Cryptojacking via PowerShell

In July 2025, Darktrace detected and contained an attempted cryptojacking incident on the network of a customer in the retail and e-commerce industry.

The threat was detected when a threat actor attempted to use a PowerShell script to download and run NBMiner directly in memory.

The initial compromise was detected on July 22, when Darktrace / NETWORK observed the use of a new PowerShell user agent during a connection to an external endpoint, indicating an attempt at remote code execution.

Specifically, the targeted desktop device established a connection to the rare endpoint, 45.141.87[.]195, over destination port 8000 using HTTP as the application-layer protocol. Within this connection, Darktrace observed the presence of a PowerShell script in the URI, specifically ‘/infect.ps1’.

Darktrace’s analysis of this endpoint (45.141.87[.]195[:]8000/infect.ps1) and the payload it downloaded indicated it was a dropper used to deliver an obfuscated AutoIt loader. This attribution was further supported by open-source intelligence (OSINT) reporting [5]. The loader likely then injected NBMiner into a legitimate process on the customer’s environment – the first documented case of NBMiner being dropped in this way.

Figure 1: Darktrace’s detection of a device making an HTTP connection with new PowerShell user agent, indicating PowerShell abuse for command-and-control (C2) communications.

Script files are often used by malicious actors for malware distribution. In cryptojacking attacks specifically, scripts are used to download and install cryptomining software, which then attempts to connect to cryptomining pools to begin mining operations [6].

Inside the payload: Technical analysis of the malicious script and cryptomining loader

To confidently establish that the malicious script file dropped an AutoIt loader used to deliver the NBMiner cryptominer, Darktrace’s threat researchers reverse engineered the payload. Analysis of the file ‘infect.ps1’ revealed further insights, ultimately linking it to the execution of a cryptominer loader.

Figure 2: Screenshot of the ‘infect.ps1’ PowerShell script observed in the attack.

The ‘infect.ps1’ script is a heavily obfuscated PowerShell script that contains multiple variables of Base64 and XOR encoded data. The first data blob is XOR’d with a value of 97, after decoding, the data is a binary and stored in APPDATA/local/knzbsrgw.exe. The binary is AutoIT.exe, the legitimate executable of the AutoIt programming language. The script also performs a check for the existence of the registry key HKCU:\\Software\LordNet.

The second data blob ($cylcejlrqbgejqryxpck) is written to APPDATA\rauuq, where it will later be read and XOR decoded. The third data blob ($tlswqbblxmmr)decodes to an obfuscated AutoIt script, which is written to %LOCALAPPDATA%\qmsxehehhnnwioojlyegmdssiswak. To ensure persistence, a shortcut file named xxyntxsmitwgruxuwqzypomkhxhml.lnk is created to run at startup.

Figure 3: Screenshot of second stage AutoIt script.

The observed AutoIt script is a process injection loader. It reads an encrypted binary from /rauuq in APPDATA, then XOR-decodes every byte with the key 47 to reconstruct the payload in memory. Next, it silently launches the legitimate Windows app ‘charmap.exe’ (Character Map) and obtains a handle with full access. It allocates executable and writable memory inside that process, writes the decrypted payload into the allocated region, and starts a new thread at that address. Finally, it closes the thread and process handles.

The binary that is injected into charmap.exe is 64-bit Windows binary. On launch, it takes a snapshot of running processes and specifically checks whether Task Manager is open. If Task Manager is detected, the binary kills sigverif.exe; otherwise, it proceeds. Once the condition is met, NBMiner is retrieved from a Chimera URL (https://api[.]chimera-hosting[.]zip/frfnhis/zdpaGgLMav/nbminer[.]exe) and establishes persistence, ensuring that the process automatically restarts if terminated. When mining begins, it spawns a process with the arguments ‘-a kawpow -o asia.ravenminer.com:3838 -u R9KVhfjiqSuSVcpYw5G8VDayPkjSipbiMb.worker -i 60’ and hides the process window to evade detection.

