A financially motivated attacker used an autonomous multi-agent AI framework to plan, build, and deploy a mass credential-harvesting campaign in under six hours, according to a report released on September 8, 2026, by Google's Threat Intelligence Group (GTIG)1,2.
The report, titled "From Prompting to Autonomy: The Evolution of Adversarial AI," covers activity GTIG tracked over the second quarter and documents a shift from simple prompt-based large language model interactions to multi-agent systems that coordinate entire attack lifecycles with minimal human oversight.
In the headline incident, Mandiant investigators traced the campaign to a suspected financially motivated actor who first compromised an organization's cloud infrastructure. The attacker then assembled an autonomous framework from an AI coding chatbot, a prompt, and a set of markdown agent instructions. The AI agents managed vulnerability scanning, harvested thousands of third-party credentials, troubleshot problems in real time, rotated IP addresses, and routed attack traffic through the victim's own addresses so it appeared legitimate on the way out.
Researchers also found an exposed command-and-control server hosting an automated reconnaissance and credential-management framework called Recon. Recon managed more than 23,800 harvested secrets, including API keys, in real time.
The report documents additional adversary experimentation across state-backed groups. An alleged China-linked espionage group used Gemini to design an automated penetration-testing framework intended to run port scanning, service parsing, and other early intrusion work autonomously; Google said it disabled the assets tied to that effort. Russia-based UNC5792 integrated AI models to automate monitoring bots that searched Telegram channels for information of interest to the government.
Supply-chain attacks also featured prominently. A criminal group Google labels UNC6780, also tracked as TeamPCP, poisoned the LiteLLM gateway in March and has since run large-scale compromises across PyPI, npm, and Docker Hub. The group published trojanized forks of Model Context Protocol servers and injected malicious code into GitHub repositories that AI coding assistants clone. A credential stealer called DUSTMAKER drops files into hidden project directories such as .claude and .cursor, which AI tooling reads as ordinary developer clutter. Some malware loaders contained prompt injections written as extreme requests about biological and nuclear weapons, likely intended to make LLM-based security scanners refuse the file and skip the malicious JavaScript beneath it.
Mandiant worked several data-theft extortion cases last quarter in which attackers took proprietary models, source code, and prompts from technology, healthcare, and media companies in North America and Europe. One healthcare victim lost drug research and a proprietary model to a group that threatened to publish both unless paid.
Separately, GTIG observed suspected activity by UNC6508, described as an alleged China-linked group, deploying open-weight models inside compromised cloud environments to keep prompting away from commercial API monitoring. In another case, an exposed GitHub access token let an attacker provision high-performance GPU instances in April at a victim's expense.
GTIG said Gemini caught many of these abuses early and responded in accordance with its safety protocols, allowing Google to disrupt campaigns and ban associated accounts. The group also noted that once attackers have valid credentials, only 37% of their actions are blocked.
GTIG underlined that fully autonomous attack pipelines have not been observed deployed against real-world targets. "Adversaries are handing multistep decisions to models, which shrinks the window defenders have to react," GTIG said.
ANALYSIS The sub-six-hour timeline from initial compromise to mass credential harvesting compresses the detection window to a degree that challenges conventional incident-response cadences built around human-speed adversaries. The 37% post-authentication block rate reported by GTIG compounds the problem: once agent-driven campaigns obtain valid credentials, the majority of subsequent actions pass through defenses unimpeded.