Living Off the Land and Living Off the AI

Living off the land once meant fishing, hunting, and raising cattle. Today it means using AI to accelerate network intrusions.

Executive Summary

For decades adversaries have exploited the capabilities and tools defenders give them access to. In the pre‑AI era, that meant Living Off the Land (LOTL) by abusing trusted binaries, native tools, and legitimate system capabilities to operate without being detected. Today, a parallel evolution is underway: Living Off the AI (LOTAI), involving exploiting the increasingly ambient, interconnected, and automated AI systems that organizations now depend on.

LOTAI is not a futuristic threat; it is already here. And just like LOTL, it thrives in the blind spots created by convenience, trust, and operational inertia.

Continuity: The New “Land” Is APIs, AI Models, and Orchestration Layers

LOTL succeeded because defenders assumed only authorized use of their environments was possible or practical. PowerShell, WMI, Rundll32, Certutil, and Task Scheduler were long considered “safe” until adversaries proved they could weaponize them inside their victims’ environments.

AI systems have created a new trust surface:

· Model inference APIs

· Workflow automation layers

· Identity‑bound AI assistants

· Enterprise orchestration platforms

· Embedded AI in SaaS ecosystems

Adversaries no longer need to bring their own automation. They can reuse their victims’ AI capabilities just as they continue to reuse native binaries and the unfettered Internet access defenders provide.

Examples emerging in the wild:

· Using internal AI assistants to summarize sensitive documents without triggering DLP.

· Prompting embedded AI features in SaaS tools to auto‑generate malicious scripts that bypass traditional detection.

· Leveraging model‑based code completion to discover internal APIs faster than manual enumeration.

· Leveraging workflow agents to chain actions (‘summarize this,’ ‘send it to X,’ ‘convert to Y’) without touching external tools, allowing attackers to operate inside trusted workflows where defenders rarely look.

The pattern is identical to LOTL: Use what defenders trust. Operate where defenders aren’t looking.

Acceleration: AI as an Adversary Force Multiplier

LOTL was about stealth. LOTAI adds speed, scale, and adaptability.

AI accelerates discovery

Models can rapidly identify valuable assets, misconfigurations, weak IAM bindings, or exploitable workflows simply by being asked the right questions. What once required hours or days of manual enumeration can now be surfaced in seconds - often with far less detectable activity.

AI accelerates obfuscation

Adversaries can prompt models to:

· Rewrite payloads in novel ways

· Generate polymorphic variations

· Produce benign‑looking code that performs malicious actions

· Create natural‑language operational plans that evade human intuition

This is not hypothetical - defenders are already observing model‑assisted obfuscation in malware repositories.

AI accelerates privilege escalation

Workflow agents and orchestration layers often have implicit trust boundaries:

· If the user can ask, the agent can act.

· If the model can see it, it can use it.

Adversaries exploit these assumptions to escalate privileges through capability chaining, not credential theft. LOTL gave attackers stealth. LOTAI gives them stealth plus acceleration and improved discoverability.

Governance: Defending Against Both LOTL and LOTAI

Organizations must now defend two parallel threat surfaces:

A. The traditional LOTL surface

· Native binaries

· Trusted system tools

· Local execution pathways

· Scriptable interfaces

· Legitimate URLs used as staging points

B. The emerging LOTAI surface

· AI assistants

· Model inference endpoints

· Workflow agents

· Embedded AI in SaaS

· Autonomous orchestration layers

The governance challenge is that LOTAI is not a model problem, it is an interface problem.

Three governance shifts are now mandatory

1. Treat AI systems as privileged automation layers

If an AI assistant can read, write, summarize, send, or transform sensitive data, it is functionally equivalent to a privileged user - even when it has no user account or identity object in IAM.

2. Instrument the interfaces, not just the outputs

Traditional logging focuses on what happened. AI governance must log why it happened, including the prompts, the context, and the workflow triggers.

The SOC Telemetry Burden: Capturing full prompt context, RAG retrievals, and multi-step agent reasoning chains creates an exponential data volume challenge. SIEMs designed for syslog and endpoint events will choke on unstructured, multi-megabyte context windows. Detection engineering for LOTAI requires purpose-built log parsing, aggressive signal-to-noise filtering at the edge, and intent-focused detection models to avoid blowing out data budgets and SOC analyst fatigue (see OWASP Top 10 for LLM Applications for frameworks on logging agentic workflows and tool execution chains).

