Hackers are increasingly using artificial intelligence to automate multiple stages of cyberattacks, with Google Threat Intelligence Group reporting that some attackers have moved beyond simple prompting to AI-driven workflows capable of scanning targets, troubleshooting failures and harvesting credentials with limited human involvement.
In a report published September 8, 2026, Google Threat Intelligence Group (GTIG) said it had observed threat actors moving toward agentic AI workflows and AI-enabled automation during the second quarter of 2026.
The company said one financially motivated threat actor compromised a victim’s cloud infrastructure and then used an AI coding chatbot, a prompt and preconfigured agent instructions to plan, build and execute a mass credential-harvesting operation in less than six hours.
The campaign compromised thousands of third-party credentials, according to GTIG.
The AI agents were instructed to manage the vulnerability-scanning pipeline, troubleshoot operational problems in real time and handle Internet Protocol address rotation without manual intervention.
Google said the attackers also operated from the victim’s cloud infrastructure, allowing attack traffic to pass through legitimate IP addresses.
The operation illustrates the change GTIG is seeing in how artificial intelligence is being used by attackers. Rather than relying on a human operator to make every decision, the systems could perform connected tasks and respond to problems during an ongoing operation.
Google also identified an exposed command-and-control server hosting an automated reconnaissance and credential-management framework known as “Recon.” Its files included agent configuration and knowledge documents named AGENTS.md, KNOWLEDGE.md and agentic_vuln_research.md.
According to GTIG, the exposed infrastructure was subsequently converted into a production dashboard used to organize, validate and manage more than 23,800 harvested secrets, including API keys for cloud and artificial intelligence services.
Google said the operation represented a move from traditional credential theft toward what it described as agentic harvesting. The system could research vulnerabilities, scan server-side infrastructure and execute targeted exploits with minimal human intervention.
GTIG also identified attempts by a China-linked cyber-espionage group to develop an automated penetration-testing framework with Gemini. The planned system was designed to observe the state of a target, reason about possible actions and execute tasks in unpredictable environments.
Its planned discovery functions included port scanning and service parsing.
Google stressed that this activity was limited to attempts to build the framework and said it disabled assets associated with the activity. The company did not report that the completed framework had been used successfully against victims.
Another operation involved threat actors experimenting with multiple AI models while developing exploitation and post-exploitation workflows. Google said the actors used services including Claude, Gemini and Codex for tasks such as exploit-code generation, spear-phishing content and troubleshooting.
The activity also involved experimentation with Phalanx, an open-source framework for autonomous penetration testing. After successful exploitation, the operation could deploy the Shai-Hulud framework to compromised systems, establish command and control and begin credential harvesting for lateral movement, according to GTIG.
Google’s report also points to a growing connection between AI-assisted software development and attacks on the open-source software ecosystem.
GTIG said AI coding tools have accelerated development for both human programmers and automated agents, while the growing use of open-source components has increased the number of dependencies and other resources that can be targeted.
The company highlighted UNC6780, also known as TeamPCP, which has conducted large-scale supply-chain compromises involving ecosystems such as PyPI, npm and Docker Hub.
Google said UNC6780 has also targeted AI environments and developer tools. In one case, the group created a malicious GitHub Actions workflow affecting a company’s proprietary AI repository, while a separate extortion actor later obtained and threatened to release the repository.
GTIG said UNC6780 has used a credential-stealing malware family known as DUSTMAKER to target AI coding assistants and development environments.
Google reported that DUSTMAKER can place malicious files inside hidden directories used by AI coding assistants and integrated development environments, establish automated startup or build commands, and interact with continuous integration and continuous delivery environments.
The malware can also extract OpenID Connect tokens from GitHub Actions runner memory, according to GTIG. Google said those tokens could be used to publish compromised packages with valid build attestations, allowing malicious packages to pass some automated trust checks used by AI coding agents.
The company said DUSTMAKER also contains techniques designed to interact directly with AI systems. Malicious prompts can be placed inside code in an attempt to influence AI-based security scanners and interfere with their analysis.
AI services and credentials are becoming targets themselves.
