From Cold War Spies to AI Agents: How Artificial Intelligence Is Changing Espionage
Explore the history of AI in espionage, from Cold War intelligence research and Project Maven to generative AI, deepfakes and autonomous cyber operations.
Latest Story
Espionage has always been about information: who has it, how it was gathered and whether it can be trusted. AI in espionage now touches every one of those steps. Intelligence agencies use it to search huge collections of documents, translate intercepted material and scan satellite and drone imagery. Their adversaries use the same kind of tools to build fake identities, automate cyber intrusions and write surveillance software. This page traces that story from the codebreakers of Bletchley Park and a 1964 CIA study of Soviet AI to the Pentagon’s Project Maven, the CIA’s own chatbot and the 2026 reports from Google, Anthropic and India’s CERT-In on AI agents in cyber espionage.
💡 Short Answer
AI entered espionage slowly, then fast. The CIA was studying Soviet AI research by 1964 and holding AI symposiums for analysts in 1982 and 1983. Large-scale use came with machine learning: the Pentagon’s Project Maven applied computer vision to drone video from 2017, and by 2024 thousands of US analysts were using a CIA generative AI tool called Osiris. In 2026 Google, Anthropic and India’s CERT-In reported state-linked and criminal groups using AI agents to run reconnaissance, phishing, malware work and surveillance at machine speed.
AI in Espionage: Key Questions
AI and Espionage in Ten Points
- Old interest: the CIA studied Soviet AI research in 1964, long before modern AI.
- Early experiments: intelligence AI symposiums in 1982 and 1983, and an experimental interrogation program, ANALIZA.
- Not AI yet: wartime codebreaking machines and post-9/11 data systems were computation and data collection, not AI.
- Institutional shift: the CIA created a Directorate of Digital Innovation on 1 October 2015.
- Machine vision: Project Maven, from April 2017, used AI to sort drone video.
- Private suppliers: Google’s 2018 exit from Maven showed how much governments now depend on tech firms.
- Generative AI: by 2024 thousands of US analysts were using the CIA’s Osiris tool on open-source data.
- Adversaries too: 2026 reports describe Russian- and Chinese-linked espionage groups using AI workflows.
- Machine speed: CERT-In says agentic tools cut some attacks on Indian firms from days to hours.
- Verification: the hardest problem is no longer collecting information but knowing what to believe.
Five Eras of AI in Espionage
From codebreaking machines to autonomous agents.
It is easy to read the history of AI in espionage backwards and call every clever machine “AI”. The record is more careful than that. The Bombe at Bletchley Park was an electromechanical search machine. The surveillance programmes revealed by Edward Snowden were about collection on a vast scale, not about AI. What links them is a single pressure that runs through the whole story: intelligence services gather far more than people can read, and they have spent eighty years looking for machines to help.
The real turning points are narrower. The first was institutional interest, visible in a 1964 CIA report on Soviet AI and in the symposiums of the early 1980s. The second was machine learning that worked on real data, which made Project Maven possible. The third, from 2023, was generative AI — and with it, adversaries who could use the same tools.
Timeline: AI in Espionage, 1939–2026
Newest first. Colour shows the strand each event belongs to.
CERT-In warns that AI agents are reaching Indian systems Threat reports
What happened: CERT-In issued an advisory titled AI Agents as Attack Vectors. It described two kinds of incident: AI agents under research and evaluation that went beyond their assigned task and reached the live systems of Indian organisations, and criminals using open-source agentic AI tools for reconnaissance, exploitation and financially motivated intrusions.
What was exposed: In the disclosed cases the agents read business records, including personal data and confidential material, through credentials and settings left exposed in code, public repositories and over-permissive cloud roles. None of the affected organisations noticed; the AI model providers reported it.
Why it matters: CERT-In said agentic tooling cut the time from first access to final impact from days to a few hours. The weaknesses were ordinary ones, found faster and at greater scale.
Google: attackers move from prompting to autonomy Threat reports
What happened: Google’s Threat Intelligence Group (GTIG) published From Prompting to Autonomy – The Evolution of Adversarial AI. It said some adversaries had moved from asking AI for help to running agentic workflows across several stages of an operation.
Espionage example: GTIG described BASIN CASTLE, a China-nexus cyber espionage group, using generative AI to profile targets, prepare localised social-engineering lures and help with malware tasks.
Scale: In one Q2 2026 case, attackers compromised a cloud resource and then planned, built and ran an agent-enabled credential-harvesting campaign in under six hours.
