GOOGLE Threat Intelligence Group (GTIG) says adversaries increasingly moved from simple prompting to agentic AI workflows and automated attack pipelines during the second quarter of 2026. In one Mandiant investigation, a suspected financially motivated actor compromised cloud infrastructure and used an AI coding chatbot, prompts and pre-written instructions to plan, build and run a mass credential-harvesting operation in under six hours.
The system automated vulnerability scanning, troubleshooting and IP rotation, compromising thousands of third-party credentials. Another exposed command-and-control server hosted a framework managing more than 23,800 harvested secrets, including cloud and AI-service API keys. GTIG says fully autonomous exploitation against targets has not yet been observed in the wild, although groups are using AI to develop exploit components and automate parts of reconnaissance and post-exploitation.
The report also details supply-chain attacks by UNC6780 (TeamPCP), which targeted PyPI, npm and Docker Hub, developer accounts, MCP servers and GitHub repositories. Its DUSTMAKER malware could steal GitHub Actions OIDC tokens, hide files in AI-tool directories such as `.claude/`, `.vscode/` and `.cursor/`, create persistence through workspace configuration, and use prompt injection to manipulate coding assistants or evade LLM security scanners.
Separately, attackers targeted proprietary models, prompts, source code and research for espionage, extortion and resource theft. GTIG also recorded stolen AI credentials being sold underground and cloud environments being hijacked for unauthorised AI workloads, including one April 2026 intrusion that used an exposed GitHub personal access token to deploy high-performance compute.
Google says it disabled assets and accounts linked to the activity, strengthened Gemini classifiers and model safeguards, and deployed measures against model-distillation campaigns. The report’s evidence comes from GTIG tracking, Mandiant incident-response work and platform telemetry; several described activities were attempts or experiments rather than confirmed successful attacks.