The program includes several evasion measures. It performs anti-sandboxing by sleeping to delay analysis and terminates sigverif.exe (File Signature Verification). It checks for installed antivirus products and continues only when Windows Defender is the sole protection. It also verifies whether the current user has administrative rights. If not, it attempts a User Account Control (UAC) bypass via Fodhelper to silently elevate and execute its payload without prompting the user. The binary creates a folder under %APPDATA%, drops rtworkq.dll extracted from its own embedded data, and copies ‘mfpmp.exe’ from System32 into that directory to side-load ‘rtworkq.dll’. It also looks for the registry key HKCU\Software\kap, creating it if it does not exist, and reads or sets a registry value it expects there.

Zooming Out: Darktrace Coverage of NBMiner

Darktrace’s analysis of the malicious PowerShell script provides clear evidence that the payload downloaded and executed the NBMiner cryptominer. Once executed, the infected device is expected to attempt connections to cryptomining endpoints (mining pools). Darktrace initially observed this on the targeted device once it started making DNS requests for a cryptominer endpoint, “gulf[.]moneroocean[.]stream” [7], one minute after the connection involving the malicious script.

Figure 5: Darktrace Advanced Search logs showcasing the affected device making a DNS request for a Monero mining endpoint.

Though DNS requests do not necessarily mean the device connected to a cryptominer-associated endpoint, Darktrace detected connections to the endpoint specified in the DNS Answer field: monerooceans[.]stream, 152.53.121[.]6. The attempted connections to this endpoint over port 10001 triggered several high-fidelity model alerts in Darktrace related to possible cryptomining mining activity. The IP address and destination port combination (152.53.121[.]6:10001) has also been linked to cryptomining activity by several OSINT security vendors [8][9].

Figure 6: Darktrace’s detection of a device establishing connections with the Monero Mining-associated endpoint, monerooceans[.]stream over port 10001.

Darktrace / NETWORK grouped together the observed indicators of compromise (IoCs) on the targeted device and triggered an additional Enhanced Monitoring model designed to identify activity indicative of the early stages of an attack. These high-fidelity models are continuously monitored and triaged by Darktrace’s SOC team as part of the Managed Threat Detection service, ensuring that subscribed customers are promptly notified of malicious activity as soon as it emerges.

Figure 7: Darktrace’s correlation of the initial PowerShell-related activity with the cryptomining endpoint, showcasing a pattern indicative of an initial attack chain.

Darktrace’s Cyber AI Analyst launched an autonomous investigation into the ongoing activity and was able to link the individual events of the attack, encompassing the initial connections involving the PowerShell script to the ultimate connections to the cryptomining endpoint, likely representing cryptomining activity. Rather than viewing these seemingly separate events in isolation, Cyber AI Analyst was able to see the bigger picture, providing comprehensive visibility over the attack.

Figure 8: Darktrace’s Cyber AI Analyst view illustrating the extent of the cryptojacking attack mapped against the Cyber Kill Chain.

Darktrace’s Autonomous Response

Fortunately, as this customer had Darktrace configured in Autonomous Response mode, Darktrace was able to take immediate action by preventing the device from making outbound connections and blocking specific connections to suspicious endpoints, thereby containing the attack.

Specifically, these Autonomous Response actions prevented the outgoing communication within seconds of the device attempting to connect to the rare endpoints.

Figure 10: Darktrace’s Autonomous Response blocked connections to the mining-related endpoint within a second of the initial connection.

Additionally, the Darktrace SOC team was able to validate the effectiveness of the Autonomous Response actions by analyzing connections to 152.53.121[.]6 using the Advanced Search feature. Across more than 130 connection attempts, Darktrace’s SOC confirmed that all were aborted, meaning no connections were successfully established.

Figure 11: Advanced Search logs showing all attempted connections that were successfully prevented by Darktrace’s Autonomous Response capability.

Conclusion

Cryptojacking attacks will remain prevalent, as threat actors can scale their attacks to infect multiple devices and networks. What’s more, cryptomining incidents can often be difficult to detect and are even overlooked as low-severity compliance events, potentially leading to data privacy issues and significant energy bills caused by misused processing power.

Darktrace’s anomaly-based approach to threat detection identifies early indicators of targeted attacks without relying on prior knowledge or IoCs. By continuously learning each device’s unique pattern of life, Darktrace can detect subtle deviations that may signal a compromise.

