AI agent used in spying on Central Asian governments

Suspected Kazakhstan-linked hackers used an artificial intelligence agent to help spy on Central Asian governments, according to new research reported on 12 November 2026 by The Record.

The research says the agent assisted the group in stealing sensitive documents and in infiltrating critical infrastructure networks. The report describes the targets as Central Asian governments. It does not, in the material available, name the individual government bodies affected, the operators of the critical infrastructure networks involved, or the volume of documents taken.

The case is notable because it places an AI agent inside an espionage operation rather than in a research demonstration. Most publicly discussed agent security failures so far have involved researchers showing what an agent could be made to do. Here, according to the research, an agent was used as part of intrusions that reached real government systems.

Several important details remain unreported. The research as summarised does not identify which AI model or agent framework was used, whether it was a commercial product or a self-hosted system, or what guardrails, if any, were bypassed. It does not say what proportion of the intrusion work the agent performed, as opposed to human operators. Nor does it state when the activity began or how long it ran before being detected.

The attribution is also hedged. The hackers are described as suspected of being linked to Kazakhstan. No further basis for that link is given in the reporting available, and no government has been quoted confirming or denying it. Readers should treat the attribution as a claim made by researchers rather than an established fact.

For defenders, the practical lesson is narrow but real. If an AI agent is being used to accelerate document collection and lateral movement inside networks, the behaviour it produces may look different from the manual tradecraft that detection rules are tuned for. Agents can work quickly, repetitively and at odd hours, and they can generate large volumes of file access and command activity in a short window. Organisations that monitor for unusual bulk document access and for automated-looking patterns of internal reconnaissance are better placed to notice that kind of activity, though the research reported does not set out specific indicators of compromise.

The root cause in this case, as recorded, is tool misuse: an agent being directed by an attacker to do work the attacker wanted done, rather than an agent being tricked by a third party through something like a prompt injection. That distinction matters for anyone building defences. Hardening an agent against malicious instructions hidden in documents or web pages does nothing to stop an attacker who controls the agent outright and points it at a victim network.

The Agentic Times has not independently verified the research. No vendor has been named in connection with the agent used, and no vendor response has been reported. We will update this story if the underlying research is published in full or if any of the named parties respond.