GTIG said underground markets tracked during 2026 showed increasing demand for compromised accounts belonging to AI services, particularly Claude and Gemini, as well as autonomous coding environments such as Cursor Pro and Devin.
Google said average underground marketplace prices for these accounts more than doubled during 2026.
Credential-stealing malware has also been targeting configuration files used by AI development tools. In May 2026, GTIG observed ACRSTEALER controllers targeting the secrets.json file associated with Cline and the config.yaml file associated with Continue AI.
Google said those files can contain plaintext API keys and custom model-routing endpoints, potentially giving attackers access to paid AI quotas and related infrastructure.
Attackers are also using stolen cloud access to run AI workloads without paying for the underlying resources, a practice Google refers to as LLMjacking.
GTIG said the cost of premium AI models and high-performance computing has encouraged attackers to steal AI accounts and compromise enterprise cloud environments.
In one April 2026 incident investigated by Mandiant, an attacker entered a victim’s cloud environment using an exposed GitHub personal access token. The attacker then enabled Gemini Enterprise, provisioned high-performance computing resources, created Docker repositories and deployed LiteLLM and the Manus agent framework.
The attacker also exposed Cloud Run services, created a privileged service account, searched BigQuery for additional credentials, attempted to assign project ownership externally, created an AI Workbench environment, enabled generative AI APIs, requested additional NVIDIA RTX 6000 capacity and launched further compute instances.
Google said the activity demonstrated how compromised cloud infrastructure can be repurposed to sustain unauthorized AI workloads.
The threat is not limited to credentials and computing resources. GTIG said attackers are increasingly targeting proprietary AI models, source code, prompts and research for espionage and extortion.
During the second quarter of 2026, Mandiant investigated incidents involving stolen AI research and proprietary models at organizations in sectors including healthcare, government and media.
Google also reported that model-distillation campaigns targeting its AI systems have grown in scale. Some coordinated campaigns exceeded 100 million prompts and targeted capabilities including visual and audio understanding, image generation and video generation.
GTIG said attackers have used proxy infrastructure, thousands of compromised credentials and fraudulent accounts to distribute queries and conceal the source of their activity.
Google said it has developed methods to identify models derived from Gemini and has deployed defenses intended to reduce the usefulness of unauthorized model extraction.
Despite the growing use of autonomous techniques, Google cautioned against interpreting the findings as evidence that fully autonomous cyberattacks are already commonplace.
GTIG said it has not yet observed threat actors deploying fully autonomous attack pipelines against targets in the wild.
Instead, Google described a gradual development in which attackers layer AI capabilities onto existing operations. Human involvement is being reduced, but the company said the observed campaigns do not yet represent completely independent end-to-end attacks.
GTIG also said threat actors continue to use AI for reconnaissance, social engineering, malware development, translation and information operations. However, the company said it had not observed breakthrough capabilities from AI-powered information operations and had not seen experimental interactive AI agents and automated bot networks used in live operations.
Google is responding with its own AI-based security systems. The company said it uses threat intelligence from observed attacks to strengthen its AI safety classifiers and models and to disable accounts and infrastructure associated with malicious activity.
It has also developed agentic security capabilities for source-code review and introduced Google AI Threat Defense, an architecture that combines Gemini and other AI models with Wiz risk prioritization, automated remediation through Gemini and CodeMender, and intelligence from Mandiant.
Google has also introduced Gemini 3.8 Flash Cyber, which it describes as its most capable cybersecurity model for vulnerability detection and automated patching.
The latest findings mark another step in the use of AI in cyber operations. Attackers are no longer relying only on models to generate individual pieces of content or code. In the incidents documented by Google, AI was connected to tools, instructions and operational workflows that allowed substantial portions of an attack to proceed with less direct human involvement.
For defenders, the concern is not simply that AI can help an attacker write code faster. The more significant development is the ability to connect reconnaissance, exploitation, credential theft and other activities into workflows that can operate at greater speed and scale.
Google’s findings indicate that fully autonomous attacks remain an emerging capability rather than an established norm. But the six-hour credential campaign and the separate agentic reconnaissance operation show that attackers are already testing how far they can push automated, AI-assisted operations.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