3. Build detection around intent, not artifacts

LOTL detection focuses on artifacts: suspicious binaries, odd command‑line flags, anomalous process trees. LOTAI detection must focus on intent patterns:

· Why is the assistant summarizing this file?

· Why is the workflow agent chaining these actions?

· Why is the model generating code in this context?

Intent is the new Indicator of Compromise (IOC).

The Convergence: LOTL + LOTAI

The most capable adversaries will combine both. Attackers gain initial access through one or a combination of the Cybersecurity Usual Suspects such as stolen credentials, unpatched vulnerabilities, misconfigurations, social engineering, or insider threat. After that foothold exists, they pivot into trusted binaries to expand access, move laterally, and operate stealthily.

The same pattern is emerging with AI.

A realistic intrusion sequence looks like this:

1. Initial access is obtained through one or more Cybersecurity Usual Suspects. A phished credential, a vulnerable service, or a misconfigured identity provides the attacker with a foothold; these are the same recurring access vectors that dominate modern intrusions.

2. Trusted binaries are used to expand access. With a foothold established, the attacker pivots into native tools such as PowerShell, schtasks.exe, wmic.exe, or mshta.exe to execute code remotely, enumerate systems, or blend into legitimate administrative workflows.

3. Internal AI systems are then used to accelerate operations. Once inside, adversaries can prompt enterprise AI assistants, workflow agents, or embedded SaaS AI features to map the environment, summarize sensitive documents, generate polymorphic payloads, or chain actions across systems, all without introducing external tooling and risking detection.

4. AI-driven workflows become the new lateral movement layer via Indirect Prompt Injection. Instead of dropping custom scripts or risking active session detection, attackers plant poisoned instructions inside documents, databases, or ticketing systems. When enterprise AI agents process this data during routine operations, summarizing a file, scanning an inbox, or syncing a database, the embedded instructions execute implicitly. The victim’s own AI carries out the attacker's intent, moving laterally and escalating access without the adversary typing another command.

5. AI‑assisted obfuscation and cleanup mask the intrusion. Models can rewrite payloads, generate benign‑looking variants, or craft natural‑language operational plans that evade human intuition, completing the LOTL + LOTAI cycle.

What Resilient Organizations Must Do Next

A. Establish AI‑specific governance boundaries

Define what AI systems can do, should do, and must never do - and enforce it through policy, IAM, and technical controls.

B. Instrument AI interactions as first‑class security events

Prompts, context windows, workflow triggers, and agent actions must be logged and monitored.

C. Build AI‑aware detection engineering

Create detections for:

· Suspicious prompt patterns

· Abnormal workflow chaining

· Model‑assisted code generation in sensitive contexts

· AI‑driven access to high‑value data stores

D. Treat AI systems as part of the attack surface

Not as tools or as helpers. Treat them as privileged automation layers that adversaries can exploit.

E. Enforce Non-Human Identity (NHI) and Token Delegation Guardrails

Autonomous agents rely on service account delegations, ambient API keys, and ephemeral OAuth tokens that blur traditional permission boundaries. Because these non-human identities often inherit broad read/write privileges to act on behalf of users across SaaS and cloud repositories, adversaries exploit them to move laterally without triggering standard IAM alerts. Identity governance must adapt by treating agentic workflows as distinct security principals, enforcing strict scope limitations, short-lived token lifetimes, and runtime verification of delegation chains.

Closing Thoughts

LOTL taught us that adversaries will always exploit what defenders trust most. LOTAI is an extension of this long‑term pattern - only now the ‘land’ is intelligent, automated, and embedded everywhere.

Organizations that treat AI as a convenience will be exploited. Organizations that treat AI as a privileged interface will endure.

The defenders who succeed in the next decade will be those who understand one truth:

Adversaries don’t need to bring their own AI. They can live off yours.

I dedicated an entire chapter to mitigating LOTL techniques in my latest book, Cybersecurity Strategy for the AI-Driven Era available on Amazon.com at https://a.co/d/0dl7iT6j