“Over the past quarter, threat actors have moved beyond simple prompt-based LLM interactions to integrate AI capabilities into multiple stages of an attack lifecycle,” the Google Threat Intelligence Group (GTIG) reports. That shift, GTIG says, is not academic: it has shortened the time between discovery and large-scale credential theft and changed how defenders must think about the earliest moments of compromise.
Multi-agent frameworks replacing one-off LLM prompts
GTIG’s telemetry — drawn from Mandiant incident response engagements, threat actor tracking, and live platform defenses — shows attackers moving from single prompt interactions with coding assistants to multi-agent AI frameworks that orchestrate entire attacks. While “traditional script-based automation” has long been used by adversaries, GTIG notes groups are now building “highly autonomous systems capable of reasoning through complex tasks and making dynamic decisions without the need for human oversight.”
Those systems do more than write code: they coordinate scanning, exploitation, troubleshooting and evasion in concert. In GTIG’s view, the result is a dramatic reduction in “human-in-the-loop” latency and compressed response windows for defenders.
Case study: a cloud compromise and a mass credential-harvesting campaign
In one incident recounted by GTIG, a financially motivated actor compromised an organization’s cloud infrastructure and deployed an autonomous multi-agent framework. Using an AI coding chatbot together with a prompt and markdown agent instructions, the actor “planned, built, and deployed a mass credential-harvesting campaign” in less than six hours.
The AI agents ran the vulnerability-scanning pipeline, harvested thousands of third-party credentials, troubleshot problems in real time, rotated IP addresses, and routed attack traffic through legitimate, compromised cloud environments to evade detection. That operational chain illustrates how AI coordination can turn a single breach into broad credential collection before defenders can fully respond.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildExposed C2 server “Recon” and 23,800+ harvested secrets
GTIG also found an exposed command-and-control server hosting an automated reconnaissance and credential-management framework named “Recon.” The server’s files included instructions written for AI agents, knowledge files, and OpenClaw artifacts associated with the framework.
Remarkably, Recon managed in real time more than 23,800 harvested secrets, including API keys. The presence of agent instructions and tooling on the C2 underscores how operators are embedding AI workflows inside persistent infrastructure rather than using AI only as an ad hoc development aid.
State-backed experimentation, supply-chain abuse, and a market for credentials
GTIG documents a range of actors experimenting with AI. China-linked cyberespionage groups tested AI-powered development tools to build “AI-assisted, automated exploitation and post-exploitation” pipelines. Russia-based UNC5792 integrated AI models to automate monitoring bots that search Telegram channels for government-relevant data. Separately, UNC6780 (TeamPCP) appears in GTIG notes as part of AI-enabled supply-chain attacks.
GTIG also observed Gemini AI distillation operations involving 100 million prompts and reports a growing market for stolen AI account credentials and API keys. The company summarizes the broader trend by listing uses for AI among state-backed groups — reconnaissance, phishing, malware development, exploitation, post-exploitation, data processing, and propaganda.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: Expect tighter remediation windows. GTIG warns that “once attackers are using valid credentials, prevention drops sharply,” and the multi-agent workflows GTIG observed compress the time defenders have to detect and contain credential misuse.
- Affected enterprises and procurement leaders: Supply-chain vectors and the market for stolen AI keys matter. GTIG’s findings include supply-chain attacks by UNC6780 and a market for stolen AI credentials and API keys — facts that translate into exposure across cloud relationships and third-party services.
- End users and the general public: Credential sets are being harvested at scale. The incidents GTIG describes involved “thousands” of third-party credentials and more than 23,800 secrets in a single framework, demonstrating the volume of account data threat actors are collecting and monetizing.
GTIG is careful to note a limit worth emphasizing: fully autonomous hacking at scale — specifically, pipelines that discover zero-days and carry out network exploitation without human oversight — has not become widespread. The company “did not observe threat actors deploying fully autonomous pipelines for zero-day discovery and network exploitation against real-world targets.” At the same time, Google reports that its own model, Gemini, “caught many of these abuses early and responded in accordance with its safety protocols, allowing Google to take additional action, disrupt the campaigns, and ban the associated accounts.”
The record GTIG offers is both clear and incomplete: multi-agent AI frameworks are real, they have been used to harvest credentials and manage them at scale, and they have already reduced the time defenders once relied on. Whether those frameworks evolve into fully autonomous exploit discovery remains an unanswered operational question; for now, the observable change is a speed and scale problem that has shifted the defensive calculus.