In this case, the cryptojacking attack was quickly identified and mitigated during the early stages of malware and cryptomining activity. Darktrace's Autonomous Response was able to swiftly contain the threat before it could advance further along the attack lifecycle, minimizing disruption and preventing the attack from potentially escalating into a more severe compromise.

Credit to Keanna Grelicha (Cyber Analyst) and Tara Gould (Threat Research Lead)

Appendices

Darktrace Model Detections

NETWORK Models:

· Compromise / High Priority Crypto Currency Mining (Enhanced Monitoring Model)

· Device / Initial Attack Chain Activity (Enhanced Monitoring Model)

· Compromise / Suspicious HTTP and Anomalous Activity (Enhanced Monitoring Model)

· Compromise / Monero Mining

· Anomalous File / Script from Rare External Location

· Device / New PowerShell User Agent

· Anomalous Connection / New User Agent to IP Without Hostname

· Anomalous Connection / Powershell to Rare External

· Device / Suspicious Domain

Cyber AI Analyst Incident Events:

· Detect \ Event \ Possible HTTP Command and Control

· Detect \ Event \ Cryptocurrency Mining Activity

Autonomous Response Models:

· Antigena / Network::Significant Anomaly::Antigena Alerts Over Time Block

· Antigena / Network::External Threat::Antigena Suspicious Activity Block

· Antigena / Network::Significant Anomaly::Antigena Enhanced Monitoring from Client Block

· Antigena / Network::External Threat::Antigena Crypto Currency Mining Block

· Antigena / Network::External Threat::Antigena File then New Outbound Block

· Antigena / Network::External Threat::Antigena Suspicious File Block

· Antigena / Network::Significant Anomaly::Antigena Significant Anomaly from Client Block

List of Indicators of Compromise (IoCs)

(IoC - Type - Description + Confidence)

· 45.141.87[.]195:8000/infect.ps1 - IP Address, Destination Port, Script - Malicious PowerShell script

· gulf.moneroocean[.]stream - Hostname - Monero Endpoint

· monerooceans[.]stream - Hostname - Monero Endpoint

· 152.53.121[.]6:10001 - IP Address, Destination Port - Monero Endpoint

· 152.53.121[.]6 - IP Address – Monero Endpoint

· https://api[.]chimera-hosting[.]zip/frfnhis/zdpaGgLMav/nbminer[.]exe – Hostname, Executable File – NBMiner

· Db3534826b4f4dfd9f4a0de78e225ebb – Hash – NBMiner loader

MITRE ATT&CK Mapping

(Tactic – Technique – Sub-Technique)

· Vulnerabilities – RESOURCE DEVELOPMENT – T1588.006 - T1588

· Exploits – RESOURCE DEVELOPMENT – T1588.005 - T1588

· Malware – RESOURCE DEVELOPMENT – T1588.001 - T1588

· Drive-by Compromise – INITIAL ACCESS – T1189

· PowerShell – EXECUTION – T1059.001 - T1059

· Exploitation of Remote Services – LATERAL MOVEMENT – T1210

· Web Protocols – COMMAND AND CONTROL – T1071.001 - T1071

· Application Layer Protocol – COMMAND AND CONTROL – T1071

· Resource Hijacking – IMPACT – T1496

· Obfuscated Files - DEFENSE EVASION - T1027

· Bypass UAC - PRIVILEGE ESCALATION – T1548.002

· Process Injection – PRIVILEGE ESCALATION – T055

· Debugger Evasion – DISCOVERY – T1622

· Logon Autostart Execution – PERSISTENCE – T1547.009

References

[1] https://www.darktrace.com/cyber-ai-glossary/cryptojacking#:~:text=Battery%20drain%20and%20overheating,fee%20to%20%E2%80%9Cmine%20cryptocurrency%E2%80%9D.

[2] https://coinmarketcap.com/

[3] https://www.ibm.com/think/topics/cryptojacking

[4] https://thehackernews.com/2025/07/3500-websites-hijacked-to-secretly-mine.html

[5] https://urlhaus.abuse.ch/url/3589032/

[6] https://www.logpoint.com/en/blog/uncovering-illegitimate-crypto-mining-activity/

[7] https://www.virustotal.com/gui/domain/gulf.moneroocean.stream/detection

[8] https://www.virustotal.com/gui/domain/monerooceans.stream/detection

[9] https://any.run/report/5aa8cd5f8e099bbb15bc63be52a3983b7dd57bb92566feb1a266a65ab5da34dd/351eca83-ef32-4037-a02f-ac85a165d74e

^{The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties.}

^{Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation.}

^{Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog.}

^{The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content without notice.}

No items found.

