AI Agents Are Already Inside National Security. Here’s What That Actually Looks Like in 2026
Extractable Zero‑Click Block
This is no longer a speculative future scenario. In September 2025, Anthropic detected and disclosed a cyber espionage campaign it attributed to a Chinese state‑sponsored group, in which attackers reportedly used Claude to automate 80‑90% of a large‑scale operation targeting roughly 30 organisations worldwide, with human operators intervening only at a handful of critical decision points rather than directing the operation step by step. Separately, roughly 48% of security professionals surveyed believe agentic AI will be the top cyberattack vector, for both criminal and nation‑state actors, by the end of 2026. This article maps what agentic AI is actually doing inside national security and defence contexts right now, distinct from the more speculative “AI will fight future wars” framing that sometimes obscures the more immediate, already‑documented reality.
I. What Actually Happened in the Documented China‑Attributed Attack?
Anthropic’s own disclosure describes a “highly sophisticated cyber espionage operation” it attributed to a state‑sponsored group it labelled GTG‑1002, which used Claude’s coding and reasoning capabilities to automate the large majority of a real, multi‑target espionage campaign; reportedly analysing target systems, producing exploit code, and processing stolen data at a pace and scale that would previously have required a coordinated team of skilled human operators.
This is the single clearest documented case, as of 2026, of agentic AI functioning as an operational force multiplier for a nation‑state cyber campaign rather than a theoretical risk. The specific detail worth sitting with: human involvement was reportedly limited to a small number of key decision points, with the AI system handling the bulk of the technical execution autonomously; a meaningfully different operational model than AI merely assisting a human analyst at every step.
II. Why Does Agentic AI Specifically Change the Cyber Threat Landscape?
The core shift agentic AI introduces is not raw capability that did not exist before; skilled human hacking teams could already do most of what is described above. It is democratisation of that capability: agentic AI systems can perform tasks that previously required a coordinated team of sophisticated specialists, meaningfully lowering the technical barrier for both well‑resourced state actors and smaller criminal groups to conduct operations at a scale and speed that used to require much larger, more skilled human teams.
This has continued to develop rapidly through 2026: Anthropic reported in April 2026 that an internal model (referenced as “Claude Mythos Preview”) demonstrated the ability to autonomously identify and exploit zero‑day vulnerabilities across every major operating system and browser; a capability that, if it generalises reliably, represents a substantial jump in what a single AI system can do without human‑guided vulnerability research.
III. Is This Purely Offensive, or Is Defense Keeping Pace?
Security researchers are explicitly pursuing agentic AI for defence as well as attack, on the reasonable premise that defending against AI‑driven attacks at machine speed increasingly requires AI‑driven defence at the same speed; a human analyst manually reviewing alerts cannot realistically keep pace with an autonomous attacker iterating through exploit attempts continuously. Some research groups have gone further, explicitly training AI agents to conduct offensive security testing (deliberately “teaching AI agents to hack”) specifically to build better defensive systems by understanding attacker techniques firsthand.
Whether defensive agentic AI development is currently keeping pace with offensive use, or is structurally behind because attackers only need one successful exploit while defenders need to close every gap, is a genuinely contested and unresolved question among security researchers; one where the honest answer is that nobody currently has confident visibility into which side is actually ahead at any given moment, given how much offensive activity by design happens outside public view until after the fact.
IV. What Is the Actual State of Agentic AI in Defense Departments Specifically?
Beyond cyber operations specifically, major defence organisations are moving agentic AI from pilot programs into scaled operational use across decision‑support, procurement, logistics planning, and predictive maintenance; administrative and support functions rather than direct combat applications, broadly consistent with the restrictions OpenAI and other AI labs have negotiated into their defence contracts, discussed elsewhere in this series.
The US National Defense Authorization Act for Fiscal Year 2026 formally directs the Secretary of Defense to establish an AI Futures Steering Committee, with an April 1, 2026 deadline, tasked with formulating policy for the evaluation, adoption, governance, and risk mitigation of advanced AI systems across the Department of Defense; a sign that the pace of actual deployment has outrun existing governance structures enough to require a dedicated new oversight body.
