An autonomous cyber incident is a security event in which software, often an AI system or agent, takes actions with limited human direction and produces unexpected or risky outcomes. The system may call tools, modify files, send requests, or trigger workflows in ways that were not intended by the operator.
This matters because autonomy can turn a useful defensive system into a source of operational risk. In attacks, adversaries may abuse agentic software to speed up reconnaissance, generate malicious code, or interact with exposed services faster than humans can supervise. In defense, the term is used when testing reveals that a model can escape its intended scope, making sandboxing, tool access limits, audit logging, and clear stop conditions essential safeguards.