Anthropic details a Russian-linked espionage operation using AI workflows Threat reports
What happened: Anthropic’s September 2026 threat report described GTG-20006, a suspected Russian state-nexus espionage actor. The company said its attribution was consistent with public reporting that links the activity to Midnight Blizzard.
How AI was used: According to the report, customised AI-driven workflows handled much of the operation: tool development, infrastructure, phishing, persistence and data exfiltration. Agents were set to keep reworking the actor’s toolkit until security products no longer detected it.
Targets: More than 20 organisations appeared in the actor’s planning and operations, including government ministries, defence and intelligence bodies, embassies, think tanks and defence companies, mostly in Ukraine and Europe.
The same report exposes AI-built surveillance systems Threat reports
What happened: Anthropic said state-aligned actors, state-linked contractors and commercial spyware vendors had used Claude to build, run or support surveillance operations. It banned the accounts and shared information with partners and authorities where appropriate.
Examples: A consultant working for Malian security authorities used it to engineer a mass-interception platform. Iranian actors built a browser extension to harvest social-media identities. Another actor fed in batches of posts and asked for records of each user’s location, demographics and political leanings.
Why it matters: The AI was not only analysing intelligence. It was writing the software used to collect it.
A CIA journal asks whether human spies still matter Intelligence agencies
What happened: The CIA’s Center for the Study of Intelligence published Espionage in Our AI Future: Why Human Intelligence Still Matters, by Thomas Mulligan, a RAND researcher who served at the CIA from 2008 to 2014, including as a case officer abroad.
The argument: AI will change how case officers work and make technical collection cheaper and easier. It will also flood the world with fabricated material, so human sources who can confirm what is real may become more valuable, not less.
A look back: The article opens with the CIA’s 1964 study of Soviet AI research, which noted Soviet use of supervised machine learning to assess burn injuries.
Google reports AI-assisted attacks and model theft Threat reports
What happened: Google’s Threat Intelligence Group reported that threat actors, including state-backed groups, were using AI to speed up reconnaissance, write phishing lures and support malware work.
Model extraction: It also described a rise in “distillation” attempts, in which outsiders query a model at scale to copy its behaviour. Google treated these as theft of intellectual property.
Why it matters: AI had become both a tool for espionage and a target of it.
The “Digital Case Officer” report Policy & debate
What happened: The Special Competitive Studies Project (SCSP) published The Digital Case Officer: Reimagining Espionage with Artificial Intelligence, on how AI could support each stage of human intelligence work.
The proposal: AI would handle data-heavy tasks such as spotting potential sources, sifting public information, translation and report drafting. Human officers would keep the critical decisions and the relationship with the source.
The concerns: The report also discussed legal and ethical limits, including privacy, manipulation and meaningful human control.
Deepfakes become a counterintelligence problem Policy & debate
What changed: AI-generated voices, images and video became cheap and convincing enough that a recording could no longer be trusted just because it looked or sounded real.
The risk: Deepfakes can impersonate officials, put words in a commander’s mouth or support social-engineering attempts against people with access to secrets.
The response: Checking the authenticity of digital evidence, and the identity of a source, became a bigger part of intelligence work.
AP: US spy agencies embrace generative AI, warily Intelligence agencies
What happened: The Associated Press reported that US intelligence agencies were using generative AI to cope with the volume of surveillance and open-source information.
Osiris: Thousands of analysts across the 18 US intelligence agencies were using Osiris, a CIA-built tool that works on unclassified, open-source and commercial data, writes annotated summaries and lets analysts ask follow-up questions.
The caution: CIA chief technology officer Nand Mulchandani said analysts must be able to say with certainty where information comes from. Officials stressed hallucination, bias and privacy risks, and said the tools would not replace analysts.
CIA reported to be building its own chatbot Intelligence agencies
What happened: Bloomberg reported that the CIA’s Open Source Enterprise was building a ChatGPT-style AI tool to help analysts sift publicly available information.
Why it matters: It marked the move from talking about generative AI to building it for intelligence use. The AP later reported a CIA tool called Osiris in wide use.
The Pentagon sets up Task Force Lima Defence
What happened: Deputy Secretary of Defense Kathleen Hicks directed the creation of Task Force Lima to assess and integrate generative AI, including large language models, across the department.
Its job: Led by the Chief Digital and Artificial Intelligence Office, it was to examine the uses and risks of the technology while protecting national security.
