From Human-Led Cybercrime to Agent-Orchestrated Crime: A New Forensic Imperative

Editorial Note

Abstract

Electronic crime is transitioning from human-controlled operations using traditional malware to sophisticated frameworks orchestrated by artificial intelligence agents. These agentic systems can autonomously plan tasks, utilize software tools, and divide complex criminal objectives among specialized sub-agents with minimal human supervision. Because of this shift, traditional digital forensics—which typically focuses on a single device, user, or account—is no longer sufficient. Instead, investigators must adopt an expanded, ecosystem-centered model to analyze distributed workflows spanning cloud services, application programming interfaces, and inter-agent communications. This evolution significantly complicates attribution, as investigators must differentiate between deliberate human instruction, autonomous AI decision-making, negligent configuration, and malicious deception or manipulation within the agent framework itself. To combat this emerging threat, investigative agencies cannot wait for these autonomous attacks to become widespread. Law enforcement, forensic laboratories, and technology providers must collaborate immediately to build multidisciplinary teams and establish new evidence-preservation requirements, methodologies, and standards capable of reconstructing complex agent-to-agent activity. Ultimately, our investigative capabilities must evolve to ensure readiness for a new era where cybercrime is executed by human operators directing networks of specialized artificial agents