Inside the SOC

No items found.

•

September 2, 2026

Parvatha Ananthakannan

Senior Product Marketing Manager, AI

Watch the NIS2 Webinar

Blog

September 22, 2026

Darktrace / SECURE AI: Extending Behavioral Security for the Age of Agentic AI

AI is moving faster than the controls built to secure it

Over 80% of Darktrace’s customers now use generative AI services, and the average organization interacted with five different AI provides in August 2026¹. That level of adoption reflects how quickly AI has become embedded in day-to-day business operations. But as adoption accelerates, so do the opportunities for new forms of exposure that often operate outside traditional security controls. Prompts can expose sensitive information, an over-permissioned agent can turn a routine task into a serious security concern, and an employee using an unsanctioned AI tool to get work done can quietly introduce risk long before the security team is aware of its existence.

Securing AI isn’t a nice-to-have. It's an urgent, board-level requirement for any business that wants AI adoption to be an advantage rather than a liability.

Why traditional security controls fall short

The challenge isn’t a lack of AI security tools, it’s that most security solutions weren’t built for the way AI behaves.

AI systems are adaptive and, by nature, unpredictable. A prompt can be entirely benign in one context and a serious risk in another. An agent's permissions can look reasonable in isolation and dangerous the moment they're combined with what that agent is actually doing. Rule-based controls, built to catch known signatures and static policy violations, simply aren't designed to catch this kind of subtlety. They might be able to tell you what happened, but they can’t tell you if it mattered.

Effective AI security requires something different: a deep understanding of what normal looks like across every human, system, and agent in an environment, so the earliest signs of drift, misuse, or compromise stand out as they emerge.

Behavioral understanding is our foundation

Darktrace isn’t reinventing itself to secure AI. We’re extending what we already do. For over a decade, Darktrace has been built on a single premise – that every organization has its own unique, evolving way of operating, shaped by how its systems, users, and devices behave. Understanding that is the only reliable way to catch what rules and signatures miss. Our Adaptive AI™ continuously learns the distinct behaviors, relationships, and operational patterns of every enterprise it protects, building a Unique Behavioral Profile that no other vendor can replicate. It's how we've spent years interpreting ambiguity, uncovering subtle intent, and spotting drift before it becomes dangerous across networks, cloud, identities, email, OT, and endpoints. AI is a new domain, but behavioral security isn't a new discipline for us.

Introducing Darktrace / SECURE AI

Darktrace / SECURE AI helps organizations embrace AI innovation without losing control of how it is used. Delivered through the Darktrace Behavioral Defense Platform™, it provides visibility into AI activity across employees, agents, and AI systems, helping security teams understand how AI is being used throughout their business.

Darktrace then applies behavioral understanding to that activity, adding the context needed to distinguish routine usage from genuine risk. By understanding the relationships between users, agents, systems, and data, / SECURE AI helps organizations move beyond simply observing AI usage to understanding risk, governing behavior against policy, and enabling AI adoption with confidence. The result is greater oversight, stronger governance, and the ability to confidently accelerate AI innovation without creating unmanaged risk.

Securing your AI ecosystem

AI risk doesn't originate from a single source, and effective AI security can't focus on just one layer of the problem. Organizations need visibility, understanding, and governance across the entire AI ecosystem, from the prompts users submit and the agents they create, to the development environments where AI is built and the unsanctioned tools operating outside approved channels. Here's how Darktrace / SECURE AI helps organizations secure each of these areas.

Shadow AI management

Darktrace / SECURE AI helps security teams discover unsanctioned AI services and track usage trends over time using Darktrace telemetry and supported SASE integrations such as Microsoft Entra Global Secure Access. It also extends visibility to Model Context Protocol (MCP) usage, helping teams understand where AI tools and agents are connecting to external services. Through Darktrace platform integrations, organizations can block unsanctioned AI usage or quarantine affected devices when needed, helping them reduce exposure and guide users toward approved options.

