How Outtake built a cyber investigator on Claude

Summary

Outtake has built Recon Agent, an autonomous system that performs extended cyber investigations using Claude, Claude Code, and the Agent SDK. The agent addresses the acceleration of attacks that now combine public-data harvesting, AI-generated impersonations such as cloned login pages, and subsequent exploitation of internal systems. Rather than reacting to isolated indicators, it follows an entire attack chain by collecting evidence from an initial lure, tracing connected infrastructure such as fraudulent support accounts, and constructing a graph of the adversary’s network.

During an investigation the agent can read and write code, execute commands, and interact directly with malicious pages to observe where captured credentials are sent. It classifies the gathered material, reconstructs the sequence of attacker actions, profiles the threat actor, and produces a final report that documents both the findings and the investigative steps. These sessions operate without continuous human oversight; median duration is sixteen minutes, yet many runs extend beyond an hour and the longest recorded session reached two hours before returning results.

By unifying detection, evidence mapping, and reporting within a single agentic workflow, Recon Agent supplies the coordinated response that conventional point solutions lack when facing AI-augmented threats aimed at high-value targets.

Why it matters

This article provides a practical use case for Product Teams and Builders on how to leverage Claude Code and the Agent SDK to build long-running, autonomous AI agents. It offers valuable architectural insights for Dutch AI practitioners developing cybersecurity solutions or complex agentic workflows.