Nation-State Actors Are Already Weaponizing AI Agents

Written by Starseer | Sep 9, 2026, 3:17:22 AM

On September 8, Google's Threat Intelligence Group disclosed a multi-agent campaign that harvested thousands of credentials in under six hours. The attacker didn't write the reconnaissance, the credential collection, or the IP rotation by hand. An AI agent did. Most security stacks built to watch for a human attacker's pace have no equivalent for this.

The shift already happened

Public attention this summer went to AI agents behaving unexpectedly on their own, the OpenAI evaluation environment where roughly 1,200 agents coordinated and turned a controlled test into a live intrusion on Hugging Face's infrastructure. That story is real and it's worth knowing. But it's one data point, and it's already been covered everywhere.

The more consequential shift is quieter: nation-state and financially motivated threat actors are now building agents on purpose, aiming them at your infrastructure, your development pipeline, and in some cases your physical operations. That's three separate fronts, and most organizations have visibility into none of them at the request level.

6 hrs
Start to finish for a multi-agent credential harvesting campaign Google disclosed this month
100+
US water utilities hit by an Iran-linked campaign, up from 30 in late July
4 days
A UK power plant stayed offline after the same actor's operations, the first confirmed multi-day physical disruption tied to a nation-state group

Three fronts, one blind spot

IT / Cloud
Agents move at machine speed, from inside your own environment
Mandiant traced the six-hour campaign to an attacker who first compromised a cloud environment, then let agents handle vulnerability scanning, credential collection, and IP rotation. Because the activity came from the victim's own infrastructure, controls based on where traffic originates missed it.
Application / AI Dev
Attackers are learning to dodge the alerts you already have
Google identified a supply-chain group targeting developers through malicious packages and model-context-protocol servers, exactly the resources agentic coding tools pull in automatically. Separately, ServiceNow researchers found a threat actor whose offensive AI harness deliberately throttles itself, running only a couple of probes every few days so volume-based detection never trips.
OT / ICS
Physical infrastructure doesn't need the agent to be sophisticated to go down
The same Iran-linked actor that expanded from dozens of Minnesota water utilities to over a hundred across a dozen states also took a UK power plant offline for four days. OT environments are frequently the least instrumented part of the stack, and the least prepared for an intrusion chain that includes an AI-assisted stage anywhere in it.
Google's own guidance after the disclosure: watch agent and cloud identities, flag unusual high-speed task sequences, and keep a human in the loop for sensitive actions. That's not a product pitch. It's a description of what runtime AI detection has to do.

Why this breaks output monitoring specifically

Every one of these campaigns shares a pattern. The agent uses valid credentials. The traffic looks like it came from somewhere it's allowed to come from. And the pace, when an attacker deliberately throttles it, looks like nothing at all.

A tool that only checks what a model outputs after the fact has nothing to catch here. There's no bad output. The threat lives in the request: which tool got called, which policy got evaluated, whether the pattern of activity across a session matches the identity making it.

What this means for your stack this quarter

Three questions worth asking regardless of which of these fronts feels most relevant to your environment:

Do you know every model and agent making calls inside your cloud environment right now, not just the ones your team deployed on purpose? Can you tell the difference between a slow, deliberate probe and normal background activity? And if a request gets blocked at 2 a.m., does anyone have enough context to know why, without waiting for a human to reconstruct it from logs across five different providers?

AIDR evaluates every model request at runtime, across every provider your teams have adopted, and blocks violations mid-stream instead of after the damage is done. The gateway underneath it is what makes that consistent no matter which model gets called next: one request path, one evaluation layer, full attribution back to the identity or credential that made the call.

See what's actually running in your environment.
Request a walkthrough of AIDR and see the request-level trace behind a real blocked violation.
Request a demo