AI prompt analysis

Prompts reveal what users are asking AI to do, what information they are sharing, and the outcomes they are trying to produce. Darktrace / SECURE AI provides visibility into prompts, sessions, and responses across supported platforms, including Microsoft Copilot, Copilot Studio, ChatGPT Enterprise, Claude, Salesforce, and AWS Bedrock². Behavioral analysis detects activity such as attempted jailbreaks, sensitive data exposure, and potential indirect prompt injection, while risk scoring helps analysts prioritize the sessions that need attention. Policy Manager maps organizational AI policies against prompt activity and surfaces potential violations, helping teams govern AI use with direct evidence instead of relying on fragmented logs or inferred intent.

AI agent identities and actions

AI agents have their own permissions, roles, relationships, and access to systems and data. Darktrace / SECURE AI brings agent identities together with the users interacting with them, giving security teams visibility into access, sessions, and connections across supported environments. A real-time audit trail helps teams continuously evaluate whether an agent’s activity remains aligned with its intended purpose, so they can identify excessive access or behavioral drift before it becomes a security issue.

AI agent development risk management

Many AI risks are introduced during development, when agents are created, permissions are assigned, and connections to data sources are established. Darktrace / SECURE AI provides visibility across both low-code and high-code environments. In platforms such as AWS Bedrock, teams can examine AI architecture and the agent identities involved in development and deployment. In low-code environments, such as Copilot Studio, they can observe agents as they are created, monitor whether behavior stays aligned with their intended purpose, and connect prompt activity during development with behavior in production. This helps organizations address misconfigurations and excessive permissions before they reach production.

The promise of AI, secured

The question isn't whether to adopt AI, it's whether security teams can enable secure adoption that allows every business to benefit from AI’s potential.

Darktrace / SECURE AI is built to solve this problem – extending a decade of behavioral understanding to the newest, fastest-moving part of the enterprise, using the same principles which already protect people and hybrid infrastructure.

‍

Darktrace / SECURE AI is generally available now. Discover the product, or get a demo today.

‍

[related-resource]

‍

[1] Based on aggregated Darktrace product telemetry across a fleet of ~8,200 observed deployments, measuring generative AI service usage across accounts monitored in August 2026. The 80%+ figure reflects the share of monitored accounts with any generative AI service usage during the same period.

[2] Microsoft, Copilot, ChatGPT, Claude, Salesforce, and Amazon Bedrock are trademarks of their respective owners.

About the author

Brittany Woodsmall

Senior Product Marketing Manager, AI

Blog

September 17, 2026

The Problem of Re-defining Human Value in the Agentic Age

Newsfeeds are constantly informing us about the rapid escalation of agentic AI systems. These systems move far beyond simple machine-based computations, and the focused, defined and bounded assistance that most AI systems started out as.

The next evolution of AI will harness the agentic properties of orchestration, automation, and heightened value-chains in IT, taking on the burden of workflow management, not just workflow delivery.

In nearly all of these instances, promises are made such as ‘this will free up human time’ or ‘this will allow people to focus on higher-order strategy’. However that message is delivered, one thing is clear: in ceding the orchestration and management of work to increasingly sophisticated AI agents and agentic systems, human value will be elevated to a particular and specific layer: the ability to judge its outputs. As AI takes on more tasks, humans should be able to focus on a higher level of governance; making sure the decisions that AI offers us are ethical, responsible and worthwhile.

But there are two major problems with that approach.

This blog discusses the problem of how Agentic systems are re-shaping how we review information, where we fit in, and when we make decisions. It also discusses the problem of how the increased flow of confident, generated information affects the way we make judgement. This blog considers how human judgement needs to adapt, and how a behavioral defense approach – using techniques pioneered by Darktrace – can help us do that.

The challenge of knowing where human judgement belongs

As we confer more automated decision-making to agentic systems, it might look increasingly less like ‘granting permissions’, and more like ‘surrendering authority’.

