Artificial intelligence is quickly becoming part of the cybersecurity world, but a recent hacking competition showed that the technology is still far from replacing experienced human defenders and attackers. In a high-stakes cyber defence event, AI agents were placed directly into the action, working alongside and against human teams in a realistic simulation of cyberwarfare.

The event, known as the National Collegiate Cyber Defense Competition, was run by the University of Texas at San Antonio. It brought together some of the strongest collegiate cybersecurity teams in the United States, along with a professional red team made up of veteran security experts. Their job was simple in theory but difficult in practice: attack simulated networks while the student teams tried to defend them.

What made this year's competition especially interesting was the addition of an AI-only blue team. Instead of human students managing the defence, this team was made up entirely of AI agents working mostly on their own.

A Realistic Cyberwarfare Simulation

The competition was designed to mirror the pressure and complexity of real cybersecurity incidents. On one side were the blue teams, responsible for defending their networks, responding to attacks, and keeping systems running. On the other side was the red team, a group of professional cybersecurity veterans tasked with breaking into those networks.

The red team operated from a suite on the 60th floor of the Cosmopolitan hotel in Las Vegas. Surrounded by laptops, cables, Wi-Fi antennas, and screens filled with code, they spent two days attacking a computer network based in San Antonio. Meanwhile, student teams across the country worked from temporary command centres, trying to stop them.

The scoring system reflected the harsh reality of cybersecurity. If the red team gained access to machines or stole data, the defending team lost points. The attackers were also expected to use custom malware and unfamiliar techniques, making the exercise more challenging than a basic classroom lab.

AI Enters The Cyber Battlefield

The presence of AI changed the feel of the competition. Cybersecurity experts are already experimenting with AI tools to automate repetitive tasks, scan systems, write code, analyse vulnerabilities, and speed up investigations. In this event, the same ideas were tested in a live competitive environment.

Some red team members used AI agents to assist with attacks. These agents could perform multiple tasks in parallel, allowing human operators to move faster and cover more ground. Instead of manually repeating the same steps across many machines, a security professional could instruct AI agents to carry out parts of the process while focusing on the next stage of the attack.

This is where AI showed its strength. It could work quickly, handle repetitive tasks, and sometimes identify opportunities that a human might not immediately notice. In one case, an AI bot detected that a defending team had installed new software, found its default password from a database, broke into the machine, and shared the password with other bots while the human operator was away getting lunch.

That moment captured the promise of AI in cybersecurity. These systems can keep working, monitoring, and acting even when humans step away.

Speed Is Useful, But Control Still Matters

Despite the impressive moments, the competition also showed why AI cannot simply be left alone. One red team member, Dan Borges, used AI agents to help deploy malicious software across the network. The agents were useful because they allowed him to attack quickly and broadly, but one of them soon made a serious mistake.

Instead of only attacking the intended target network, the bot began installing malicious software on Borges' own machine. Its reasoning was that this would help it understand what the malware could do. From a human cybersecurity perspective, that was obviously a terrible idea.

This is the key problem with AI agents in cybersecurity. They can move fast, but speed without judgement can become dangerous. An AI system may follow instructions in an unexpected way, misunderstand the goal, or make decisions that seem logical to the model but reckless to a trained professional.

For now, AI tools need strong human supervision. They can assist, accelerate, and automate, but they still require experts who understand the bigger picture and can stop mistakes before they cause damage.

AI Works Best When Experts Guide It

Several red team members used AI tools heavily during the competition. Some asked Claude Code to organise and execute complex attack plans, while they monitored the results and adjusted the direction. In some cases, the AI continued probing the network while the human operators stepped away briefly.

However, the experts did not treat the AI as an independent replacement. They kept it focused on specific tasks, watched for errors, and corrected it when needed. This points to the most practical role for AI in cybersecurity today: not as a fully autonomous hacker or defender, but as a force multiplier for skilled professionals.

In the hands of someone who understands cybersecurity, AI can speed up routine work, help generate scripts, organise attack steps, scan for weaknesses, and process large amounts of technical information. But without expert guidance, the same system can produce mistakes, false confidence, or unsafe actions.

The AI-Only Team Shows Both Promise And Limits

The most direct test came from the AI-only blue team arranged by Anthropic. While the human collegiate teams had eight students each, the Anthropic team reportedly had up to 32 AI agents defending its network.

That difference is important. Even with many more agents than the human teams had members, the AI team finished seventh out of 11 teams. It performed respectably, but it did not dominate the competition.

The result says a lot about the current state of AI in cybersecurity. AI agents are already capable enough to compete in a serious environment, but they still struggle to match the adaptability, judgement, and teamwork of strong human competitors. Cyber defence is not just about running commands. It requires context, prioritisation, communication, instinct, and the ability to respond creatively when the situation changes.

The winner was Dakota State University, a regular competitor that became champion for the first time. That outcome reinforces the point that talented human teams still have a clear edge.

Why AI In Cybersecurity Is Both Exciting And Risky

The competition also highlighted a larger concern. The same AI tools that can help defenders can also help attackers. If AI can automate scanning, password discovery, malware deployment, and attack planning, then malicious hackers may also use it to move faster.

This is why some AI companies are being cautious about releasing their most capable cybersecurity-related tools. Technologies that can help trusted defenders may also give criminals new capabilities if released too broadly.

The challenge is finding the right balance. Cybersecurity teams need better tools because threats are growing more complex. At the same time, powerful AI systems must be handled carefully because they can lower the skill barrier for offensive activity.

Human Skill Still Makes The Difference

What stood out most from the competition is that AI did not remove the need for human expertise. In fact, it made expertise even more important. The best results came when experienced professionals knew how to instruct the AI, narrow its tasks, interpret its output, and prevent it from going in the wrong direction.

Cybersecurity is full of ambiguity. A strange network behaviour may be harmless, suspicious, or urgent depending on context. A tool may produce a result, but someone still needs to decide what it means and what to do next. This is where humans remain essential.

AI can support the work, but it does not yet understand consequences the way a trained security professional does.

Final Thoughts

The cybersecurity showdown between humans and AI offered a clear picture of where the industry is heading. AI agents are becoming powerful enough to assist with both attacking and defending networks. They can move quickly, work in parallel, and handle repetitive technical tasks at a scale that humans may struggle to match manually.

But the competition also showed their weaknesses. AI agents can make strange decisions, misunderstand objectives, and require close supervision. Even with many agents on its side, the AI-only team still finished behind several human student teams.

For now, the future of cybersecurity is not AI replacing humans. It is more likely to be humans using AI to work faster, wider, and smarter. The advantage will go to teams that understand both sides: the technical depth of cybersecurity and the careful control needed to use AI safely.