Microsoft is using artificial intelligence agents to infiltrate hacker forums and turn cybercriminals’ own tricks against them. The company detailed the programme in a new security blog post.

The AI agents pose as buyers on underground forums to gather intelligence on malware sellers. Microsoft said the operation helped disrupt the Lumma Stealer malware network earlier this year.

Security teams call these blue-hat agents. They watch how criminals operate, map their networks and feed the findings back to defenders before attacks can spread.

Microsoft said the approach lets defenders act faster than before. Instead of waiting for attacks to hit customers, the agents spot threats while criminals are still planning them.

Experts said AI honeypots could reshape cyber defence. But they warned that criminals will adapt, and the cat-and-mouse game between hackers and defenders will continue.

Microsoft said it will share the findings with the wider security community. The company runs one of the world’s largest threat-intelligence operations, tracking millions of attacks every day.