Summary
- Google observed attackers moving from prompt-based AI use towards agentic workflows and AI-enabled automation.
- One compromised cloud environment hosted a multi-agent framework that built and executed mass credential harvesting in under six hours.
- Google says it has not yet observed fully autonomous attack pipelines targeting organisations in the wild.
Threat actors are beginning to use agentic AI to orchestrate parts of real cyber operations, according to Google, including a campaign that turned a compromised cloud environment into a mass credential-harvesting platform in less than six hours.
Google Threat Intelligence Group published its latest AI Threat Tracker on 8 September, describing a shift from basic model prompting towards workflows in which agents can manage scanning, troubleshoot errors, rotate infrastructure, and continue multi-stage tasks with less direct human intervention.
In one case investigated by Mandiant, a suspected financially motivated attacker compromised an organisation’s cloud infrastructure and deployed an autonomous multi-agent framework. Google says the operator used an AI coding chatbot, prompts, and agent instructions to plan, build, and execute a mass credential-harvesting campaign in under six hours.
The framework used preconfigured instruction files as operational playbooks, managing vulnerability scanning, troubleshooting, credential harvesting, and IP rotation. Operating from compromised cloud infrastructure also allowed attack traffic to originate from legitimate addresses associated with the victim environment.
Google says the activity resulted in thousands of third-party credentials being compromised.
The research does not support the broader claim that fully autonomous AI systems are now routinely conducting end-to-end attacks. Google explicitly says it has not yet observed threat actors deploying fully autonomous exploitation pipelines against targets in the wild.
The change is instead one of orchestration and tempo. Attackers have automated scanning, phishing, password attacks, and malware deployment for years. Agentic workflows add the ability to interpret intermediate results, select actions, handle operational errors, and continue towards an objective with less manual intervention.
That can reduce the intervals on which incident response has traditionally depended. Where an operator once moved manually between reconnaissance, exploitation, credential harvesting, and infrastructure management, an agent can perform repetitive decisions continuously while the human retains control over the broader objective.
Cloud environments are well suited to that model because their control planes are already designed for automation. Valid credentials can expose APIs for resource discovery, secrets, deployment, permission changes, and data access, while compromised compute can provide infrastructure for subsequent attacks.
Google also observed UNC6780 using tactics intended to manipulate AI coding assistants and large-language-model security scanners during open-source software supply chain compromises. AI-assisted development therefore creates exposure on both sides: attackers can use models to accelerate operations, while development teams increasingly depend on models and scanners whose own assumptions may be targeted.
Another part of the research concerns theft of AI assets themselves. Google recorded adversaries targeting proprietary models, source code, prompts, API credentials, research, and cloud compute across sectors including healthcare, government, media, and technology.
Some of that activity has an extortion motive rather than an espionage one, making proprietary AI infrastructure another category of enterprise information that can be stolen and monetised.
The resulting security problem is less about identifying an attack as “AI-generated” than preserving ordinary controls under faster conditions. Identity boundaries, cloud permissions, API monitoring, software review, segmentation, and incident-response authority still determine how far an attacker can move once automation begins.
Google’s findings point towards greater adversarial autonomy without establishing the science-fiction endpoint often attached to the term. Humans remain involved, but some of the delays between their decisions are being removed. Where defensive processes depend on those delays, the operating margin is beginning to narrow.