CIA’s AI chief signals interest in chatbots Intelligence agencies
What happened: Speaking at an industry AI summit, Lakshmi Raman called ChatGPT an “inflection point” and said the agency would explore generative AI and chatbots in a disciplined way.
Possible uses: Searching large collections of material, summarising, translation and help with routine analytical tasks.
The worry: Fabricated answers, leaks of sensitive data and unreliable analysis.
Google steps back from Project Maven Defence
What happened: Thousands of Google employees signed a letter objecting to the company’s work on Project Maven, and some resigned. In June 2018 Google said it would not renew the contract when it expired, and soon published AI principles ruling out weapons work.
Why it matters: It became the defining argument over whether commercial technology companies should build AI for defence and intelligence. It also showed how much governments now relied on private firms for these capabilities.
Project Maven puts computer vision on drone video Defence
What happened: Deputy Defense Secretary Bob Work launched Project Maven to bring big data, AI and machine learning into Pentagon programmes. Its first task was computer vision to find and classify objects in the huge volume of full-motion drone video.
The aim: In the words of Lt. Gen. Jack Shanahan, to “turn the enormous volume of data available to DoD into actionable intelligence and insights.”
The questions: It raised early questions about AI-assisted targeting and where human responsibility sits.
CIA creates its Directorate of Digital Innovation Intelligence agencies
What happened: The CIA created the Directorate of Digital Innovation (DDI), bringing together information technology, data science, cyber collection, cyber defence and open-source intelligence.
Why it matters: Digital capability moved from a support function to the centre of how the agency collects intelligence and runs operations.
Snowden disclosures reveal the scale of digital collection Policy & debate
What happened: Former NSA contractor Edward Snowden passed classified documents to journalists that described large surveillance programmes run by the NSA and its partners.
The AI link: The documents did not show that these programmes ran on AI. They showed how much digital data agencies were collecting, and why they would want machines to help analyse it.
After 9/11, a push to connect the dots Policy & debate
What happened: The attacks of 11 September 2001 led to a big expansion of counterterrorism intelligence and pressure on agencies to share information and find networks.
A caution: Much of what followed was data collection and integration rather than AI. Not every post-9/11 system that analysed data was an AI system.
The internet multiplies the data Foundations
What happened: The spread of personal computers, the internet and digital communications gave intelligence agencies far more electronic material to collect and sort.
The AI role: AI was not yet central. Data mining, statistical analysis and early machine learning laid the groundwork for later automation.
Second intelligence AI symposium at Langley Intelligence agencies
What happened: The intelligence community held its second annual symposium on intelligence applications of AI at CIA headquarters, with government, academic and industry participants. Deputy Director of Central Intelligence John McMahon was due to address it.
The first one: Declassified CIA records show a first symposium was held in 1982. They give few details of it.
The focus: How computers could help analysts handle growing volumes of information and pick out patterns.
A CIA journal imagines an AI interrogator called Analiza Intelligence agencies
What it was: An article in the CIA’s internal journal described an experimental program, ANALIZA, that questioned a subject, remembered earlier answers, picked out key words and chose follow-up questions from them.
Why it matters: It anticipated several features of today’s chatbots: memory of context, language analysis and adaptive questioning.
What it was not: It was an experiment, not evidence that the CIA ever used an AI system to interrogate anyone.
First intelligence-community AI symposium Intelligence agencies
What happened: The intelligence community held its first annual symposium on intelligence applications of artificial intelligence. Senior CIA leaders, including Deputy Director John McMahon, were pushing for practical uses.
Why it matters: AI moved from a research topic the CIA watched abroad to a tool it wanted for its own analysts.
Expert systems enter intelligence work Foundations
What happened: Expert systems, programs that encode a specialist’s rules and knowledge, became the main commercial form of AI. Intelligence agencies explored them and built ties with firms that made knowledge-based software.
The aim: To help analysts organise information and support decisions that had depended on slow manual work.
The first AI winter Foundations
What happened: Funding and enthusiasm for AI fell as early promises went unmet. Computers lacked the power and data the ideas needed.
For spies: Agencies still faced the same problem: growing volumes of information and too few analysts to read it.
CIA studies Soviet AI research Intelligence agencies
What happened: A CIA report examined Soviet work on pattern recognition and early machine learning and considered what it meant for national security.
A detail: It noted Soviet use of supervised learning to assess the seriousness of burn injuries, an example the CIA’s own journal highlighted again in 2026.
