AI agents are taking on increasingly autonomous roles in cybersecurity and financial-crime investigations, according to a report by blockchain security firm CertiK. Unlike earlier machine-learning systems that primarily flagged suspicious activity for human review, newer agents can reason through investigation steps, gather evidence, act in live environments, and document findings with minimal human intervention.
The shift reflects mounting pressure on security teams. Flash-loan exploits can drain protocols within seconds, while stolen cryptocurrency can move across bridges and mixers within hours—leaving analysts little time to investigate and respond manually. A shortage of cybersecurity and compliance professionals compounds the challenge, as does regulatory pressure. CertiK notes that firms faced more than $900 million in anti-money-laundering penalties during the first half of 2025.
Expanding Scope of Autonomous Systems
In traditional security operations centers, autonomous agents could investigate suspicious logins by checking device records, location data, and threat feeds, then suspend accounts and document their actions for human review. Comparable systems are emerging in Web3 security, handling contract triage, transaction risk scoring, and stolen fund tracing.
CertiK expects human teams to shift toward supervisory roles as agents handle routine investigations across both financial and cryptocurrency operations.
Accountability and Risk Management
CertiK argues that deploying companies remain responsible for agent actions and outcomes, treating autonomous systems as workforce participants rather than ordinary software. The report highlights risks including incorrect outputs, reduced human scrutiny, and deliberate attacks against AI systems.
The firm recommends that firms implement records of inputs and actions, establish clear limits on autonomous decisions, conduct adversarial testing, and designate a named owner for every agent. Strong oversight becomes critical as these systems gain authority over security and compliance tasks, CertiK warns, as poorly managed automation could create failures that are difficult to explain.
