Google Finds AI Agents Ran a Credential-Theft Campaign in Under Six Hours

Google's Threat Intelligence Group (GTIG) has documented a criminal campaign in which a multi-agent AI system planned, built and ran a mass credential-harvesting operation in less than six hours. The findings, reported on September 8, mark a shift from attackers using AI as a writing and coding helper to attackers handing whole operations to agents. For enterprise security and AI leaders, the report has two messages: attacks will move faster than human response times, and the AI systems companies are deploying are now targets in their own right.

What did Google's threat report find?

According to The Hacker News, which summarized GTIG's report "From Prompting to Autonomy: The Evolution of Adversarial AI," a financially motivated actor compromised an unnamed organization's cloud infrastructure and deployed an autonomous, multi-agent attack framework there. The actor used an AI coding chatbot, a prompt and preconfigured markdown instruction files that served as playbooks.

From those inputs, the agents ran the vulnerability-scanning pipeline, fixed errors as they came up, rotated IP addresses and routed traffic through compromised cloud environments, without a human stepping in. The campaign harvested thousands of third-party credentials. Google did not give an exact count, and the victim was not named.

GTIG chief analyst John Hultquist said, according to The Hacker News, that "we can assume that all threat actors are using AI in some capacity." AI Weekly also highlighted his warning that criminals will favor attacks that move faster than defenders can respond.

How are attackers going after enterprise AI systems?

The report goes beyond one campaign. GTIG described attackers exfiltrating API credentials tied to proprietary AI models at healthcare, government and media organizations, then hijacking victims' cloud environments to run their own AI workloads, according to The Hacker News.

It also tracked a group called TeamPCP, also known as UNC6780, which ran software supply chain compromises against PyPI, npm and Docker Hub. Its newer payload, DUSTMAKER, targets CI/CD pipelines and, per the report, is the first of its tools to poison AI assistant workspaces and use prompt injection to evade defenses. Infostealers such as Lumma Stealer and Vidar have expanded to grab AI developer configuration files. Other groups stole models, prompts, skills and source code for extortion.

A China-nexus group, UNC6508, set up local language models on compromised cloud infrastructure using open-weight models, a setup that avoids the misuse monitoring commercial model providers run. GTIG also listed state-backed groups from China, Russia, Iran and North Korea using commercial assistants, including Gemini, Claude and Codex, for reconnaissance, phishing lures, exploit scripts and debugging.

Why does this matter for enterprises deploying AI?

Three implications stand out.

Response time is the new bottleneck. A campaign that goes from plan to mass credential theft in under six hours leaves little room for manual triage. Detection and containment for cloud credentials, unusual compute use and outbound traffic need to be automated to keep pace.

AI assets are now crown jewels. API keys for model providers, agent configurations, prompt libraries and fine-tuned models carry real value to attackers, both to resell and to run unmonitored workloads on someone else's bill. Many companies do not yet inventory these assets or rotate their keys with the same rigor as database credentials.

Developer tooling is an attack surface. Poisoned AI assistant workspaces and stolen developer configurations put coding agents and their permissions squarely in scope for security reviews.

Speakers at AI Connect events have warned about this exposure. At The AI Enterprise Conference 2026, Rubrik's Cal Al-Dhubaib argued that most organizations already run agents whether or not they planned to. "You have an agentic problem whether or not you want to acknowledge it," he said, in a session on why agents need context-based security controls. A year earlier, Airia's leaders told a AI Connect webinar that unsanctioned AI tools need layered detection, a point that applies with more force when stolen AI credentials are a target.

What is Google proposing, and what is contested?

Google's prescription centers on open-weight models. According to The Hacker News, GTIG argued that open models enable local deployments without centralized safety monitoring, and called for binding safety baselines across the industry for open-source AI, along with coordinated platform policies against uncensored checkpoints. It also pointed to enterprise platforms such as Gemini Enterprise as a contained place to use open models.

That position is likely to draw pushback. Open-weight advocates argue that open models support innovation, transparency and data sovereignty, and GTIG itself acknowledged that simply gating open models is impractical. Google also sells the managed alternative it recommends, which readers should weigh.

What should security and AI leaders do next?

The near-term checklist is practical: inventory every AI API key and agent credential and put them under the same rotation and monitoring as other secrets; watch for unexpected GPU or model spend as a sign of hijacked infrastructure; review the permissions held by coding agents and CI/CD pipelines; and test response playbooks against attacks measured in hours, not days. The next thing to watch is whether cloud and model providers turn GTIG's findings into default controls, or leave the work to customers.

Frequently asked questions

What did Google's GTIG report on autonomous AI attacks find?

A financially motivated actor deployed a multi-agent framework that scanned for vulnerabilities, rotated IP addresses and harvested thousands of third-party credentials in under six hours, with little human intervention, according to The Hacker News' summary.

How are attackers targeting enterprise AI systems?

GTIG described theft of AI API credentials, hijacking of cloud environments to run AI workloads, theft of models and prompts for extortion, and supply chain malware that poisons AI assistant workspaces.

What should enterprises do about AI-driven attacks?

Inventory and rotate AI API keys and agent credentials, monitor for unexpected GPU or model spend, review coding-agent and CI/CD permissions, and automate response for attacks that unfold in hours.

Filed under: Security & Fraud, Agentic AI, AI Governance & Trust