Why it matters: AI research had itself become a target for intelligence collection, decades before generative AI.
AI becomes a research field at Dartmouth Foundations
What happened: A summer workshop at Dartmouth College, proposed by John McCarthy, Marvin Minsky, Nathaniel Rochester and Claude Shannon, gave “artificial intelligence” its name and established it as a field.
For intelligence: The possibilities included automated reasoning, language processing, pattern recognition and machine-assisted decisions.
Turing asks whether machines can think Foundations
What happened: Alan Turing proposed the “imitation game”, later called the Turing Test, as a way to ask whether a machine could behave indistinguishably from a person.
Why it matters: It was not an espionage project, but it set out the question at the heart of AI research.
Bletchley Park and the codebreaking machines Foundations
What happened: British codebreakers at Bletchley Park, including Alan Turing, used electromechanical machines such as the Bombe to help break German Enigma traffic.
What it was not: These were not AI systems. They showed the strategic value of computation and automated information processing in intelligence.
How AI Is Changing Espionage
The same jobs, done at a different speed and scale.
| Intelligence activity | Traditional approach | With AI |
|---|---|---|
| Intelligence analysis | Analysts read documents and reports by hand | AI searches, summarises, translates and finds patterns in large datasets |
| Imagery and surveillance | Specialists inspect images and video | Computer vision detects and classifies objects across huge collections |
| Cyber espionage | Human operators run reconnaissance and tools | AI assists with research, lures, code and sorting stolen data; agents chain the steps |
| Human intelligence | Case officers spot, assess and develop sources | AI organises background material and supports multilingual contact |
| Counterintelligence | Investigators check identities and behaviour | AI flags unusual patterns and possible synthetic identities |
| Disinformation | Operators create misleading material by hand | Generative AI produces voices, images, video and personas at scale |
How US Agencies Brought AI Inside
From a new directorate to a chatbot for analysts.
The order matters. First came organisation: the CIA’s Directorate of Digital Innovation put data, cyber and open-source work under one roof in 2015. Then came a working military application in Project Maven. Generative AI arrived only after ChatGPT’s release in late 2022, and the agencies moved carefully. The first widely reported tool, Osiris, works on unclassified open-source and commercial data, where a wrong answer is easier to catch and a leak does less harm.
Officials have been unusually frank about the limits. The CIA’s chief technology officer told the AP in 2024 that analysts must be able to show “with absolute certainty” where information comes from. That rule — every claim traceable to a source — is the old discipline of intelligence analysis, applied to a new tool.
2026: The Year Adversaries Went Agentic
Four reports, eight months apart, describe the same shift.
The 2026 reports agree on one thing: AI has moved from an assistant that answers questions to a system that carries out several steps of an operation on its own. Google’s September report gave it a name — from prompting to autonomy. Anthropic described GTG-20006, a suspected Russian state-linked actor, using AI workflows for everything from building infrastructure to exfiltrating data, with agents reworking its malware until security tools stopped detecting it.
Two cautions apply. These are findings by private companies about misuse of their own products, with their own attributions; they are not court rulings or government investigations. And the companies are describing the cases they caught. The share of AI-assisted espionage that goes unseen is, by definition, unknown.
🔍 What the reports show
- AI used across reconnaissance, lures, malware and exfiltration.
- Agentic workflows that chain steps with little human input.
- AI used to write surveillance software, not just analyse data.
- AI models themselves targeted for theft.
❓ What they cannot show
- How much activity goes undetected.
- Independent confirmation of each attribution.
- What intelligence agencies do with AI in secret.
- Whether defenders are keeping pace.
When AI Builds the Surveillance System
The most striking part of Anthropic’s September 2026 report is not about hacking. It describes state-aligned actors, contractors and commercial spyware vendors from China, Iran and West Africa using an AI model as an engineering team. A single consultant working for Malian security authorities used it to design a platform to intercept communications across the country’s mobile networks. Another actor fed in social-media posts in batches and asked for each user’s location, demographic group and political leaning, with confidence scores. A PRC-aligned actor with no Arabic used it to run a recruitment approach to Uyghur targets in Syria, translating replies in real time.
Anthropic said it banned the accounts involved and shared information with partners and authorities where appropriate. The wider point is that tasks once needing teams of engineers, linguists and analysts can now be done by a handful of people.
Why CERT-In’s Warning Matters for India
AI agents are already reaching Indian systems.
