Cybercriminals and state-backed hackers are moving beyond using AI as a coding or research assistant and are instead building agentic systems that can autonomously scan targets, troubleshoot failures, and harvest credentials.
Google Threat Intelligence Group (GTIG) says one financially motivated actor used a multi-agent framework to build and launch a large-scale credential theft operation in less than six hours.
The findings come from GTIG’s Q3 2026 AI Threat Tracker, based on analysis of Mandiant incident response investigations, Google threat-actor tracking, and activity detected through the company’s platform defenses.
In one Q2 2026 intrusion, an attacker compromised an organization’s cloud infrastructure and combined an AI coding chatbot, a prompt, and predefined agent instructions to create an automated vulnerability-scanning and credential-harvesting pipeline. Markdown files acted as operational playbooks, allowing the agents to manage scans, resolve errors in real time, and rotate IP addresses without requiring continuous human input.
GTIG researchers said the campaign's significance was not a new hacking technique, but the speed and independence with which existing techniques could be orchestrated.
The attacker’s framework ultimately compromised thousands of third-party credentials. Running from a victim’s cloud environment also allowed malicious traffic to originate from legitimate IP addresses, potentially making it harder for defenders to distinguish from normal activity.
GTIG separately discovered an exposed command-and-control server running an agentic reconnaissance platform dubbed “Recon.” Its directories contained files including AGENTS.md, KNOWLEDGE.md, and agentic_vuln_research.md, along with .openclaw/ and memory/ components. The system later appeared as a production dashboard that could organize and validate more than 23,800 harvested secrets, including credentials for cloud and AI services.
Google also observed a China-linked espionage group attempting to design an agent that could observe a target, reason about possible actions, and perform discovery tasks such as port scanning and service analysis. However, GTIG said that activity did not progress beyond attempts to build the framework.
The researchers cautioned that this does not yet amount to fully autonomous hacking. GTIG has not observed threat actors running end-to-end autonomous zero-day discovery and exploitation pipelines against real-world targets. Instead, the current shift is toward AI agents coordinating established tools and making tactical decisions with far less human intervention.
For defenders, that compressed timeline makes prevention more important. Organizations should tightly restrict cloud credentials, rotate exposed secrets, monitor unusual compute and API usage, and treat AI-agent configuration files and developer automation environments as security-sensitive assets.
Leave a Reply