The judgement layer for AI-generated work is not a fixed boundary. We have become used to the idea of a ‘human in the loop’ (HITL) and, historically, relationships between humans and IT systems were reasonably clear and bounded. Computer and software systems were programmed to carry out certain tasks or automated functions, and humans could control the gates and decision points where actions were undertaken. Even across highly complex computational workflows, human interaction was a controllable node within the process; we were able to configure and regulate. But in the agentic age, where that human interaction sits, and what it can influence shifts every time AI systems are granted autonomy.

This leads us to the first problem: if humans are moving themselves (or are being moved) into the ‘judgement’ part of the value chain, exactly where and when do we exercise that judgement?

Humans are no longer the sole shepherds of computer-based or software-controlled outputs. We are at times at least one step further (and slower) behind the new agentic shepherds. We might also be blind to what they are doing. Not only might we be removed and blind to the actions of our AI shepherds, but with the challenge of unknown, unapproved AI systems operating beyond our control, humans might not even know that our work is being shepherded by an AI at all. Simply put, with the advent of greater levels of autonomy and orchestration, humans are at risk of not even knowing where to apply our newly-extended powers of strategic judgement.

Shadow AI – the use of unapproved AI systems or processes – is a growing threat to the role of effective governance and oversight. Shadow AI isn't just the AI you can't see. Its the AI you already know about being used in an unapproved way. The ability to generate effective oversight of the AI systems you use (or that are used on your behalf) will be increasingly important to ensure that human judgement in the AI value chain is effective, and deliberately placed.

The problem of what makes good judgement

The second problem lies in how flawed human judgement can be. Humans are historically, notoriously, and, sometimes dangerously, unreliable when it comes to exercising judgement. Humans are prone to the worst kinds of bias, the seduction of malign influence, and the sometimes-overwhelming urge to succeed. AI has long had a known flaw of operating with sycophancy, providing outputs that tend to agree with or flatter the human user. But as AI grows ever more effective, there is a risk of both hyper-enablement (where humans increasingly and knowingly enable AI despite potential harm), as well as the greater risk of suggestion. Both of these aspects could skew the newly-elevated input of human judgement.

Imagine a highly competent AI system that has just orchestrated and managed a dizzying array of processes and workflows. The AI is designed to present the human decision-maker with recommendations; based on analysis, comparison and other programmed factors. This is where the human judgement layer is enabled. But what if that judgement is summarily diffused by an AI-based recommendation that emulates the decision, provides plausible but unattractive alternatives, then suggests (or, worse, directs) the human end-user to take a particular course of action.

The risk here is that you are given a recommendation, tailored to your preferences (which the AI has learned, or which you have divulged), and which appears to make perfect sense. It appears to be a well-weighted recommendation, with sound arguments that tap into our inherent biases or inclinations so that a specific decision-path is followed. With the growth of agentic systems specifically designed to match user profiles (from Cowork agents to ‘digital twin’ models), the likelihood of agentic influence could badly skew human judgement or, at the least, devalue the proposition that humans are taking a higher-layer of strategic control over AI-based decisions.

If AI convincingly recommends something that may be problematic, it can be difficult to discern both accurate data, and the context required to make the right judgement.

Given the two problems described above, the job of exercising valuable human judgement in the agentic age can draw down to these two questions:

When should humans intervene in the agentic process?
How can we make the best possible judgement calls?

What humans contribute that AI cannot

For all the flaws that make human judgement unreliable, people have the edge over even the most sophisticated and powerful AI systems when it comes to issues such as ethics and social context. An AI system can, with startling granularity, rank the value of adopting a new business proposal: offering predictive metrics on costs, returns, market value, time-to-deliver operations, conformance with legal registers, etc. But it can’t tell if the business proposal is ethically sound, or if the business venture will potentially affect groups outside of the analyzed proposal. It can’t tell you if the CEO has a ‘bad feeling’ about this effort. It can’t tell you if this is the right thing to do.

The ability to add social context, balance complex interpersonal dynamics, understand nuance, and to go beyond what seems economically reasonable is where human judgement can add value.

Human judgement is difficult to encapsulate in metrics. And the way we train our development may need to adapt too. Rather than building up a gradual, experiential knowledge base, we should think about training the skill of judgement itself; especially for an agentic age.

How behavioral security strengthens AI governance

If this all feels like a vicious circle (‘I need AI help to make good judgements’ / ‘AI can twist what I need to judge’) it needn’t be. The key to this is having a defense-in-depth approach, with tools that can actually help.

