Artificial intelligence agents are moving from experimental tools to active weapons in cyberattacks, with threat actors using autonomous systems to scan for vulnerabilities, steal credentials, and execute exploits with far less human oversight than traditional hacking campaigns. According to Google Threat Intelligence Group's Q3 2026 AI Threat Tracker, attackers are transitioning from simple AI prompts toward sophisticated multi-agent frameworks that can handle multiple connected tasks simultaneously, marking a significant shift in how modern cyberattacks are conducted.

What Exactly Are AI Agents Doing in Cyberattacks?

AI agents are autonomous systems that can perform multiple tasks with minimal human direction. In the context of cyberattacks, threat actors are leveraging these systems to automate parts of the attack lifecycle that traditionally required hands-on hacker involvement. The Google report, which draws on Mandiant incident response engagements and live platform defenses, identified several ways attackers are deploying agentic AI.

• Vulnerability Scanning: AI agents automatically probe networks and systems to identify security weaknesses without requiring attackers to manually search for flaws.
• Credential Harvesting: Autonomous systems extract usernames, passwords, and authentication tokens from compromised systems and organize them for later use.
• Real-Time Troubleshooting: When attacks encounter obstacles, AI agents diagnose problems and adjust tactics on the fly, including rotating IP addresses to avoid detection.
• Exploit Development: Threat actors use AI coding assistants to write custom exploit scripts that target specific vulnerabilities without manual coding effort.

How Did Attackers Pull Off a Six-Hour Credential Theft Campaign?

In Q2 2026, Mandiant investigated a financially motivated threat actor who compromised a cloud infrastructure and deployed an autonomous multi-agent framework to steal credentials at scale. The attacker used an AI coding chatbot, a prompt, and agent instructions to plan, build, and execute a mass credential-harvesting campaign in less than six hours, compromising thousands of third-party credentials.

"The agent instructions enabled the AI to autonomously manage the vulnerability scanning pipeline, perform real-time troubleshooting, and execute IP rotation logic without manual intervention," researchers at Google Threat Intelligence Group explained.

Google Threat Intelligence Group, Mandiant Incident Response

What made this attack particularly effective was the attacker's choice of infrastructure. By operating from the victim's own cloud environment, attack traffic passed through legitimate IP addresses, making it harder for security systems to flag the activity as malicious. The speed and automation of the campaign underscore how AI agents compress what might have taken days of manual work into hours.

What Did Researchers Find on the Exposed Command-and-Control Server?

Google Threat Intelligence Group identified an exposed command-and-control server hosting an automated reconnaissance and credential management framework called "Recon." The exposed directory contained configuration files with names like AGENTS.md, KNOWLEDGE.md, and agentic_vuln_research.md, along with directories for storing agent memory and operational logs.

Shortly after detection, the exposed directory became a production dashboard designed to organize, validate, and manage more than 23,800 harvested secrets in real time. These secrets included API keys for cloud services and AI platforms, which threat actors could use to gain deeper access to victim systems or to fund their own AI-powered attacks.

Researchers described this activity as a transition from "passive, endpoint-focused infostealers to offensive agentic harvesting," marking a fundamental shift in how attackers approach credential theft. Rather than stealing credentials reactively, threat actors are now proactively scanning, harvesting, and organizing stolen secrets at scale.

Are Nation-State Actors Using AI Agents Too?

The threat is not limited to financially motivated cybercriminals. Google researchers also documented cyber espionage actors with ties to the People's Republic of China experimenting with AI-powered attack frameworks. In one case, a PRC-nexus threat actor used Google's Gemini AI model to design a dynamic, automated penetration testing framework intended to observe target systems, reason through attack options, and execute tasks in unpredictable environments.

In a separate incident, another PRC-nexus actor experimented with AI development tools to build an AI-assisted automated exploitation and post-exploitation pipeline. This operation involved querying Claude, Gemini, or Codex to write custom exploit scripts, generate spear-phishing lures, and debug errors. The attackers also used Burp Suite to probe web applications and Phalanx, an open-source penetration testing framework, for automated exploitation routines.

How to Defend Against AI-Powered Cyberattacks

• Monitor for Autonomous Behavior: Security teams should look for signs of automated attack activity, such as rapid vulnerability scanning, mass credential harvesting, or unusual patterns of API calls that suggest agent-driven activity rather than manual hacking.
• Harden AI Model Access: Organizations should restrict access to premium AI models and high-performance computing resources, as these are primary barriers that limit threat actor adoption of agentic AI. Monitoring who accesses these tools can reveal early signs of compromise.
• Implement Real-Time Secret Management: Deploy systems that detect and invalidate harvested credentials in real time, preventing attackers from using stolen API keys and authentication tokens even if they successfully extract them.
• Segment Cloud Infrastructure: Isolate cloud environments so that compromised systems cannot easily pivot to other parts of the network, limiting the damage an autonomous agent can inflict.

Has Anyone Deployed Fully Autonomous Attack Pipelines Yet?

Despite the concerning trend, Google Threat Intelligence Group has not yet observed threat actors deploying fully autonomous attack pipelines against targets in the wild. However, researchers emphasized that "adversarial adoption of agentic AI suggests threat actor use of AI could be evolving towards this use case".

The report describes "a gradual maturation of tradecraft," with adversaries using commercial and open-weight AI models to turn public security disclosures and patch delays into working exploit code. Threat actors are refining payloads in controlled environments and progressing "toward constructing functional, multi-stage exploit chains" that could eventually operate with minimal human oversight.

Google researchers concluded by noting that they "continuously harden our AI models against misuse by feeding insights from active threat monitoring directly into our safety classifiers and guardrails." This defensive approach reflects the ongoing arms race between AI safety teams and threat actors seeking to weaponize the same technology.