AI Update: Government Intrusions Show Signs of AI-Generated Code

Unit 42 identified intrusions into government and state-affiliated Linux infrastructure using scripts with signs of AI-generated code. The newly disclosed activity ran from October 2025 through April 2026. Attackers collected passwords, installed backdoors and searched government mailboxes for messages linked to social-media accounts. Some scripts contained comments explaining their logic to an operator, consistent with language-model output. This does not establish that autonomous agents conducted the operation. The researchers found attempts to copy databases and mailboxes, including a mailbox-export script that would fail because of syntax errors. Attackers also planted misleading security-testing markers and tried to erase logs.

Bitsight found a hacking tool marketed for use with stolen AI-provider keys in a study of thousands of posts across 16 underground communities. The MONST3R-AI panel is advertised as letting buyers enter stolen OpenAI, Anthropic or Google access keys, set a budget and run automated scans billed to the key owner. The seller’s claimed scan results remain unverified. The study covered February through August and found a 67 percent increase in mentions of agents, indirect prompt injection and the Model Context Protocol, which connects agents to tools. That measures forum discussion rather than attacks. Researchers also observed interest in models whose downloadable parameters can be modified locally.

Proof says its agent identity wallet and x401 server are in production. The protocol and a working server were first announced in June. A website can ask an AI agent for verified identity attributes and a signature on a specific transaction. The person reviews the requested information and terms on their own device, authenticates with a biometric and approves a signature using a hardware-protected key. The receiving business checks the credential, signature and transaction terms; changing signed details invalidates the signature. Proof’s server connects through the Model Context Protocol, allowing compatible assistants to carry requests while the person’s wallet supplies the approval.

GoDaddy, Infoblox, Google and Cloudflare demonstrated a Chain of Trust architecture for transactions between AI agents, developed with Singapore’s Infocomm Media Development Authority. A simulated flight purchase connected buyer and seller agents on different clouds. A person approved the purchase with a passkey, and signed mandates limited the seller, purchase and spending amount. The buyer checked the seller’s identity against public records before checkout. The companies say tests involving a look-alike seller and forged credentials were stopped. Each verification layer was checked separately, and every step was recorded in a log designed to reveal later changes.

Google is adding an opt-in Enhanced protection mode to Google Messages in the coming weeks. It combines cloud Gemini analysis of conversations with unknown senders, on-device link checks and clearer warnings, with device support varying by feature. Google says cloud analysis uses its encrypted Private AI Compute environment. Screen-share protection for login and payment fields in Chrome and Android WebView rolls out this month on Android 15 and later. Call-forwarding safeguards are due in early December on Pixel and selected devices, blocking silent redirection and warning about forwarding codes. Expanded third-party chat scam alerts are planned for later this year.

Snyk introduced Evo Agentic AppSec, a suite of AI security agents for reviewing code, screening dependencies and repairing vulnerabilities. The agents call Snyk’s existing analysis engines to inspect software. Code scanning, a dependency firewall and repository security reviews are available to selected customers in experimental preview. A remediation agent is in open preview, initially addressing Snyk Open Source issues; fixes that might break a build are queued for approval. Tools for detecting exposed credentials, checking code during generation and testing running applications for vulnerabilities are generally available. Snyk says results are checked independently of the agent that produced them, while security teams set the requirements and audit agent decisions.

The University of Surrey is leading a project to build a controlled environment for AI agents, backed by more than £3.2 million from the UK’s Advanced Research + Invention Agency. Researchers at Surrey, Sheffield and Melbourne will develop controls that can change or revoke an agent’s permissions while it operates. An agent that accesses confidential information could, for example, be blocked from communicating externally until its output passes a trusted filtering process. Formal models and mathematical proofs are intended to establish that specified restrictions hold. The team will build a proof-of-concept and test it against realistic agent-escape scenarios.