Google’s Threat Intelligence Group has been sounding the alarm about a growing trend in cybersecurity threats: the increasing use of artificial intelligence (AI) by both nation-state actors and financially motivated attackers to automate and scale their attacks. This development is giving lesser-resourced groups unprecedented capabilities, making it essential for enterprises to be aware of this new threat landscape.
The evolution of AI-assisted attacks has been rapid, with aggressors developing and using their own AI systems while enterprises deploy additional AI defenses that provide a larger attack surface. Google, as both a developer of AI technology (with Gemini) and a defender against such threats, has documented the growth of this phenomenon through 2026. The result is an accelerated pace of attacks, which are becoming increasingly sophisticated.
A recent example highlighted by Google researchers demonstrates the impact of AI on attack speed and scale. TeamPCP, a group associated with UNC6780, used an AI coding chatbot to plan, build, and execute a mass credential harvesting campaign in under six hours. This type of automation allows attackers to operate at scales more commonly seen with larger, better-resourced groups, such as those affiliated with nation states.
The exploitation of AI and the open-source supply chain is also on the rise. TeamPCP has compromised various platforms, including PyPI, npm, and Docker Hub, using over a dozen different methods to target or exploit AI tools and open-source software development practices. The group has even developed publicly available malware, such as Shai-Hulud and Miasma, which will likely be emulated by other adversaries.
This is not an isolated incident; numerous groups are leveraging AI in similar ways. Nation-state actors are increasingly using AI to amplify their capabilities. For instance, UNC6508, a People’s Republic of China (PRC)-nexus threat actor, has been conducting a multi-year cyberespionage campaign targeting research institutions in North America. Other nation-state actors have been experimenting with AI-powered development tools to build automated exploitation and post-exploitation pipelines.
These developments underscore the growing reliance on AI by both financially motivated attackers and nation-state actors. This trend is likely to continue, as bad actors will always seek ways to exploit vulnerabilities and develop new malware and exploits.
In response to this threat landscape, Google has taken steps to disrupt adversarial operations by disabling associated projects and accounts when identified. It also hardens its own models against misuse, such as deploying real-time defenses to degrade the performance of unauthorized “student” models.
For enterprises, understanding this evolving threat landscape is crucial. The use of AI in cybersecurity attacks will continue to accelerate, making it essential for companies to be prepared and proactive in their defense strategies. By staying informed about these developments and adopting robust security measures, organizations can better protect themselves against the increasing sophistication of AI-assisted attacks.
In the face of this rapidly evolving threat landscape, enterprises must remain vigilant and continuously adapt their defenses to counter the growing use of AI by attackers. This includes implementing robust security controls, monitoring for signs of AI-powered attacks, and staying informed about emerging threats and vulnerabilities.
Source: SecurityWeek — 2026-09-09