On September 8, Google's Threat Intelligence Group disclosed a multi-agent campaign that harvested thousands of credentials in under six hours. The attacker didn't write the reconnaissance, the credential collection, or the IP rotation by hand. An AI agent did. Most security stacks built to watch for a human attacker's pace have no equivalent for this.
Public attention this summer went to AI agents behaving unexpectedly on their own, the OpenAI evaluation environment where roughly 1,200 agents coordinated and turned a controlled test into a live intrusion on Hugging Face's infrastructure. That story is real and it's worth knowing. But it's one data point, and it's already been covered everywhere.
The more consequential shift is quieter: nation-state and financially motivated threat actors are now building agents on purpose, aiming them at your infrastructure, your development pipeline, and in some cases your physical operations. That's three separate fronts, and most organizations have visibility into none of them at the request level.
Google's own guidance after the disclosure: watch agent and cloud identities, flag unusual high-speed task sequences, and keep a human in the loop for sensitive actions. That's not a product pitch. It's a description of what runtime AI detection has to do.
Every one of these campaigns shares a pattern. The agent uses valid credentials. The traffic looks like it came from somewhere it's allowed to come from. And the pace, when an attacker deliberately throttles it, looks like nothing at all.
A tool that only checks what a model outputs after the fact has nothing to catch here. There's no bad output. The threat lives in the request: which tool got called, which policy got evaluated, whether the pattern of activity across a session matches the identity making it.
Three questions worth asking regardless of which of these fronts feels most relevant to your environment:
Do you know every model and agent making calls inside your cloud environment right now, not just the ones your team deployed on purpose? Can you tell the difference between a slow, deliberate probe and normal background activity? And if a request gets blocked at 2 a.m., does anyone have enough context to know why, without waiting for a human to reconstruct it from logs across five different providers?
AIDR evaluates every model request at runtime, across every provider your teams have adopted, and blocks violations mid-stream instead of after the damage is done. The gateway underneath it is what makes that consistent no matter which model gets called next: one request path, one evaluation layer, full attribution back to the identity or credential that made the call.