The Threat is constituted by all the AI ships free to attack Humans as they see an opportunity.
There are two distinct behaviors: the normal threat and the Threat Fleet. The last is a more coherent fleet of free ships with a behavior similar to the Special Forces, doing pressure and invasions instead of mobile defense.
The Threat Fleet is enabled at Difficulty 6+ as part of the "smart" behaviors the AI has progressively access to between difficulties 5 and 8.
When the AI reinforces a planet, the new ships are guarding their Guard Posts. When their planet is attacked, they wake up and defend themselves, but once the planet is clear of Human presence, they don't return to their guard posts. Instead, they switch to Threat mode.
The Cross Planet Waves option spawns Waves on AI planets, directly as Threat.
A Cross Planet Attack is basically a massive addition to the Threat.
After 30 minutes of "normal" Threat, free ships join the central Threat Fleet.
How smart the Threat is depends on AI Difficulty. At low difficulty, any fleet joining the Threat will simply walk to human territory without checking its chances of success. At higher difficulty, the Threat may gather and form a Threat Fleet, which has access to more advanced behaviors.
Threat tends to station near the frontier: ships often move toward a wormhole leading to human territory but instead of crossing it they then move to a gathering place nearby.
Threat tends to roam the frontier: sometimes Threat ships make a detour from a frontier planet to another. This is often to approach a less protected Human planet when Human fleets move.
Threat tends to back-stab: when Human fleets are engaged with AI forces in AI territory, it may let Human planets undefended. If the Threat Fleet at the frontier of a Human planet thinks it has good chances of success, counting local defense and nearby unengaged Human fleets, it will invade. This often forces Human players to retreat or lose a planet.
If not part of the Threat Fleet, Threat is often scattered and pressure different Human planets at once. Cross Planet Attacks often do that.