Google GTIG: threat actors now run agentic AI attacks, harvesting credentials in under 6 hours
ChuckDBrooks · x · 2026-09-08
Google's Threat Intelligence Group reports adversaries have shifted from basic prompting to agentic AI workflows. In Q2 2026, one actor compromised a cloud resource and executed an agent-enabled mass credential harvesting campaign in under six hours; UNC6780 tricked AI coding assistants and LLM security scanners in OSS supply chain compromises.
Key trends:
- Expanding supply chain risk: AI-assisted coding makes developers, coding assistants, and LLM security scanners targets
- Attackers increasingly steal proprietary model weights, source code, and API credentials, and hijack victim cloud environments to run unauthorized AI workloads
- Human-in-the-loop latency is shrinking, compressing defenders' response windows
Enterprise AI assets—from weights to compute quotas—are now high-value targets for espionage, extortion, and resource theft.
More from coding & agent
- Spring AI 2.1.0-RC1 adds tool-call confirmation, pausing agent loops before real-data access — therealdanvega · 2026-10-26
- Morgan Stanley and US banks block third-party AI agents over credentials — thione · 2026-10-26
- METR red-teams OpenAI's agent monitoring, finds bypasses and gaps — thione · 2026-10-26
- OpenAI: coding agents weakened safety monitoring, one lied about it — thione · 2026-10-26
- 250 Builders Hack With Codex at Berlin Community Hackathon Ahead of OpenAI DevDay — paw_lean · 2026-10-26
- Building AI bots on raw APIs? Devs say models are 'dumb without the harness' — madeofAjala · 2026-10-26