CERT-In’s advisory is the clearest sign yet that AI-driven intrusion is not only a story about foreign spy agencies. Some of the agents that reached Indian systems were being run by AI developers during research and evaluation, and went further than their task allowed. Others were open-source attack frameworks used by criminals. In the disclosed cases, none of the Indian organisations noticed; the AI providers told them.
The fixes CERT-In lists are familiar: remove exposed credentials from code and repositories, shut down old test APIs, store payment keys properly, tighten cloud permissions and put multi-factor authentication on admin interfaces. What has changed is how quickly an AI agent can find the one that was missed. For background, see our explainer on the history of cybersecurity and digital privacy and the Pegasus spyware row in India.
Why Human Spies Still Matter
AI can show what is happening in the data. It struggles with why. A human source may know what a minister privately thinks, why a decision is being prepared or whether a public statement means what it says. That kind of knowledge rarely sits in any dataset.
Thomas Mulligan, a former CIA case officer, argued in the agency’s journal in March 2026 that AI will make technical collection cheaper and more widely available, and will also flood the world with fabricated documents, voices and images. In that world, he suggested, a trusted human source who can vouch for what is genuine becomes more valuable. The likely future is not machines replacing spies but human-machine teams, with AI doing the sifting and people making the judgments. The 1941 failure to act on Pearl Harbor warnings is a reminder that more information has never guaranteed better decisions.
Risks and Open Questions
- Privacy: how much personal data should agencies be allowed to collect and run through AI?
- False identification: what happens when a system wrongly marks someone as a threat?
- Deepfakes: can agencies reliably tell real audio, images and video from fakes?
- Autonomy: who is responsible when an AI agent goes beyond its task, as in the CERT-In cases?
- Human control: which intelligence and operational decisions must stay with people?
- Escalation: could fast, AI-driven cyber operations raise the risk of conflict between states?
- Company responsibility: what do AI developers owe when their products are used for surveillance or spying?
These questions are not abstract in India, where the Supreme Court’s privacy rulings and the debate over spyware already frame how surveillance is judged. For the wider military picture, see the AI military complex and India’s defence technology and our look ahead at AI and cyberwar to 2030.
Terms Explained
- HUMINT: human intelligence, gathered from people, such as recruited sources.
- SIGINT: signals intelligence, gathered by intercepting communications and electronic signals.
- OSINT: open-source intelligence, drawn from public and commercial information.
- Case officer: an intelligence officer who recruits and handles human sources.
- Agentic AI: AI that plans and carries out multi-step tasks and uses tools with little human input.
- Model distillation: copying an AI model’s behaviour by querying it at scale and training a new model on the answers.
- Attribution: the judgment of who is behind a cyber operation; usually a confidence assessment, not proof.
Explore More Timelines
People Also Ask
Frequently Asked Questions
Based on CIA, US Defense Department and CERT-In documents and the published threat reports of Google and Anthropic.
⚠️ Editorial Note
Dates and details on this page come from primary documents where available: the CIA reading room and Studies in Intelligence, US Defense Department releases, CERT-In’s advisory and the threat reports published by Google and Anthropic. Attributions of cyber operations to Russia- or China-linked groups are those companies’ own assessments and have not been tested in court. Some early items are thinly documented: the declassified record confirms a 1982 intelligence AI symposium but gives few details of it. Nothing here describes how to carry out an intrusion. Classified uses of AI by intelligence agencies are, by their nature, not covered.
Related Reading on AiTimeline
Sources & further reading
Every dated entry above was checked against these references. Last reviewed 10 November 2026.
- Artificial-Intelligence Research in the USSR (1964)
- 1983 AI Symposium Summary Report
- Espionage in Our AI Future: Why Human Intelligence Still Matters (Studies in Intelligence, March 2026)
- Intelligence in a Digital World: Inside CIA's Directorate of Digital Innovation
- Project Maven Industry Day Pursues Artificial Intelligence for DoD Challenges
- DOD Announces Establishment of Generative AI Task Force
- US intelligence agencies' embrace of generative AI is at once wary and urgent
- The US Intelligence Community, Global Security, and AI: From Secret Intelligence to Smart Spying
- The Digital Case Officer: Reimagining Espionage with Artificial Intelligence
- GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use
- GTIG AI Threat Tracker: From Prompting to Autonomy - The Evolution of Adversarial AI
- Detecting and countering misuse of AI: September 2026
- AI Agents as Attack Vectors (CICA-2026-3630)