Canada’s Cyber Centre Warns Agentic AI Is Speeding Up Cyberattacks, Citing Storm-0940

Canada's cyber defenders have put out a warning that reads less like a prediction and more like a field report. The Canadian Centre for Cyber Security says agentic artificial intelligence is already accelerating cyberattacks, and it points to recent activity by a threat actor it calls Storm-0940 as the example. The bulletin, published on cyber.gc.ca and updated on November 10, 2026, describes a shift the Centre says it has expected for some time and now sees taking shape in real operations.

What the Cyber Centre actually said

The bulletin starts from a point most security teams already accept. AI has already made familiar threats stronger: easier to find weaknesses in software, to develop malicious code, and to attack many organizations at once. Agentic AI, in its view, goes a step further. Instead of helping with one task at a time, an agentic system can link separate stages of an attack and carry them out with less human direction. The bulletin calls this a long anticipated change that is now beginning to take shape, and it says the change matters because it compresses the time defenders have to notice something is wrong and respond.

Storm-0940 and the attack chain

The bulletin points to recent malicious activity by Storm-0940 as the example of what agentic AI can do in practice. According to the Cyber Centre, the actor used an agentic AI framework to carry out and coordinate several stages of a cyberattack. The framework could search for targets, test ways into systems, explore compromised networks, and seek greater access, rapidly and repeatedly, and across many organizations.

That list maps onto stages security teams know well: reconnaissance, initial access, lateral movement, and privilege escalation. None of those stages is new. What the bulletin says is new is the speed, the repetition, and the breadth: one framework, many organizations, and less waiting around for a human operator between steps.

The Centre is careful about where it places the emphasis. The most important development, it says, is not the identity of one threat actor or the details of one campaign. It is the emergence of a reusable framework that can help conduct cyber operations on an industrial scale. The worry is not Storm-0940 as such. It is that the same approach can be picked up by a range of different threat actors, which the bulletin describes as a fundamental evolution of malign techniques.

There are limits to what the bulletin discloses. It does not name victims, give dates, specify which agentic framework was used, or attach figures to the scale of the activity. The description of the Storm-0940 activity is attributed to a footnoted reference in the original document.

What has not changed, and what has

The bulletin states one limit plainly. Cyberattacks are not yet fully autonomous. Humans still choose the targets and set the objectives. The machine is doing more of the legwork between those decisions, which is a different problem from a machine deciding to attack on its own.

That distinction matters for how organizations should react. The positive reading, and there is one, is that nothing in the bulletin describes a new class of vulnerability. It describes faster use of the ones already known. Controls that were worth having last year are worth more now, because the adversary's patience is no longer the limiting factor.

Why this warning lands now in Canada

The timing is hard to miss. Canada is in the middle of a major public debate about artificial intelligence. The federal budget tabled on November 5, 2026, put AI at the centre of the government's growth strategy, with billions in spending tied to AI programs, data centres, and sovereign compute capacity. At the same time, recent polling reported by Abacus Data shows public opinion turning against the AI industry, with the share of Canadians naming AI as a threat rising from 10 percent in April 2026 to 26 percent in November 2026.

The Cyber Centre's bulletin sits apart from that political argument. It does not take a position on whether Canada should invest more in AI. It takes a position on what defenders should do given that attackers are already using it. It also arrives alongside a separate international development: on November 9, 2026, Canada joined five other countries and ten major AI companies in signing a joint declaration on frontier AI safety in Paris, committing to common evaluation standards and information sharing on AI risks. The bulletin is the domestic, operational side of the same picture.

What organizations should do next

The bulletin includes a section on what organizations should do, and the advice that follows from its analysis is straightforward. First, review how fast your environment detects and responds to repeated authentication attempts across many accounts, and check whether that detection runs continuously rather than in a weekly report nobody reads. A credential attack that runs all night should trigger an alert the same night.

Second, audit standing privilege, especially service accounts and long lived tokens. An automated explorer looking to seek greater access will find the account you forgot about before you do. Remove access that is no longer needed, and shorten the life of tokens where you can.

Third, confirm that admin paths require phishing resistant multi factor authentication, and that privilege escalation alerts actually page someone. An alert that lands in an inbox nobody monitors is not a control. It is a record of something that already happened.

Finally, the bulletin points organizations toward its guidance on preparing critical infrastructure and reporting cyber incidents. Reporting matters because the Centre's picture of the threat depends on what organizations tell it.

Frequently Asked Questions

What is agentic AI in the context of cyberattacks?

Agentic AI refers to AI systems that can carry out a sequence of tasks toward a goal with less human direction at each step. In the Cyber Centre's bulletin, it means a framework that can search for targets, test ways into systems, explore compromised networks, and seek greater access, rapidly and repeatedly, rather than waiting for a human operator to direct each stage.

Who is Storm-0940?

Storm-0940 is the name the Canadian Centre for Cyber Security uses for a threat actor whose recent activity it cites in the bulletin. The bulletin does not name victims or give dates, and the description is attributed to a footnoted reference in the original document.

Are cyberattacks now fully autonomous?

No. The bulletin states plainly that cyberattacks are not yet fully autonomous. Humans still choose the targets and set the objectives. What has changed is that AI systems are doing more of the work between those decisions, which shortens the time defenders have to detect and respond.