Intel Brief: Caught in the Crossfire - When an AI Agent Swarm Uses Your Infrastructure to Attack

Executive Summary For approximately 48 hours in June 2026, a cluster of activity that the urlscan Threat Research Team assesses to be a swarm of automated AI agents used urlscan.io as a free, unattributable and anonymous browser to perform scans of government data portals in Australia and India. The urlscan platform was not the target of this activity, but we have visibility of the activity through the saved artifacts on the platform. Using internal platform data, the urlscan Threat Research Team attributed 3,553 scans to this cluster, submitted through 15 urlscan API keys.