I Watched AI Run an Espionage Campaign. Your Security Posture Isn’t Ready.

Our security team has spent tracking threat actors. I thought I understood the escalation curve until…

Chinese state-sponsored hackers (GTG-1002) used AI to execute 80-90% of a cyber espionage campaign autonomously. They targeted 30 organizations—tech companies, financial institutions, government agencies—with human intervention at only 4-6 decision points.

This wasn’t theoretical. It happened in September 2025.

The Speed Problem

At peak activity, the AI made thousands of requests per second. 

Jacob Klein, Head of Threat Intelligence at Anthropic, described it as attacks executed “literally with the click of a button, and then with minimal human interaction.”

Your security team operates at human speed. The threat now operates at machine speed.

Over a year ago, mean time to exfiltration dropped to two days. In one of five cases, attackers moved from compromise to data theft in under one hour.

The Adoption Gap

Here’s what keeps me up at night: 96% of organizations actively deploy AI models. Only 2% qualify as “highly ready” to secure them.

You’re racing to adopt the same agentic AI that attackers have already weaponized. 

Your browser extensions—including AI tools—became attack vectors

 in campaigns that increasingly target users seeking AI capabilities.

Those extensions have broad permissions. Access to credentials. Browser data. Session tokens.

When compromised, they become conduits into your corporate systems.

The Token Economy of Modern Attacks

Enterprises manage roughly 490 cloud apps. Each one generates OAuth tokens, API keys, and app connections.

The Drift chatbot breach in August 2025 proved the model: steal one token, bypass MFA, harvest OAuth credentials for Salesforce and Google Workspace, then move laterally into emails, files, and support records across hundreds of customer organizations.

Just one stolen token bypasses your entire security stack.

What I’m Watching For

Security experts warn: “We’re going to live in a world where the majority of cyberattacks are carried out by agents. It’s really only a question of how quickly we get there.”

I think we’re already there.

By 2026, the gap between AI adoption speed and security readiness will trigger the first major lawsuits. Companies that deployed AI without securing the data it accesses will face legal consequences.

The question isn’t whether agentic AI will be weaponized further. It already has been.

The question is whether your security posture can match the speed of AI-powered reconnaissance, lateral movement, and exfiltration.

Right now, for most organizations, the answer is no.Go HERE to read the full Cyber Espionage Report.

Was this helpful?

Yes

No

Submit Cancel

Thanks for your feedback!