Autonomous AI agents in cybercrime: how threat actors are weaponizing reasoning systems

A new report from Google Threat Intelligence Group (GTIG) warns that threat actors are moving beyond prompt-based LLMs and building autonomous reasoning systems into every stage of the attack lifecycle. The shift from scripted automation to dynamic, AI-driven operations changes the threat landscape for any organization deploying or building AI tools. If your team runs models in cloud environments or works with sensitive research data, this report is worth a close read.

How threat actors are using autonomous AI agents

GTIG observed adversaries embedding AI capabilities into reconnaissance, exploitation, and data exfiltration workflows. One group, UNC6508, linked to Chinese strategic interests, has been targeting American academic, medical, and military research institutions. Instead of using commercial APIs, UNC6508 deploys open-source AI models inside the target's own cloud environment to steal compute power. This approach leaves fewer traces than a call to a public model provider and makes detection harder. Report

Iran-aligned actors were caught using Gemini to produce photorealistic deepfakes for social engineering. Rather than iterating manually, they used the model to autonomously define camera angles, studio lighting, and facial textures. The result is high-quality deepfakes generated faster and at lower effort. Report

GTIG also reported coordinated, ongoing campaigns to distill its proprietary AI systems. Distillation, the practice of training a new model on the outputs of a larger one, is a common technique in AI development. But when executed at scale by state-backed groups, it becomes a national security issue. OpenAI, Anthropic, and the White House have all condemned industrial-scale distillation as a threat to U.S. frontier AI advantage. Report

Why the shift to autonomous reasoning matters for builders

The headline is straightforward: the same agentic capabilities that make AI useful for automation are now being used by attackers to operate with less human oversight. That means incident response teams can no longer assume attacks follow predictable, scripted patterns. Autonomous reasoning allows adversaries to pivot dynamically, test defenses, and adapt to countermeasures in real time. Report

For builders shipping AI products, the implications cut across multiple surfaces. If your model is accessed through an API, attackers might try to extract its capabilities via distillation. If you run models in a shared cloud environment, an adversary could spin up an open-source model on your infrastructure to hide their activity. The convergence of offensive and defensive AI means your own tools could be turned against you.

Policy responses are also accelerating. The White House has signaled action against large-scale distillation, and leading AI developers are rethinking model access controls. Any builder relying on API-accessible frontier models should watch for changes in usage policies, rate limits, and model distribution terms.

Practical steps for defending AI-powered workflows

GTIG's report points to several concrete defense moves. First, audit your cloud environments for unauthorized model deployments. The UNC6508 case shows that attackers will use open-source models to avoid leaving commercial API trails. Monitoring for unexpected GPU utilization or model weight downloads can catch this early. Report

Second, strengthen anomaly detection around AI API calls. Look for patterns that suggest model extraction: high volumes of structured queries, repeated prompt permutations, or unusual output sampling. Third, treat deepfake detection as a operational requirement, especially if your organization handles sensitive communications or research data.

Finally, prepare for a tightening regulatory environment around distillation and model access. The GTIG report makes clear that what was once a standard engineering practice is now a flashpoint. Builders should evaluate whether their model supply chain could be exposed to adversarial distillation campaigns and plan governance accordingly.

What remains uncertain

The GTIG report is a single vendor's threat intelligence assessment. Some operational details, such as the exact scale of distillation campaigns or which specific targets were compromised, are not publicly available. The claims about UNC6508 and Iranian deepfake operations come from GTIG's monitoring and have not been independently confirmed in the context of this article. Still, the report aligns with broader trends: agentic AI is being adopted by both defenders and attackers, and the gap between capability and control is widening.