ANALYSIS North Korea's Kimsuky group has crossed a threshold that cybersecurity researchers long anticipated: the first confirmed use of an autonomous AI coding agent, not merely a chatbot or language model, to mass-produce attack infrastructure for a state-backed cyber operation. The finding, paired with a $50 million bet by a new startup on securing the AI-agent supply chain, frames a widening gap between offensive adoption and defensive readiness.
Why it matters
South Korean security firm Genians confirmed that Kimsuky exploited the open-source AI coding agent "opencode" to generate financial and insurance-themed decoy documents at scale2,5. Genians said this "marks the first time" it has detected signs of Kimsuky utilizing AI coding agents in its malicious attacks4. ◆ The distinction matters: Genians had previously detected signs of the hacking group using large language models to create decoys and plan malicious attacks, but an LLM answering prompts is a different capability from an agent that executes multi-step programming tasks from natural-language instructions. The shift from copilot to autonomous production line compresses the time an attacker needs to prepare a campaign.
The big picture
Genians' report, published Monday, analyzed 13 malicious files collected last month3. In some of the PDF documents, both the "creator" and "producer" metadata fields were listed as "opencode". "These are not values typically generated with standard document creation software, strongly suggesting the documents were generated by an AI agent through programming, rather than created manually," the report said. Multiple malicious documents shared identical creation timestamps down to the second, strong evidence of automated, script-based generation. Unsubstituted "(placeholder)" markers appeared in document bodies where specific figures such as payment cycles and interest rates should have appeared, a telltale sign of templated AI output.
The campaign's operational tradecraft extended well beyond document creation. The malicious files received additional commands via GitHub and Pastebin. Infected computers had scheduled tasks secretly registered and disguised as Windows' built-in BitLocker feature or MATLAB software. Some variants halted execution when security tools were detected, and the new variants deleted command execution history to erase analysis traces. Researchers found that Kimsuky distributed emails with attached compressed files holding documents titled "insurance bills" or "policy fund notice," which activated malware when users clicked them.
ANALYSIS Taken together, the evidence describes a pipeline: an AI agent generates convincing lure documents at machine speed, while human operators (or additional automation) layer on evasion logic and command-and-control infrastructure. The placeholder artifacts suggest the agent was given templates and told to populate them, a workflow that scales trivially once established.
Between the lines
The defensive side of the ledger is scrambling to catch up. AIR, an AI security startup founded by veterans of Israel's Unit 8200 intelligence corps, emerged from stealth the same day with $50 million raised across two seed rounds6. A $10 million round was led by Sequoia, followed by a $40 million round led by Greenoaks. AIR's CEO Yair Saban said AI agents are "increasingly resembling operating systems within companies, yet the tools and add-ons they use lack the kind of verification long applied to software like device drivers". AIR's platform discovers active agents across a company's environment, flags unapproved AI tool usage, and enforces security checks on agent actions in real time, screening tools against a continuously updated whitelist that currently filters out about 27% of add-ons it evaluates. The company reports more than 20 customers, with strongest demand from regulated sectors like financial services.
ANALYSIS AIR's pitch addresses the enterprise side of the same coin Kimsuky is exploiting on the offensive side: open-source AI agents are proliferating faster than organizations can vet them. The fact that Kimsuky used an openly available tool, not a bespoke model, underscores that the barrier to weaponizing coding agents is effectively zero for any group with operational intent. Security experts stress that AI has elevated both the sophistication and speed of attacks, making it essential to build integrated security frameworks centered on anomaly detection and response.
What's next
Genians noted that the forged attribute descriptions in the LNK files matched fingerprints described in reports on Kimsuky's Operation GitPower. ◆ That continuity suggests the group is layering AI-agent capabilities onto an existing, active campaign rather than starting fresh, meaning defenders tracking GitPower indicators now face faster-evolving lure content generated by the same pipeline. AIR's $50 million war chest and its 27% add-on rejection rate offer one data point on the scale of the filtering problem ahead. The scheduled tasks in the Kimsuky malware began repeating at regular intervals after five minutes and continuously downloaded additional malicious commands from GitHub, a reminder that the agent-built documents are only the entry point for persistent access that outlasts any single lure.