Autonomous Multi-Agent AI Hacked Thousands of Credentials in Six Hours, Google Report Finds

The outcome of the intrusion was determined the moment the threat actor deployed an autonomous multi-agent framework into a compromised cloud environment, handing multistep operational decisions over to artificial intelligence. Operating entirely without human oversight, the AI agents planned, built, and executed a mass credential-harvesting campaign that compromised thousands of third-party credentials in under six hours. This shift from human-driven attacks to machine-speed automation is the central finding of the Q3 2026 AI Threat Tracker report released Tuesday by the Google Threat Intelligence Group (GTIG).[1][2]

According to incident response telemetry from Mandiant, the financially motivated attacker assembled the autonomous framework using an AI coding chatbot, a core prompt, and a set of agent instructions. Using preconfigured markdown playbooks—specifically files named AGENTS.md and KNOWLEDGE.md—the AI agents autonomously managed the vulnerability-scanning pipeline and harvested credentials at scale. The system was capable of troubleshooting errors in real time and executing IP rotation logic without requiring an operator to intervene.[2][3]

To evade detection, the attack traffic was routed directly through the victim's own compromised cloud infrastructure, allowing the malicious activity to pass through legitimate IP addresses. This approach dramatically reduced the human-in-the-loop latency that traditionally slows down cyberattacks. "Over the past quarter, threat actors have moved beyond simple prompt-based LLM interactions to integrate AI capabilities into multiple stages of an attack lifecycle," GTIG researchers noted in the report.[1][2][3]

The speed of the autonomous framework represents a significant challenge for enterprise security teams, as a six-hour execution window is often faster than standard incident response cycles can begin. John Hultquist, chief analyst at Google Threat Intelligence Group, emphasized that the working assumption is now that every threat actor is utilizing AI in some capacity. "Criminals, like the ones who conducted a mass exploitation campaign in just six hours, will gravitate to attacks that are faster than we can respond to," Hultquist said.[2][3]

Beyond credential harvesting, the GTIG report details how threat actors are increasingly targeting the AI supply chain itself. A criminal group tracked as UNC6780, also known as TeamPCP, has conducted large-scale compromises across major open-source repositories including PyPI, npm, and Docker Hub. After poisoning the LiteLLM gateway in March 2026, the group began publishing trojanized forks of Model Context Protocol (MCP) servers and injecting malicious code into GitHub repositories that AI coding assistants frequently clone.[1][2]

TeamPCP's operations deploy a credential stealer known as DUSTMAKER, which drops files into hidden project directories such as .claude and .cursor, disguising the malware as ordinary developer clutter. In some instances, the malware loaders carried prompt injections containing extreme requests about biological and nuclear weapons. This text was specifically designed to trigger large language model security scanners into refusing the file, thereby causing the scanner to skip the malicious JavaScript hidden beneath the prompt.[1][2]

Proprietary AI assets have also become high-value targets for extortion. During the second quarter of 2026, Mandiant investigated several data theft cases in which attackers exfiltrated proprietary models, source code, and prompts from technology, healthcare, and media companies across North America and Europe. In one notable case, a healthcare organization lost both drug research data and a proprietary AI model to a threat group that threatened to publish the intellectual property unless a ransom was paid.[1][2]

State-linked actors are similarly experimenting with agentic AI capabilities. GTIG observed a China-nexus cyber espionage group attempting to use Google's Gemini model to design a dynamic, automated penetration testing framework. The group aimed to build an architecture capable of observing a target's state, reasoning through actions, and executing tasks in unpredictable environments. While Google disabled the assets tied to the effort before it could be fully deployed, the attempt underscores the growing adversary interest in offensive AI automation.[1][2][3]

In another incident, researchers discovered an exposed command-and-control server hosting an automated reconnaissance and credential-management framework dubbed Recon. The server contained configuration files, AI agent instructions, and artifacts that managed more than 23,800 harvested secrets, including API keys, in real time. Another China-linked group, UNC6508, was observed deploying open-weight models inside compromised cloud environments to keep its prompting activity hidden from commercial API monitoring.[2][3]

For defenders, the transition from passive infostealers to offensive agentic harvesting means that traditional, static detection methods are becoming less effective. Because AI agents can dynamically alter their tactics and operate at machine speed, security teams are being forced to prioritize behavioral detection, robust identity controls, and strict governance over non-human identities like service accounts and API keys.[1][3]