Our read on what AI-enabled nation-state activity in mid-2026 means for the security market.
Every threat report this year opens with the same reassuring sentence: AI is a "force multiplier, not a new capability". That is technically true and quietly misleading. The multiplier is real, what matters is which variable each adversary multiplies.
Russia is multiplying analyst labor. China is multiplying the speed from vulnerability disclosure to working exploit. Iran is multiplying scarce human expertise. North Korea is multiplying the credibility of fake people. Four different bottlenecks removed.
Here is what the last four months of caught campaigns actually show - and why we think the caught are the least interesting part of the story.
Model laundering: no single vendor sees the whole attack anymore
The cleanest example of the new tradecraft is a China-linked intrusion set documented in July. The operators ran a split-model stack: a Chinese model (DeepSeek) did the reasoning and attack logic while a frontier western model did the hands-on execution. The design is deliberately routing the sensitive offensive reasoning through a model with no vendor monitors, and let the Western agent handle only the plumbing and the technology. Each provider sees a fragment - neither sees the operation.
This is the structural point we keep coming back to: AI-abuse detection today lives almost entirely inside a single model provider, and attackers are architecting around exactly that. North Korea's Kimsuky took it to the end state, running open-weight models (Ollama + GPT4All) entirely on its own infrastructure — no cloud API, no logs, nothing to ban.
The reassuring "Anthropic/OpenAI/Google caught and banned the actor" headlines describe the adversaries who used those platforms, the serious ones increasingly don't.
The detection center of gravity has to migrate from the provider back to the enterprise.
"As threat actors bypass provider-level guardrails through split-model operations and decentralized tooling, relying solely on perimeter telemetry is no longer enough. By correlating human intent and cross-functional collaboration across the organizational workflow, security teams can detect sophisticated tradecraft that isolated perimeter telemetry entirely misses.”
David B. Cross, CISO, Atlassian
AI is now the target, not just the tool
The second shift is that the AI stack itself has become the objective. In June, North Korea's Sapphire Sleet poisoned roughly 130 packages of Mastra, an AI agent framework - the first nation-state attack on an AI orchestration framework. The prize was to sit inside the toolchain where developers keep cloud credentials, GPU access and API tokens.
At the model layer the same logic shows up as capability theft. In late September, OpenAI disclosed and disrupted a campaign - core cluster attributed to the Chinese lab behind the Kimi models - that used a novel technique to pull model reasoning out in plaintext, spiking at one point to 16,000 prompts from 4,000 accounts in a day.
CrowdStrike frames the macro trend bluntly: adversaries "are attacking AI itself" - model weights, training data, and early-stage AI startups, which carry materially weaker security than the hyperscalers.
The new crown jewel is the equipment you can't patch
For twenty years "crown jewels" meant data. This summer's state campaigns went after the equipment that can't easily be patched: SCADA systems and PLCs (programmable logic controllers), network gear, edge appliances. Patching a PLC means stopping the process it runs, and none of this equipment can run an EDR agent.
Being unpatchable is only half of why this equipment is the target. As geopolitical tension rises, an attack with a physical effect has become a way for states to poke one another and watch the response. Dutch intelligence describes Russia's campaign as "designed to stay below the threshold of open war." These attacks are also deniable. The US water attacks were claimed by a "hacktivist" group that US agencies say is a front for Iran's IRGC. Recorded Future expects AI to make such personas cheap to mass-produce, which can "obscure state involvement."
The methods are still the simple ones: no exploits, just default passwords. As Microsoft puts it, "threat actors don't have to be sophisticated if they're able to find unlocked doors." AI just finds the doors faster, going "from intent to a list of accessible US ICS devices with known default credentials in under five minutes."
Many of these operations do several things at once: they cause an effect, steal data, and map the OT for a larger attack later. Microsoft sees Iranian actors pre-positioning "for long-term espionage and potential disruption." In the Volt Typhoon case, US agencies found Chinese operators exfiltrating SCADA diagrams and testing default OT vendor credentials. Iran and Russia were caught at the moment of physical impact.
Russia vs. Europe: from espionage to preparing the battlefield
The Poland attack is also the clearest signal of a strategic shift. Microsoft reads it as "a new willingness to destroy critical infrastructure outside of Ukraine… a warning to countries that support it."
This is pre-positioning and rehearsal. It sits alongside Russia's hijacking of tens of thousands of exposed IP cameras along European military-aid routes (surveillance in service of physical interdiction), the Leipzig airport drone incident, and intelligence assessments now pulling the window for a broader confrontation forward.
The genuinely novel AI element is at the human edge: Ukraine reports AI chatbots automating the recruitment of saboteurs, and Russian influence networks ran AI-generated video into Germany's September regional elections. For the European this widens the problem from data protection to infrastructure resilience and hybrid-threat detection.
Attribution is eroding
The tradecraft that made attribution possible is dissolving. In September, five distinct Chinese clusters were observed firing the same browser-and-OS zero-day chain ("BlueMoon") - shared style tooling that makes "who did it" unreadable from the exploit.
The Poland attack drew two confident, conflicting attributions (ESET and Dragos pointed at GRU/Sandworm, Polish and EU authorities landed on FSB Centre 16). And AI-generated code is converging on a generic, "vanilla" style that erases the compilation quirks, language tells and working-hour patterns attribution relied on.
In the near future more incidents will be mis-filed as commodity crime. The widely-used npm packages debug and chalk sat in the record for ten months as "generic crypto theft" before being re-attributed to North Korea.
As attribution decays, the value migrates from "name the actor" to "detect the behavior and bound the blast radius".
The uncomfortable truth: this is probably just the tip of the iceberg
Look again at how every campaign above was caught:
- The split-model operation was exposed by an open directory the operators forgot to lock - not by either AI vendor.
- The water attacks announced themselves through a drop in water pressure.
- Poland surfaced when endpoint defense caught the wiper firing.
- Kimsuky's offline AI was found only because researchers stumbled onto leftover artifacts on its infrastructure.
Every one of those detection methods carries the same bias. Provider telemetry only catches cloud-AI users. Incident response only catches organizations that hire it and look below the endpoint. Physical-symptom detection only catches attacks that cause a visible effect. Luck only catches operators who slip.
The campaigns that are quiet, self-hosted, patient and below the EDR line are precisely the ones every method is blind to. The Chinese BRICKSTORM intrusions sat in networks an average of 393 days against the 90 days of logs most firms retain - meaning the deepest ones cannot be reconstructed even after they are found. One U.S. government intrusion was dismissed as a false positive twice before anyone confirmed it was real.
So the selection bias runs the wrong way. We are not sampling the average state-sponsored campaign, we are sampling the catchable one - and the catchable one is probably the less sophisticated.
With open-weight models now trailing the frontier by only four to seven months, and distilled models shipping with their safety guardrails stripped, the operators we can't see are not working with worse tools. Just quieter ones.
The campaigns in this report are the ones that got caught. Our working assumption - and the lens we apply to every security company we meet - is that the published record is a lower bound. The most valuable companies in this cycle will be the ones that assume the same.
Sources on file: Microsoft Digital Defense Report 2026, Mandiant M-Trends 2026, CrowdStrike Threat Hunting Report 2026, Recorded Future (Iran), Anthropic Threat Intel (Sep 2026), Deepwatch/Hunt.io (split-model), CERT Polska and EU/UK attribution (Poland), plus daily briefings. Attribution caveats noted in the working files.
Technology Research Director
