Threat actors used a multi-agent artificial intelligence framework to compromise thousands of credentials in under six hours, Google LLC’s Google Threat Intelligence Group said in a report released today.
Mandiant investigators traced the campaign to a suspected financially motivated actor that first broke into an organization’s cloud infrastructure. The attacker then assembled an autonomous framework out of an AI coding chatbot, a prompt and a set of agent instructions, with preconfigured markdown playbooks driving the scanning and harvesting that followed.
Troubleshooting and IP rotation ran without an operator. Traffic left the victim’s own addresses, so it looked legitimate on the way out.
The report, “From Prompting to Autonomy: The Evolution of Adversarial AI,” covers activity GTIG tracked over the second quarter. It follows the May edition, which documented the first confirmed case of criminals using AI to build a working zero-day exploit. What has changed since then is how little human involvement is left, GTIG said. Adversaries are handing multistep decisions to models, which shrinks the window defenders have to react.
GTIG said it has not observed fully autonomous attack pipelines deployed against targets in the wild. Adversary intent is not in doubt. An alleged China-linked espionage group used Gemini to design an automated penetration testing framework meant to run port scanning, service parsing and other early intrusion work by itself. The group got no further than trying to build it, and Google disabled the assets tied to the effort.
On the open-source supply chain, the report’s main subject is a criminal group Google labels UNC6780. The same actor, which Google also tracks as TeamPCP, poisoned the LiteLLM gateway in March.
Since then, it has run large-scale compromises across PyPI, npm and Docker Hub, publishing trojanized forks of Model Context Protocol servers and injecting malicious code into GitHub repositories that AI coding assistants clone. Its DUSTMAKER credential stealer drops files into hidden project directories such as .claude and .cursor, where AI tooling reads them as ordinary developer clutter.
Some samples went further. Malware loaders carried prompt injections written as extreme requests about biological and nuclear weapons, text likely intended to make large language model security scanners refuse the file and skip the malicious JavaScript beneath it.
AI assets themselves are now a target. Mandiant worked several data theft extortion cases last quarter in which attackers took proprietary models, source code and prompts from technology, healthcare and media companies in North America and Europe. One healthcare victim lost drug research and a proprietary model to a group that threatened to publish both unless it was paid.
Compute is being stolen the same way. UNC6508, an alleged China-linked group tied to a multiyear campaign against academic, medical and military research institutions, is also behind suspected activity GTIG observed deploying open-weight models inside compromised cloud environments, keeping its prompting away from commercial application programming interface monitoring. An exposed GitHub access token let another attacker provision high-performance graphics processing unit instances in April at a victim’s expense.
John Hultquist, chief analyst at Google Threat Intelligence Group, said the working assumption now is that every threat actor is using AI in some capacity and benefiting from it. Speed is what worries him most.
“Criminals, like the ones who conducted a mass exploitation campaign in just six hours, will gravitate to attacks that are faster than we can respond to,” he said. Groups such as TeamPCP are a newer category, he added, going after AI systems as they get built into the enterprise stack rather than simply using them.
