AI agents in attacks: what security teams are missing at request level

TL;DR: A multi-agent campaign harvested thousands of credentials in under six hours, with threat actors using AI agents for reconnaissance, credential collection, and IP rotation while blending into valid infrastructure traffic, according to Starseer reports. The key failure is request-level blind spots: monitoring output after the fact does not catch agentic abuse that moves at machine speed.

Editorial analysis by NHI Mgmt Group, based on content published by Starseer: “Nation-State Actors Are Already Weaponizing AI Agents”.

By the numbers:

• 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.

Key questions

Q: What breaks when an AI agent can reach trusted machine credentials?

A: The boundary between initial compromise and broader intrusion collapses.

Q: Why do slow, deliberate AI-driven attacks evade normal security monitoring?

A: Because many detection programmes key off volume, speed, or obvious malicious output.

Q: How should organisations govern AI agents that can provision cloud resources?

A: Treat them as machine identities with bounded authority, not as feature extensions of a human user.

Practitioner guidance

• Map every agent and model request path Inventory all production agentic workflows, including shadow deployments, and document which identities, credentials, and tools each request can touch.
• Move controls to issuance time Replace periodic review as the primary control with per-request authorization, scoped delegation, and session-level attribution for sensitive actions.
• Instrument request-level telemetry Log tool selection, policy decisions, credential use, and timing so analysts can reconstruct what the agent actually did, not just what it returned.

Bottom line: AI agents can be used offensively to compress reconnaissance and credential theft into short, hard-to-detect attack windows.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →