A financially motivated threat actor used an autonomous multi-agent AI framework to plan, build, and execute a mass credential-harvesting campaign in less than six hours after compromising an organization's cloud infrastructure, according to a report published on September 8, 2026, by Google Threat Intelligence Group1,2.
The attacker assembled the framework from an AI coding chatbot, a prompt, and preconfigured markdown playbooks containing agent instructions3. The AI agents autonomously managed the vulnerability-scanning pipeline, harvested thousands of third-party credentials, troubleshot problems in real time, rotated IP addresses, and routed attack traffic through the victim's own cloud environment so outbound requests appeared legitimate4,9. Troubleshooting and IP rotation ran without an operator6.
The incident, observed during the second quarter of 2026, is documented in GTIG's Q3 2026 AI Threat Tracker, which draws on Mandiant incident-response engagements, threat-actor tracking, and live platform defenses. Mandiant investigators traced the campaign to a suspected financially motivated actor.
"Like everyone else, we're concerned about the vulnerability problem, but AI is being applied to several other areas, and it will be especially challenging as it is applied agentically, creating a scaled, faster adversary," said John Hultquist, chief analyst at GTIG10.
The report describes a broader shift: threat actors are moving beyond simple prompt-based LLM interactions to integrate AI capabilities into multiple stages of the attack lifecycle8,12. State-backed groups and criminal operators are using AI across reconnaissance, social engineering, malware development, vulnerability research, and post-exploitation troubleshooting. Adversaries are using both commercial and open-weight models to support these activities.
Separately, GTIG identified an exposed command-and-control server hosting an automated reconnaissance and credential-management framework called Recon. The system managed more than 23,800 harvested secrets in real time, including API keys for cloud and AI services. Its files included agent configuration instructions, knowledge files, and OpenClaw artifacts.
The report also flags nation-state activity. A suspected China-linked espionage group used Gemini to design an automated penetration-testing framework intended to carry out port scanning and service parsing on its own11. Google disabled the assets tied to that effort. Another China-linked actor experimented with AI development tools to build an automated exploitation and post-exploitation pipeline. Russia-based UNC5792 integrated AI models into bots that automatically monitor Telegram channels for government-relevant information.
On the supply-chain front, the financially motivated group UNC6780, also known as TeamPCP, ran large-scale compromises across PyPI, npm, and Docker Hub. The actor published trojanized forks of Model Context Protocol servers and injected malicious code into GitHub repositories that AI coding assistants clone. A credential stealer called DUSTMAKER drops files into hidden project directories such as .claude and .cursor, which AI tooling reads as ordinary developer clutter.
GTIG noted that once attackers have valid credentials, only 37% of their actions are blocked. METR separately reported that an attacker discovered an exposed agent dashboard, prompted the agent to reveal its model-provider API key, and used the credential for approximately three weeks, consuming an estimated $600,000 in model credits.
GTIG said it has not observed fully autonomous attack pipelines deployed against real-world targets. The report frames the current state as an incremental shift, not a sudden jump to fully autonomous cyberattacks.
ANALYSIS The six-hour timeline begins after cloud access was already obtained, meaning the full intrusion window is longer, but the compressed post-access phase leaves defenders far less time to correlate signals and authorize containment.
Google said it disrupted some observed malicious activity by disabling associated assets and hardening protections designed to prevent its AI systems from assisting similar attacks.