Google: AI agents stole credentials in under six hours

Investigators from Mandiant, a Google company, traced the campaign to a suspected financially motivated actor. The attacker first broke into an organization's cloud infrastructure, then assembled an autonomous framework from an AI coding chatbot, a prompt and a set of agent instructions. Preconfigured Markdown playbooks drove the scanning and harvesting that followed. Troubleshooting and IP rotation ran without an operator, and traffic left the victim's own addresses, making it appear legitimate.

The report, titled “From Prompting to Autonomy: The Evolution of Adversarial AI,” covers activity tracked during the second quarter. It follows a May edition that documented the first confirmed case of criminals using AI to build a working zero-day exploit. Google said the change since then is how little human involvement remains; adversaries are handing multistep decisions to models, shrinking the window defenders have to react. Google said it has not observed fully autonomous attack pipelines in the wild, but an alleged China-linked espionage group used Gemini to design an automated penetration testing framework intended to run port scanning and other early intrusion work by itself. Google disabled assets tied to that effort.

On the software supply chain, the report focuses on a criminal group Google labels UNC6780, also known as TeamPCP. The group poisoned the LiteLLM gateway in March. Since then, it has run large-scale compromises across PyPI, npm and Docker Hub, publishing trojanized forks of Model Context Protocol servers and injecting malicious code into GitHub repositories that AI coding assistants clone. Its DUSTMAKER credential stealer drops files into hidden project directories such as .claude and .cursor, where AI tooling reads them as ordinary developer clutter. Some samples went further: malware loaders carried prompt injections framed as extreme requests about biological and nuclear weapons, likely intended to make large language model security scanners refuse the file and skip the malicious JavaScript beneath it.

AI assets themselves are becoming targets. Mandiant worked several data theft extortion cases last quarter in which attackers stole proprietary models, source code and prompts from technology, healthcare and media companies in North America and Europe. One healthcare victim lost drug research and a proprietary model to a group that threatened to publish both unless paid. Compute is also being stolen. An alleged China-linked group, UNC6508, tied to campaigns against academic, medical and military research institutions, was observed deploying open-weight models inside compromised cloud environments to keep its activity away from commercial API monitoring. An exposed GitHub token let another attacker provision high-performance GPU instances in April at the victim's expense.

John Hultquist, chief analyst at Google Threat Intelligence Group, said the working assumption now is that every threat actor is using AI in some capacity. “Criminals, like the ones who conducted a mass exploitation campaign in just six hours, will gravitate to attacks that are faster than we can respond to,” he added. He said groups such as TeamPCP are a newer category, going after AI systems as they are built into the enterprise stack rather than simply using them.