Hackers used artificial intelligence agents to plan, build and execute a mass credential-harvesting campaign in less than six hours, compromising thousands of third-party credentials in what Google researchers say illustrates a rapid shift toward more autonomous cyberattacks.
The use of AI agents in recent attacks demonstrates a growing trend of automated attacks eliminating humans from critical portions of an attack lifecycle. This, according to Google is driving a second trend where AI automation is compressing the traditional window for defenders to respond, wrote Google Threat Intelligence Group in a report released Tuesday.
Researchers documented how agents were used to build attack tooling, conduct reconnaissance, orchestrate multi-stage operations, troubleshoot failures, scan for vulnerabilities and automate credential theft and post-exploitation tasks.
The emerging model is less hacker-out-of-the-loop than hacker-in-the-loop. Humans still choose targets and objectives, while AI takes over more of the work between those decisions.
Outsourcing the Dirty Work
Google said the six-hour credential attack was one of numerous cases it observed during the second quarter involving financially motivated and state-backed adversaries experimenting with AI across the attack lifecycle.
The attacker used an AI coding chatbot, a prompt and preconfigured agent instructions to plan and build the operation. Once running, the agents automatically scanned targets, harvested credentials, handled real-time troubleshooting and rotated IP addresses without manual intervention.
The instructions were stored in Markdown files that effectively served as operational playbooks for the agents. Google said the system could manage its own vulnerability-scanning pipeline and work through errors as they occurred, sharply reducing the need for a human operator.
Operating from the victim’s cloud environment also allowed the attacker to route malicious traffic through legitimate IP addresses. Google said the operation compromised thousands of third-party credentials.
Google did not identify the victim, its industry or location, nor did it name the attacker beyond describing the actor as financially motivated. The company placed the attack sometime during the second quarter of 2026 but did not disclose the initial intrusion vector, vulnerabilities exploited or which AI coding chatbot was used.
The Bots Are Getting Better
Other research suggests what Google is documenting is a shift that is accelerating.
The U.K. AI Security Institute estimates that the length of cybersecurity tasks frontier AI models can reliably complete on their own has been doubling about every 4.7 months since late 2024. More recent models have exceeded even that pace, according to the government research group.
In April, Anthropic’s Claude Mythos Preview became the first model tested by the U.K. AI Security Institute to complete a simulated 32-step corporate network attack end to end. It estimated the task would take a human expert about 20 hours. An early version succeeded in three of 10 attempts; a later version succeeded in six.
In a July evaluation, the U.K. AI Security Institute ran 122 cyber tests across seven models. Agents took unauthorized real-world actions in 10 runs, including one attempt to plant malicious code in an open-source project. AISI recorded 19 such actions, 17 involving Anthropic’s Mythos 5.
Separately, an investigation by METR and Redwood Research found roughly 1,200 OpenAI agents exchanged more than 70,000 messages and files, with about 700 participating in an attack against Hugging Face after discovering a way to coordinate despite being designed to operate independently.
Real-world attacks are also beginning to show the same pattern.
In August, NCC Group analyzed a ransomware operation in which an AI agent dubbed JADEPUFFER handled an intrusion largely on its own after a human selected the target and prepared the infrastructure.
The agent exploited vulnerable systems, moved laterally and adapted when its actions failed. In one instance, after a login attempt broke, the agent diagnosed the problem, deleted the account and recreated it with simpler credentials — all within a 31-second decision loop and without human intervention.
An earlier Anthropic investigation into a China-linked espionage campaign targeting about 30 organizations found AI handled 80% to 90% of the tactical work, with humans stepping in at only a handful of critical decision points.
Taken together, the research suggests hackers are not disappearing from the attack chain so much as shifting into supervisory roles.
Recon Goes Robo
In a separate case, Google found an exposed command-and-control server running “Recon,” an automated reconnaissance and credential-management framework.
Unlike the six-hour campaign, where agents scanned targets, harvested credentials and troubleshot attacks in real time, Recon embedded AI into an offensive platform built to research vulnerabilities, scan infrastructure, execute exploits and organize stolen secrets.
Exposed files including AGENTS.md, KNOWLEDGE.md and agentic_vuln_research.md each showed how the system instructed agents, while other directories supported agent memory and the OpenClaw framework.
Shortly after researchers discovered the exposed infrastructure, it transitioned into a live production dashboard capable of organizing, validating and managing more than 23,800 harvested secrets in real time, including API keys for cloud and AI services.
Google said the operation used autonomous agents to research vulnerabilities, scan server-side infrastructure and execute targeted exploits, automating much of the post-exploitation process with minimal human involvement.
Researchers called it a “critical evolution in threat actor methodology,” shifting credential theft away from passive endpoint infostealers toward what Google described as offensive, agent-driven harvesting.
Maestro, Start the Attack
GTIG also saw attackers testing AI as an orchestrator for multiple hacking tools. One China-linked espionage group used several LLMs to generate exploit scripts, troubleshoot failures and support attack development.
Another used Gemini to build an automated penetration-testing framework designed to observe targets, reason through next steps and execute tasks such as port scanning and service discovery.
Google said the project never moved beyond development. GTIG disabled associated assets, while Gemini’s safety systems blocked malicious requests and Google DeepMind updated its defenses based on the activity.
Because Apparently AI Needed Threat Actors Too
Attackers are also targeting AI itself.
Google said financially motivated group UNC6780, or TeamPCP, carried out large-scale supply chain compromises across PyPI, npm and Docker Hub, while its DUSTMAKER malware used prompt injection to manipulate AI coding assistants and evade LLM-based security scanners.
Other attackers are stealing AI credentials, proprietary models, source code, prompts and research. In one healthcare intrusion investigated by Mandiant, hackers stole drug-development data, AI research and a proprietary model before demanding ransom.
Cloud environments are also being hijacked for the costly computing power needed to run AI workloads.
Autopilot, Not Autonomous
Taken together, the examples show AI moving across the attack chain: chatbots helping build attacks, agents conducting reconnaissance, AI orchestrating tools and infrastructure, and attackers targeting AI systems themselves. Different use cases, one direction; more hacking done faster, at greater scale and with less human involvement.
While Google has not yet seen threat actors deploy fully autonomous zero-day discovery and exploitation against real-world targets, what it is seeing is a steady handoff. Attackers are using commercial and open-source models to speed exploit development, automate reconnaissance and post-exploitation, coordinate tools and make tactical decisions with less human direction.
Autonomous hacker-bots aimlessly scouring for their next target is not here yet. The AI-orchestrating hacker is.
