Anthropic's September 2026 threat intelligence report describes a state-linked actor, tracked as GTG-20006, that built an operation around a genuinely new pattern: AI agents that monitor their own malware for detection and rebuild it automatically when it gets caught. The group's toolkit combined Windows implants, a mobile exploitation kit, a credential stealer targeting browser password stores, and a phishing platform mimicking government targets. What's notable isn't the toolkit itself but how it was maintained. Anthropic found that this toolkit was managed and re-tooled as needed during the cyber operations through AI-assisted workflows, and the actor also used AI to monitor how well their tools evaded detections from known security defenses. When something got flagged, the loop closed itself: if the monitoring AI agents identified that any deployed malware was detected by a security product, agents would set about autonomously modifying and rebuilding the malware to evade the existing detections, and continue iterating until it was undetected. This is a live example of exactly the accountability gap the agent-identity field keeps describing in the abstract. There's no signed record of which agent modified which binary, no verifiable chain showing what changed and why, no way for a defender to distinguish a human-directed patch from an autonomous one. The operation also reused stolen hotel WiFi vendor access and victim device data to expand targeting of people connected to Ukraine, folding consumer-facing infrastructure into a state espionage campaign with no attestation layer anywhere in that chain. The report's own recommendation is blunt: organizations should treat AI keys and agent integrations with the same level of seriousness as they do production credentials, because attackers already do. That's a credentialing argument, but the deeper problem it points at is evidentiary. Security teams can currently observe that malware evolved; they can't currently prove an agent did it, when, under whose authorization, or with what tool calls. The defensive equivalent of GTG-20006's detection-evasion loop would be a verifiable log of every autonomous modification an agent makes to its own artifacts — something closer to a build provenance record than a firewall rule. Right now that log doesn't exist on either side of this fight. Attackers have already automated iteration; defenders still can't automate attribution of what iterated. The gap isn't theoretical anymore. It's the operating model of an active campaign, documented with named toolkits and dated by the company that caught it.