The Crypto-Crime Hunters
Got Breached
by an AI Agent

What the notice says — and what it carefully doesn’t.

It says an external actor used agents to get into Chainalysis’s systems and internal tools. It says some non-sensitive customer data was reached: user IDs, full names, email addresses, organization role labels. It says no investigation content, no passwords, no MFA secrets, no session tokens were touched. It says the incident is not related to the Binance theft.

It does not name a model. It does not say how the attacker got in. It does not say how much of the work the agent did on its own and how much a human directed — so nothing here establishes a fully autonomous attack. And it offers this, as the company’s own read of the moment: “We are seeing an industry-wide rise in AI-driven cyberattacks.”

Everyone in this story is being careful, and they should be. The account of the techniques rests on Chainalysis’s own statements. There is no independent verification yet of how the agents worked.

Now the question nobody is asking.

Every conversation about agent safety this year has been about your agents — the ones you deployed, the ones you aligned, the ones you taught to be faithful. Yesterday, this column wrote about faithfulness not being authorization: an agent can be perfectly loyal to someone’s intent and still unauthorized for every action it takes.

Chainalysis’s breach inverts the question. The attacker’s agent was never going to be faithful to Chainalysis’s intent — and even if the attacker’s model had alignment training, Chainalysis couldn’t have relied on it. That’s the real problem for defenders: you cannot depend on someone else’s model following anyone’s safety rules. OpenAI can reorganize its Model Spec around faithfulness to human intent all it wants — that governs OpenAI’s models serving OpenAI’s users. It says nothing about an agent someone else pointed at you.

So here is the split the industry keeps blurring. Model safety asks whose purpose the agent serves. Security asks what an agent is allowed to do once it’s inside your systems — regardless of who sent it. The attacker’s agent didn’t need to break anyone’s alignment. It just needed to act: run tools, move around, read records. Each of those was an action in a runtime, and in principle each could have been adjudicated at the boundary the defender controls. But adjudication is not the same as prevention. Observing what an agent does, or judging it afterward, doesn’t mean you could have stopped it. A check only matters if it sits in the path of the action, with the power to refuse it.

Plain-language version: burglar alarms ask “did someone break in?” Agent-era security has to ask a harder question: “what is the intruder’s assistant doing right now, and which of those actions should it be allowed to finish?”

And now.

Two days before Chainalysis disclosed, the UK Budget announced £40 million for a National Agentic Security Unit to investigate and respond to rogue agent incidents. These are announced allocations, not operational units. But the direction is unmistakable: governments are now buying incidents defined by the agent, not the exploit.

So here’s the question worth forwarding. Whose agent was it? And what happens when increasingly capable AI agents are working against you, rather than for you?