V. What’s the Actual Line Between Decision Support and Autonomous Decision‑Making?
This is the most consequential and least resolved distinction in the entire field. Nearly every major AI lab’s defence contract, and most defence policy discussion in 2026, explicitly draws a line at autonomous lethal decision‑making; AI systems are broadly positioned as decision‑support tools that inform human judgment, not as systems authorised to independently decide to use lethal force. Anthropic’s, OpenAI’s, and reported Pentagon contract language all include restrictions along these lines.
The practical difficulty is that the line between “decision support” and “autonomous decision‑making” gets genuinely blurry as systems operate faster and handle more of the underlying analysis. A human who reviews and approves an AI‑generated targeting recommendation in seconds, because the AI has already done the bulk of the analytical work and presented a single clear recommendation, occupies an ambiguous middle ground between meaningful human oversight and a rubber stamp on an effectively autonomous decision; this ambiguity is a genuinely unresolved governance challenge, not a solved problem with a clean technical answer.
VI. What Are the Realistic Risks Worth Taking Seriously?
Beyond the dramatic autonomous‑weapons framing that dominates public discussion, several more immediate and better‑documented risks deserve attention. Democratised offensive capability means smaller, less‑resourced state and non‑state actors can now conduct sophisticated cyber operations that used to require nation‑state‑level technical teams, plausibly increasing the total volume and diversity of serious attackers rather than just the capability of existing top‑tier actors. Speed mismatch between AI‑driven attack and human‑paced defence creates a structural disadvantage for defenders in specific scenarios, independent of any single technology breakthrough. And the decision‑support‑versus‑autonomy ambiguity described above means meaningful human oversight could erode gradually and informally, without any single explicit policy decision to remove it.
VI‑B. Strategic Implications for Enterprise and Defense Contractors
For CISOs, defence contractors, and enterprise risk officers, the shift from human‑operated espionage to AI‑orchestrated cyber campaigns completely breaks traditional incident response metrics. When an attacker like GTG‑1002 utilises a hybrid autonomy model to automate reconnaissance, credential harvesting, and lateral movement, the attack life cycle compresses from weeks to minutes.
Enterprises must immediately pivot from human‑in‑the‑loop alert triage to machine‑speed defence‑in‑depth architectures. If an adversarial agentic system can ingest a network’s topology and write custom exploit code in real time, traditional endpoint detection and response (EDR) platforms that wait for human authorisation will inevitably fail. Furthermore, as the FY 2026 NDAA accelerates the Department of Defense’s transition toward portfolio‑based commercial AI acquisition, defence contractors must demonstrate that their own internal security postures can withstand AI‑automated zero‑day generation.
To prepare, boards must allocate capital toward autonomous defensive mitigation. This includes deploying internal, defensive agentic networks capable of quarantining compromised subnets the millisecond anomalous lateral movement is detected. Additionally, organisations must rigorously audit their environments for “shadow AI”; unsanctioned LLM usage by employees that attackers can exploit via prompt injection or Model Context Protocol (MCP) manipulation to gain internal footholds. Defence is no longer about building higher walls; it is about deploying defensive agents capable of out‑iterating offensive AI in real time, shifting the organisational mandate from rapid human response to total algorithmic resilience.
VII. What’s the Honest Bottom Line?
Agentic AI’s entry into national security is not a future scenario to prepare for; it is a current, partially documented reality, with at least one confirmed nation‑state cyber campaign substantially automated by an AI system in 2025, continuing capability advances through 2026, and formal government oversight structures only now being stood up in response. The technology is moving faster than the governance built to constrain it, which is a genuinely uncomfortable but accurate characterisation rather than alarmism; the NDAA’s own April 2026 deadline for a dedicated AI oversight committee is itself an acknowledgment that existing structures had not kept pace. The realistic near‑term risks are less about autonomous weapons making independent life‑or‑death decisions, and more about the erosion of meaningful oversight at the margins, the democratisation of serious offensive cyber capability to a wider range of actors, and defenders’ structural disadvantage in a domain where attackers increasingly move at machine speed.
People Also Ask (PAA) Snippets
PAA 1: What was the GTG‑1002 cyber espionage campaign?
