• Attackers are automating cyberattack operations with AI agents.
• South Korea and Singapore are tightening AI agent security.

South Korea is updating its AI security guidance to address systems that can operate with limited human oversight, while cybersecurity researchers track attackers using AI agents to automate more parts of cyber operations.

The Korea Internet & Security Agency (KISA) told Reuters on September 15 that it is preparing an updated version of its AI Security Guide. The revised guidance will focus on security issues linked to agentic AI services and include a checklist for organisations managing those risks.

The planned guide could also cover common security controls for physical AI systems that interact with real-world devices and machinery. KISA said the guidance is intended to address agentic AI broadly rather than specific high-performance AI models.

Singapore has already introduced guidance covering the security of agentic AI systems, including controls around access, permissions, and human oversight. Google Threat Intelligence Group (GTIG) has meanwhile documented attackers using AI across reconnaissance, credential theft, exploit development, and other parts of cyber operations.

From prompts to automated attack workflows

In a recent report, GTIG said it had observed adversaries moving beyond basic interactions with large language models and incorporating AI into agentic workflows and automated attack processes.

During the second quarter of 2026, Mandiant observed a suspected financially motivated attacker compromise an organisation’s cloud infrastructure and deploy an autonomous multi-agent attack framework. The attacker used an AI coding chatbot alongside predefined instructions and operational files to plan, build, and execute a credential-harvesting campaign in less than six hours.

GTIG said the framework managed vulnerability scanning, troubleshooting, and IP address rotation without manual intervention. The operation harvested thousands of third-party credentials while running attack traffic through compromised cloud infrastructure.

Singapore’s Cyber Security Agency of Singapore (CSA) has separately warned that frontier AI models can reportedly shorten parts of vulnerability discovery and exploit development from months to hours. CSA said in its April advisory that it had no indication at the time that these capabilities were being misused or abused, but recommended that organisations prepare to respond to compromised credentials within minutes rather than hours.

GTIG also identified an exposed command-and-control server running an automated reconnaissance and credential-management framework. A dashboard associated with the operation was used to organise and validate more than 23,800 harvested secrets, including API keys for cloud and AI services.

The framework used AI agents to research vulnerabilities, scan server-side infrastructure, and execute targeted exploits. Google said it disabled assets associated with the activity after detecting the operation.

NIST has identified identity and access management as a separate security issue as organisations give agents access to applications, data, and external tools. The U.S. standards agency said agents should have their own identifiers, credentials, and permissions instead of routinely sharing human or enterprise credentials.

NIST also warned that static API keys, long-lived access tokens, and broad permissions can expose agentic systems to misuse. It said agents operating from high-level instructions can interact with multiple tools and data sources at a speed and scale beyond typical human activity, increasing the importance of restricting what each agent can access.

The GTIG report also documented interest in agentic offensive tools among state-linked groups. GTIG observed a China-linked cyber espionage group using Gemini while attempting to develop an automated penetration-testing framework designed to observe a target environment, select actions, and execute tasks.

GTIG also observed another China-linked group connecting several AI models to exploitation and post-exploitation workflows. The actor used models including Claude, Gemini, and Codex for tasks such as generating exploit scripts and troubleshooting technical errors.

GTIG said it has not yet observed threat actors deploying fully autonomous attack pipelines against targets in the wild. Its findings instead document attackers combining AI with existing tools and automation for vulnerability research, exploitation, credential theft, malware development, and post-exploitation activity.

AI infrastructure and software become targets

GTIG has also observed attackers targeting AI accounts, developer credentials, and enterprise cloud environments to obtain access to paid services and computing resources. In one April 2026 intrusion investigated by Mandiant, an attacker entered a cloud environment using an exposed GitHub personal access token and created a rogue service account with Editor privileges.

The attacker searched the environment for additional credentials, enabled AI services, and provisioned computing resources for unauthorised workloads. GTIG describes the broader practice of hijacking cloud environments to consume AI resources without authorisation as “LLMJacking.”

Google also found infostealer operators targeting configuration files used by AI development tools. Some of these files can contain API keys and model-routing information, providing access to paid model quotas and related infrastructure when credentials are exposed.

Mandiant also detected attempted downloads of malicious open-source AI resources in enterprise environments in Asia and North America during early 2026.

GTIG tracked attacks linked to financially motivated group UNC6780, also known as TeamPCP, involving open-source software repositories and AI development tools. The group compromised developer accounts, published modified software packages, and targeted credentials associated with AI services.

Malware linked to the group also placed malicious configuration files inside directories used by AI coding assistants and development environments. The files contained instructions designed to make an AI assistant execute commands during normal developer activity without the developer intentionally requesting them.

GTIG also found prompts embedded in malicious JavaScript files that appeared intended to interfere with LLM-based security analysis. Google said Gemini’s safeguards responded to the activity and that it subsequently disabled related assets and updated its protections.

South Korea and Singapore tighten controls around agent access

CSA, GovTech Singapore, the Infocomm Media Development Authority, and Google launched an AI Agents Sandbox in August 2025 to test computer-use agents in government-related applications.

The four-month exercise examined uses including automated quality assurance, AI safety testing, and assistance with social-service applications. It also identified issues involving human oversight, cybersecurity, data protection, and the level of control given to autonomous systems.

One security issue identified during the sandbox was indirect prompt injection, where content encountered by an agent causes it to perform an unintended action. CSA said this type of attack could result in actions including remote code execution.

NIST has tested related agent-hijacking scenarios in which malicious instructions are placed inside emails, files, or websites encountered by an agent during a legitimate task. Its evaluations included attempts to make agents execute downloaded software, exfiltrate cloud files, and send phishing messages.

In tests using the AgentDojo evaluation framework, NIST said the average attack success rate across five injection tasks increased from 57% on a single attempt to 80% when each attack was tried 25 times. The tests used an agent powered by Anthropic’s upgraded Claude 3.5 Sonnet, and NIST noted that success rates varied depending on the task.

The Singapore sandbox also identified risks when agents interact directly with personal information, including data leakage and privacy breaches. The agencies recommended adjusting human oversight according to the level of risk, including requiring approval before higher-risk actions are carried out.

CSA followed the sandbox work with an addendum to its existing guidelines on securing AI systems. Published in June this year, the document covers security risks associated with systems that can understand context, formulate plans, and independently take actions while accessing external tools and data.

The guidance recommends mapping agentic workflows to identify points where attackers could exploit vulnerabilities and applying controls across the development lifecycle. Its examples include coding assistants, automated customer onboarding, and automated fraud detection systems.

CSA has separately recommended restricting the credentials, permissions, and tools available to autonomous agents. In a May advisory, the agency advised organisations to use narrowly scoped agents rather than one agent with broad access, assign dedicated credentials, and use short-lived tokens stored in secure vaults.

CSA also recommends logging agent activity and requiring human approval before high-impact or irreversible actions, including financial transactions, production code execution, critical-data deletion, and external communications. It said these restrictions should be enforced through system-level mechanisms such as permission gates and approval workflows rather than relying only on instructions given to the model.

NIST’s National Cybersecurity Center of Excellence has also proposed work on applying identity standards and security practices to software agents. Its February concept paper covers agent identification, authorisation, auditing, non-repudiation, and controls against prompt-injection techniques.

South Korea’s planned update will similarly focus on controls for organisations using AI systems with greater autonomy. KISA did not provide Reuters with a publication date for the revised guide.

Want to learn more about Cloud Computing from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events, click here for more information.

Tech Wire Asia is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.