XIA LEI 
A New Kind of Intruder
For decades, attacks on government systems needed skilled people working long hours: researching targets, writing phishing emails, probing networks and sifting through stolen files. In 2025 and 2026 that changed. Autonomous AI agents — software that can plan, use tools and act on its own — can now carry out large parts of that work with very little human help.
In late 2025, AI company Anthropic publicly reported disrupting what it described as a largely AI-orchestrated espionage campaign, in which a state-linked group used an AI coding agent to help target around thirty organisations, including government agencies. Whatever the exact details, the lesson for every public body is clear: the attacker of the future is not a single hacker but a tireless, scalable machine.
This article explains, at a high level, how AI agents are used against government, and then focuses on what matters most — how to prevent it.
> This article is written for defenders: public servants, IT teams, government suppliers and curious citizens. It deliberately does not include step-by-step attack instructions.
Why Government Is a Prime Target
Governments hold some of the most valuable data on earth:
- Citizen records — tax, health, welfare, immigration, licensing and electoral data
- Policy and negotiation documents — trade, defence and budget plans
- Critical infrastructure details — water, energy, transport and emergency systems
- Identity systems — the logins citizens use to access every other service
Public bodies also tend to have large, ageing IT estates, many outside suppliers, and staff who publish a lot of information openly by design. That mix makes them attractive to criminal groups, hacktivists and foreign intelligence services alike.
How AI Agents Change the Attack
1. Reconnaissance at Machine Speed
Government is transparent by nature: org charts, tender documents, staff profiles, technical job adverts and press releases are all public. An AI agent can read thousands of these in minutes and build a detailed picture of who works where, which systems and suppliers an agency uses, and who might have privileged access.
2. Hyper-Personalised Phishing and Impersonation
Generative AI writes flawless, context-aware messages in any language and tone. Combined with voice cloning and deepfake video, attackers can convincingly impersonate a minister's office, a supplier or the IT help desk — and do it for hundreds of targets at once, each message tailored to the recipient.
3. Automated Probing of Exposed Systems
AI agents can continuously look for forgotten websites, unpatched public services, leaked passwords and misconfigured cloud storage, then prioritise the weakest point. What once took a team weeks can happen overnight.
4. Attacking the Government's Own AI
Agencies are rolling out chatbots and AI assistants for citizens and staff. These introduce a new weakness called prompt injection: hidden instructions placed in a document, email or web page that trick an AI assistant into revealing data or taking actions it should not. An AI that can read internal files and send emails becomes a powerful target.
5. The "Mosaic Effect"
Individually harmless public datasets can be combined by AI to reveal sensitive information — for example, linking anonymised records back to real people, or working out the location of a sensitive facility from scattered clues.
6. Faster Sorting of Stolen Data
Once inside, the slowest part for attackers used to be finding the valuable files. AI can now summarise, translate and rank stolen documents in hours, shrinking the time defenders have to detect and respond.
How to Prevent It: A Layered Defence
There is no single fix. The strongest approach is defence in depth — several layers so that if one fails, others still hold.
Layer 1: Lock Down Identity
Most breaches still start with a stolen login.
- Phishing-resistant multi-factor authentication (security keys or passkeys) for all staff, especially administrators. SMS codes are no longer enough.
- Least privilege: give each person and system only the access they actually need, and remove it when roles change.
- Separate admin accounts used only for administration, never for email or web browsing.
- Verify unusual requests out of band: if "the minister's office" asks for urgent data by email or video call, confirm through a known phone number.
Layer 2: Patch and Shrink the Attack Surface
AI agents are excellent at finding forgotten things.
- Keep an up-to-date inventory of every public-facing system, including old project sites and supplier-run services.
- Patch internet-facing systems quickly — critical issues within 48 hours.
- Switch off what is no longer used.
- Follow a recognised baseline such as Australia's ASD Essential Eight, the UK Cyber Assessment Framework or the US NIST Cybersecurity Framework.
Layer 3: Use AI for Defence
Machine-speed attacks need machine-speed defence.
- Behaviour-based detection that spots unusual logins, data downloads or account activity rather than only known threats.
- Automated response that can suspend a suspicious account or isolate a device in seconds, with humans reviewing afterwards.
- AI-assisted threat hunting that helps small security teams review far more alerts than they could alone.
Layer 4: Secure the Government's Own AI Systems
Every AI assistant an agency deploys must be treated as a potential entry point.
- Limit what the AI can reach: a public chatbot should never be able to read internal databases it does not need.
- Keep a human in the loop for any action that sends data, changes records or spends money.
- Treat everything the AI reads as untrusted — emails, uploaded files and web pages may contain hidden instructions.
- Log every AI action so investigators can see what happened.
- Red-team AI systems before launch and regularly afterwards, using guides such as the OWASP Top 10 for Large Language Model Applications and the NIST AI Risk Management Framework.
Layer 5: Minimise and Protect Data
Data you do not keep cannot be stolen.
- Collect only what is needed and delete it on schedule.
- Encrypt sensitive data at rest and in transit.
- Assess datasets for the mosaic effect before publishing them as open data.
- Use data loss prevention tools that flag unusually large or unusual downloads.
Layer 6: Manage Suppliers
Many government breaches come through contractors.
- Write security requirements, including AI use, into every contract.
- Give suppliers time-limited, monitored access only.
- Require suppliers to report incidents quickly.
Layer 7: Train People for the AI Era
- Teach staff that voices, faces and writing style can now be faked.
- Run realistic, AI-generated phishing simulations — in a supportive way, not to punish.
- Make reporting easy: one button to report a suspicious message, and thanks rather than blame for doing so.
Layer 8: Plan for the Breach
Assume something will get through.
- Keep offline, tested backups.
- Have a written incident response plan, practised at least once a year with leadership involved.
- Know in advance who to contact — national cyber agencies such as Australia's ACSC, the UK's NCSC or the US CISA can help.
What Citizens Can Do
Government security also depends on the public:
- Protect your government login (for example myGov) with strong, unique passwords and multi-factor authentication.
- Be suspicious of messages "from the government" asking you to click a link or confirm details — go to the official website directly instead.
- Report scams to your national scam-reporting service.
Final Thoughts
AI agents have made attacks on government faster, cheaper and more convincing — but the same technology is giving defenders powerful new tools. The agencies that will stay safe are not those with the most expensive products, but those that get the basics right: strong identity protection, quick patching, careful limits on their own AI systems, minimal data, well-managed suppliers and well-prepared people.
The arms race is AI versus AI. Making sure the defending AI — and the humans guiding it — stays one step ahead is now a core part of good government.