This is precisely where behavioral security becomes important. The complex and nuanced way that humans exercise judgement is often rooted in our ability to recognize behavior that doesn't look right. We may not always be able to articulate it immediately, but we can often identify when an action, recommendation, or outcome feels inconsistent with the context around it. As AI systems take on more responsibility across the decision chain, preserving that ability to recognize meaningful deviations becomes increasingly important.

Darktrace’s / SECURE AI is designed to do exactly that. It applies behavioral security to AI ecosystems, helping organizations understand how people, AI tools, identities, and agents interact across the business. By learning the patterns of normal AI usage and surfacing activity that deviates from those patterns, it provides security teams with the context needed to investigate risk, understand unusual behavior, and make informed governance decisions. Rather than relying solely on predefined rules or assumptions, this behavioral understanding helps organizations distinguish between expected AI activity and behavior that warrants closer scrutiny.

This matters because we are already in an era of information overload. If humans are expected to elevate their value through strategic judgement, the ability to do this without being overwhelmed by data (good or bad) will be critical.

We need the ability to discern when we're being misled by AI, and whether our judgement calls are being made on the basis of accurate, contextual information. Darktrace / SECURE AI provides that additional layer of defensive security for activity we cannot easily see. Whether it is suspected Shadow AI or skewed recommendations, the net result is a protected organization, where users can more effectively use AI to make positive judgements.

For those where that judgement is a critical skill (both individuals, as well as those working in security teams), improving our metacognition - the ability to understand information in a broader context - will supercharge the value of human judgement. When those judgements are grounded in context rather than assumptions we have better information to make sound decisions.

Conclusion

Human judgement is a skill that is honed over time and experience. Darktrace’s / SECURE AI employs the same principles, but at machine-speed. Rather than influencing or directing, Darktrace / SECURE AI offers AI-enabled assurance; providing human-based judgement with the right context to make a balanced decision.

What we judge can be valued by the legitimacy of its outputs. For AI, those outputs are valued on the speed and accuracy of the information provided. Increasingly for humans, the value of our outputs will be based on the validity of our judgement, and how we justify our decisions in ways that engineer confidence.

Humans often know more than we can express, while AI is prone to expressing more than it truly understands. Humans can bridge the context AI often fails to appreciate. When that judgement is supported by relevant, impartial AI systems, this is the future space where good AI governance will be exercised.

‍

Discover Darktrace / SECURE AI.

[related-resource]

About the author

Jason Lusted

AI Governance Advisor

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: How Darktrace Detects Cryptomining: Threat Example & Walkthrough

From PowerShell to Payload: Darktrace’s Detection of a Novel Cryptomining Malware

What is Cryptojacking?

Darktrace’s Coverage of Cryptojacking via PowerShell

Inside the payload: Technical analysis of the malicious script and cryptomining loader

Zooming Out: Darktrace Coverage of NBMiner

Darktrace’s Autonomous Response

Conclusion

Appendices

List of Indicators of Compromise (IoCs)

MITRE ATT&CK Mapping

References

Botnet Behind the Camera: Mirai Katana Activity on a Video Recording Device

Darktrace / SECURE AI: Extending Behavioral Security for the Age of Agentic AI

Enjoying the blog?

More in this series

When AI Agents Attack: The Case for Behavioral Anomaly Detection

Hiding in Plain Sight: Uncovering a Multi-Stage Ransomware Attack Through Behavioral Detection

9 Stages of Ransomware & How AI Responds

Blog

September 22, 2026

Darktrace / SECURE AI: Extending Behavioral Security for the Age of Agentic AI

AI is moving faster than the controls built to secure it

Why traditional security controls fall short

Behavioral understanding is our foundation

Introducing Darktrace / SECURE AI

Securing your AI ecosystem

Shadow AI management

AI prompt analysis

AI agent identities and actions

AI agent development risk management

The promise of AI, secured

Blog

September 17, 2026

The Problem of Re-defining Human Value in the Agentic Age

The challenge of knowing where human judgement belongs

The problem of what makes good judgement

What humans contribute that AI cannot

How behavioral security strengthens AI governance

Conclusion