Threat actors are moving beyond using AI as a helper tool and are now deploying autonomous AI agents that can plan, build, and execute cyberattacks with minimal human involvement. According to Google Threat Intelligence Group's latest research, attackers are transitioning from simple AI prompts to sophisticated multi-agent workflows that handle vulnerability scanning, credential harvesting, and troubleshooting automatically.

What Does an AI-Powered Attack Actually Look Like?

In one real-world incident investigated by Google's Mandiant team in the second quarter of 2026, a financially motivated threat actor compromised a cloud environment and deployed an autonomous multi-agent framework that executed a mass credential-harvesting campaign in less than six hours. The attacker used an AI coding chatbot, a set of instructions, and agent workflows to plan and execute the attack without stopping to troubleshoot manually. The result: thousands of third-party credentials were stolen.

What made this attack particularly concerning was how the AI agents handled operational challenges. "The agent instructions enabled the AI to autonomously manage the vulnerability scanning pipeline, perform real-time troubleshooting, and execute IP rotation logic without manual intervention," researchers from Google Threat Intelligence Group wrote. This means the AI didn't just follow a script; it adapted, fixed problems, and covered its tracks in real time.

In another case, Google researchers discovered an exposed command-and-control server hosting a credential management framework called "Recon." The server contained configuration files and directories that organized and validated more than 23,800 harvested secrets, including API keys for cloud and AI services. This infrastructure suggests attackers are building industrial-scale credential theft operations powered by AI.

Why Are Threat Actors Targeting AI Tools and Cloud Resources?

Attackers aren't just using AI to launch attacks; they're also targeting AI assets themselves. Google researchers observed adversaries across multiple threat categories targeting proprietary AI models, stealing API credentials, and hijacking victim cloud environments to run unauthorized AI workloads. This shift reveals that enterprise AI assets, from model weights to cloud computing quotas, have become high-value targets for espionage, extortion, and resource theft.

One reason is practical: accessing premium AI models and high-performance computing resources is expensive. By stealing credentials or compromising cloud accounts, attackers can run their own AI-powered operations without paying for access. A China-linked cyber espionage group, for example, compromised cloud environments to deploy local large language model (LLM) infrastructure using open-weight models, which allowed them to evade monitoring by AI model providers.

How Are Attackers Exploiting AI Development Tools?

The integration of AI-assisted coding tools has created new vulnerabilities in software supply chains. Threat actors are actively targeting developers, AI coding assistants, and LLM security scanning tools to inject malicious code into open-source projects. A financially motivated group known as UNC6780 (also called TeamPCP) has conducted a series of large-scale compromises targeting popular open-source repositories on PyPI, npm, and Docker Hub since March 2026.

UNC6780's tactics reveal how deeply attackers are integrating AI into their operations. The group deployed credential stealers like DUSTMAKER, a cross-platform JavaScript payload optimized for continuous integration and continuous delivery (CI/CD) pipelines, to harvest developer credentials and AI service credentials. What's particularly notable is that DUSTMAKER includes AI-targeting techniques, such as poisoning AI assistant workspaces and using prompt injection for defense evasion, that weren't present in earlier versions of their malware.

Steps to Understand the Evolving AI Threat Landscape

• Agentic AI Workflows: Threat actors are moving from basic prompting to multi-agent frameworks where AI systems autonomously handle scanning, error resolution, and credential harvesting at scale, compressing the time needed to execute attacks from days to hours.
• AI Asset Targeting: Attackers are increasingly targeting proprietary AI models, source code, API credentials, and cloud compute resources across healthcare, government, and media sectors for espionage, extortion, and unauthorized workload operations.
• Supply Chain Weaponization: Malicious actors are exploiting AI-assisted coding tools to compromise open-source software repositories, inject malicious dependencies into legitimate projects, and target developers through trojanized AI integrations.
• LLM Misuse Across Attack Lifecycle: State-sponsored and financially motivated groups are using commercial and open-weight large language models to write custom exploit scripts, generate convincing phishing lures, debug malware, and automate post-exploitation tasks.

Which Threat Groups Are Leading This Shift?

The adoption of agentic AI spans multiple threat categories. State-sponsored cyber espionage groups from China have used Google's Gemini model to design automated penetration testing frameworks capable of observing target environments, reasoning through actions, and executing tasks in unpredictable settings. Another China-linked group experimented with AI development tools to build an AI-assisted automated exploitation pipeline, using Claude, Gemini, or Codex to write custom exploit scripts and generate spear-phishing lures.

Financially motivated groups are equally active. Beyond UNC6780's supply chain compromises, other cybercriminal organizations have used Claude Code to bypass security guardrails and analyze stolen data for extortion operations. North Korean threat clusters have used AI in bulk LLM API registration schemes using hijacked accounts, while Iranian hacking groups have leveraged generative AI for reconnaissance and targeted social engineering.

"At this point, we can assume that all threat actors are using AI in some capacity and their operations have benefited. Like everyone else, we're concerned about the vulnerability problem, but AI is being applied to several other areas, and it will be especially challenging as it is applied agentically, creating a scaled, faster adversary. Criminals, like the ones who conducted a mass exploitation campaign in just six hours, will gravitate to attacks that are faster than we can respond to," said John Hultquist, chief analyst at Google Threat Intelligence Group.

What Does This Mean for Defenders?

The shift toward autonomous AI agents represents a fundamental change in the speed and scale of cyberattacks. Traditional security responses assume humans are involved in attack planning and execution, which creates windows for detection and response. When AI agents handle these tasks autonomously, that window collapses. A credential theft campaign that once took days can now execute in hours, leaving defenders scrambling to catch up.

Google researchers emphasized that while they have not yet observed fully autonomous attack pipelines deployed against targets in the wild, the trajectory is clear. Adversaries are demonstrating "a gradual maturation of tradecraft," using commercial and open-weight models to turn public vulnerability disclosures and patch delays into working exploit code, refining payloads in controlled environments, and progressing toward multi-stage exploit chains.

The research suggests that the cybersecurity industry faces a dual challenge: defending against AI-powered attacks that operate faster than human responders can react, while also protecting AI assets themselves from theft and misuse. As attackers continue to operationalize AI tools across reconnaissance, exploitation, and post-exploitation phases, the traditional security playbook may need fundamental rethinking.