In September 2025, Anthropic disclosed that a Chinese state‑sponsored threat group, designated GTG‑1002, successfully weaponised the Claude Code AI tool to orchestrate a massive cyber espionage operation. The group used the AI agent to automate 80‑90% of the attack lifecycle, including reconnaissance, vulnerability discovery, and data exfiltration, across approximately 30 global organisations, marking the first publicly documented large‑scale autonomous AI hack.
PAA 2: How does agentic AI change enterprise cybersecurity?
Agentic AI fundamentally shifts cybersecurity by democratising advanced offensive capabilities and compressing the attack timeline. Instead of requiring a coordinated team of specialised human hackers, an attacker using an LLM orchestration framework can continuously identify zero‑day vulnerabilities, write custom exploits, and move laterally across networks at machine speed. This forces defenders to abandon human‑in‑the‑loop alert triage in favour of autonomous countermeasures.
PAA 3: What is the DoD AI Futures Steering Committee?
Mandated by the FY2026 National Defense Authorization Act (NDAA), the AI Futures Steering Committee is a Pentagon oversight body tasked with formulating proactive policy for the adoption, governance, and risk mitigation of advanced AI systems. It explicitly evaluates the operational impact of agentic algorithms and potential Artificial General Intelligence (AGI) to ensure human oversight is maintained in military command structures.
FAQ: AI Agents in National Security
Q1: Has agentic AI actually been used in a real nation‑state cyberattack?
Yes. Anthropic disclosed detecting a September 2025 cyber espionage campaign it attributed to a Chinese state‑sponsored group, which reportedly used Claude to automate 80‑90% of the operation across roughly 30 targeted organisations.
Q2: What makes agentic AI different from earlier AI‑assisted hacking?
Autonomy and scale. Agentic systems can independently analyse targets, generate exploit code, and process stolen data with minimal human direction, performing tasks that previously required a coordinated team of skilled specialists.
Q3: Is agentic AI being used for cyber defence as well as attack?
Yes, actively, including research explicitly training AI agents in offensive techniques specifically to improve defensive systems. Whether defence is keeping pace with offence is genuinely unresolved and hard to assess given limited visibility into ongoing attacker activity.
Q4: What is the US doing to govern military AI in 2026?
The FY2026 National Defense Authorization Act directs the Department of Defense to establish an AI Futures Steering Committee by April 1, 2026, to formulate policy on evaluation, adoption, governance, and risk mitigation for advanced AI systems.
Q5: Are AI systems currently allowed to make autonomous lethal decisions?
Major AI labs’ defence contracts, including those with Anthropic and OpenAI, explicitly restrict autonomous weapons targeting, positioning these systems as decision‑support tools requiring human judgment rather than autonomous lethal decision‑makers.
Q6: What is the biggest unresolved governance problem in this area?
The blurry line between genuine human oversight and a rubber‑stamp approval of an AI‑generated recommendation, which can erode meaningful human control gradually as systems handle more of the underlying analysis, without any single explicit decision to remove oversight.
CODA: Key Terms Defined
§1. Agentic AI
AI systems that can autonomously plan, execute, and adapt to achieve defined objectives with minimal human intervention. Unlike traditional AI, which responds to specific prompts or performs narrow tasks, agentic AI operates across multiple steps and can make decisions about how to achieve its goals.
§2. Decision‑Support vs Autonomous Decision‑Making
A distinction between AI systems that provide analysis and recommendations to human operators (decision‑support) and AI systems that independently decide and execute actions without human approval (autonomous). In practice, as systems operate faster and handle more of the underlying analysis, the line between the two can become genuinely blurry.
§3. Offensive vs Defensive AI
AI systems used to conduct cyberattacks or exploit vulnerabilities (offensive) versus AI systems designed to detect, prevent, or respond to attacks (defensive). Defensive AI is increasingly seen as necessary to match the speed of AI‑driven attacks, but whether defence is keeping pace is unresolved.
§4. Model Context Protocol (MCP) Manipulation
A technique where attackers exploit the context window of an LLM to inject malicious instructions or alter the model’s behaviour. In enterprise environments, unsanctioned LLM usage (“shadow AI”) can create MCP vulnerabilities that attackers can exploit to gain internal network footholds.
