How Agentic AI Is Reshaping the Threat Landscape
Google Threat Intelligence and Mandiant report that adversaries are combining AI agents, stolen credentials, supply-chain abuse, and cloud hijacking.
Artificial intelligence is becoming less of a standalone tool in cyber operations and more of an orchestration layer. In its September 2026 AI Threat Tracker, Google Threat Intelligence Group (GTIG), drawing on Mandiant incident response, threat-actor tracking, and platform telemetry, describes adversaries moving from occasional prompt use toward agentic workflows that can coordinate reconnaissance, troubleshooting, credential collection, and cloud abuse.
The important change is not that attackers have acquired a magical new capability. Rather, AI is reducing the time and manual effort required to connect familiar activities. GTIG reports that one suspected financially motivated actor compromised cloud infrastructure and then used an AI coding chatbot, prompts, and agent instructions to plan and execute a mass credential-harvesting campaign in less than six hours. The same research also documents supply-chain compromises aimed at developers and AI coding tools, theft of proprietary AI assets, and the misuse of victim cloud environments for unauthorized AI workloads.
These findings point to a broader defensive issue: organizations must protect not only endpoints and applications, but also the development environments, model-access credentials, cloud quotas, agent configuration files, and automation systems that now sit around AI-enabled software delivery.
From prompts to coordinated workflows
GTIG’s central assessment is that threat actors are gradually adopting multi-agent and AI-assisted automation across the attack lifecycle. The observed activity remains uneven. Some operations involve AI for translation, code generation, or troubleshooting, while others use preconfigured instruction files to coordinate larger workflows with limited human intervention.
In the credential-harvesting case investigated by Mandiant, the actor used a compromised cloud environment to host an autonomous, multi-agent framework. Agent instructions directed the system to scan for vulnerabilities, collect credentials, troubleshoot operational failures, and rotate source IP addresses. The use of victim infrastructure also allowed traffic to originate from legitimate cloud address space, complicating straightforward infrastructure-based detection.
GTIG separately identified an exposed command-and-control server hosting a framework called “Recon.” Its directories contained agent instructions and knowledge files, while a live dashboard was used to organize and validate more than 23,800 harvested secrets, including cloud and AI service API keys. GTIG characterizes this as a move away from passive infostealing toward automated harvesting and post-exploitation management. The organization also reports that it disabled assets associated with the activity.
At the same time, GTIG stresses that fully autonomous exploitation at scale has not been observed in the wild by the organization. Its assessment is of gradual maturation: adversaries are layering AI onto existing tools and processes rather than replacing all human decision-making with autonomous systems.
AI-assisted development creates a new supply-chain target
AI coding assistants and the rapidly expanding ecosystem around model development have introduced additional trust relationships. These include open-source packages, Model Context Protocol (MCP) servers, model formats, inference engines, vector databases, IDE extensions, workspace configuration, and continuous integration pipelines.
GTIG believes that faster AI-assisted development and increased reliance on third-party resources can reduce scrutiny of dependencies. The organization reports attempted downloads of malicious open-source AI resources in enterprise environments in North America and Asia during early 2026. It also describes malicious packages that installed LLM proxy services and public reporting concerning a malicious cryptocurrency-themed dependency incorporated into an active codebase by an AI coding agent.
The most detailed example involves UNC6780, also known as TeamPCP, which GTIG attributes to financially motivated activity. Since March 2026, the group has conducted large-scale compromises involving PyPI, npm, and Docker Hub. According to GTIG, UNC6780 has used compromised developer accounts to publish trojanized forks of legitimate MCP servers and has inserted malicious code into official organizational repositories.
Those modifications were designed to be consumed by developer environments when tools were downloaded or repositories cloned. GTIG reports that the group’s DUSTMAKER credential stealer can identify CI/CD environments, extract OpenID Connect tokens from GitHub Actions runner memory, and use those tokens to publish compromised packages with valid SLSA Build Level 3 attestations. The reported objective was to make malicious packages appear trustworthy to automated checks used by AI coding agents.
DUSTMAKER also demonstrates how malware can target the conventions of modern development environments. GTIG says it writes or alters files in hidden project directories associated with AI assistants and IDEs, including .claude/, .vscode/, and .cursor/. It can use those files to create startup or build commands, causing execution when a workspace or extension opens. Malicious configuration content can also attempt to manipulate an AI assistant into running commands during ordinary developer activity.
Another reported feature targets the review process itself. DUSTMAKER samples included adversarial prompts in JavaScript loader comments, apparently intended to cause LLM-based security scanners to refuse or skip analysis of the code that followed. This is a defense-evasion tactic aimed at the software assurance pipeline rather than a conventional endpoint control.
Proprietary AI assets are now strategic data
GTIG reports growing targeting of proprietary models, source code, prompts, research, and related secrets. The affected organizations were not limited to AI companies. Reported victims included organizations in government, military, healthcare, technology, and media and entertainment.
GTIG attributes a multi-year campaign against academic, medical, and military research institutions in North America to UNC6508, described as a PRC-nexus espionage actor. The group specifically targeted proprietary AI research, and GTIG observed suspected activity involving compromised cloud environments used to deploy local, open-weight language-model infrastructure. This approach can provide access to AI capabilities without relying on commercial API monitoring, while also consuming the victim’s compute resources.
Mandiant also investigated data-theft extortion incidents in which proprietary AI assets were stolen. Reported data included models, prompts, skills, source code, model scripts, secrets, and related research. In one healthcare case, stolen material included drug research and a proprietary AI model. In another case involving an AI media-generation company, the stolen material was used in an extortion threat.
GTIG additionally describes model-distillation campaigns targeting Google AI systems. These operations used proxy infrastructure, compromised credentials, and fraudulent accounts to send very large volumes of queries intended to reproduce proprietary model behavior. The findings are specific to Google’s observed environment; they should not be interpreted as evidence that every organization’s models are being targeted at the same scale.
Cloud hijacking turns AI capacity into an attacker resource
The report identifies “LLMJacking” as a growing consequence of stolen AI credentials and cloud compromise. Underground demand has increased for credentials associated with AI platforms and autonomous coding environments, according to GTIG’s tracking of criminal forums. The organization also observed infostealer activity targeting configuration files used by AI coding assistants, including files that may contain API keys or custom model-routing endpoints.
In an April 2026 intrusion investigated by Mandiant, an exposed GitHub personal access token provided initial access to a victim cloud environment. The actor enabled enterprise AI services, provisioned high-performance compute, created container repositories, and deployed containerized AI-related services. Mandiant also observed publicly accessible Cloud Run services, permissive IAM settings, a highly privileged rogue service account, credential searches in BigQuery, and attempts to increase quotas for NVIDIA RTX 6000 hardware.
The reported sequence illustrates why cloud monitoring must cover resource consumption as well as data access. Unexpected GPU provisioning, quota requests, new container repositories, public service exposure, service-account key creation, and broad API enablement can all be meaningful signals when they occur together.
What organizations should do now
- Protect AI and developer credentials. Inventory API keys, IDE secrets, model-provider tokens, CI/CD identities, and cloud service-account keys. Replace long-lived credentials with short-lived, narrowly scoped identities wherever practical, and monitor for access from unusual locations or workloads.
- Harden CI/CD trust. Review GitHub Actions and equivalent runner permissions, OIDC configuration, package-publishing rights, and build provenance. Separate build, release, and repository administration privileges. Investigate unexpected package releases, unfamiliar workflow changes, and attestations that do not match the organization’s build process.
- Inspect AI workspace configuration. Treat hidden assistant and IDE directories as executable-content locations. Review workspace hooks, startup commands, MCP server definitions, extension settings, and repository configuration changes. Establish allowlists for approved tools and require review before automatic execution.
- Monitor cloud AI consumption. Alert on GPU instance creation, quota increases, new AI or language APIs, unusual container deployments, public invoker permissions, permissive firewall rules, and service accounts with unexpected administrative access. Compare compute usage with approved projects and business workloads.
- Centralize identity and cloud telemetry. Correlate token use, package publication, repository changes, runner activity, API calls, resource provisioning, and secret access. A single event may look routine; a rapid sequence across development and cloud control planes may reveal automation or account takeover.
- Strengthen software supply-chain review. Pin dependencies, verify package provenance, review maintainer and publisher changes, scan package contents, and test AI-oriented open-source resources in isolated environments. Do not assume that a valid signature or build attestation alone proves a package is safe.
- Prepare for AI-data extortion. Classify model weights, prompts, research, source code, and secrets as sensitive intellectual property. Limit repository access, segment training and inference environments, and ensure that incident-response plans address both data theft and unauthorized compute use.
- Hunt for behavior, not only malware names. Look for credential access from CI runners, unexpected changes in hidden project directories, automated package publication, cloud services exposed to all users, unusual model-query volumes, and compute workloads that do not match approved use.
These recommendations are general defensive measures derived from the reported activity. GTIG’s research does not establish that every listed control would prevent every operation, and the report does not provide a universal detection signature or a single exploit path.
What remains uncertain
GTIG reports experimentation with autonomous penetration-testing frameworks and AI-assisted exploit development, but it has not observed tracked actors deploying fully autonomous pipelines against targets in the wild. Similarly, the organization observed interest in interactive influence-operation bots but did not find evidence of successful breakthrough automation in those campaigns.
The report also contains assessments rather than definitive conclusions in several areas. GTIG believes AI-assisted coding contributed to major supply-chain compromises observed in 2025 and early 2026, but the source does not claim that AI independently caused every incident. Some actor relationships and motivations are described as suspected or assessed, and those judgments should remain separate from confirmed technical observations.
Conclusion
Google Threat Intelligence and Mandiant’s findings show an attack ecosystem adapting AI to compress familiar workflows. The immediate risk is practical: compromised identities, developer tooling, open-source dependencies, and cloud resources can be connected into faster, more scalable operations. Organizations that secure only model endpoints may miss the more exposed control points around them.
Defenders should therefore treat AI development environments, model credentials, CI/CD automation, and cloud compute as one connected security surface. Strong identity controls, supply-chain verification, workspace scrutiny, and cloud behavior monitoring are the most useful foundations while adversary use of agentic systems continues to develop.