A financially motivated attacker ran reconnaissance, exploitation, and cleanup with almost no human in the loop — using the same design patterns you'd use to build a helpful agent. That symmetry is the actual story.
Google's Threat Intelligence Group (GTIG) published its Q3 2026 AI Threat Tracker documenting a mass credential-harvesting campaign carried out largely by a multi-agent framework rather than a human operator. According to GTIG's report and coverage from The Hacker News, SiliconANGLE, and Help Net Security, a suspected financially motivated actor gained access to an organization's cloud infrastructure, then deployed an autonomous multi-agent system from inside that environment — which let requests originate from legitimate-looking IP addresses rather than obviously malicious infrastructure.
The attacker reportedly built the framework using an AI coding chatbot, a set of instructions, and preconfigured Markdown files functioning as operational playbooks — essentially the same "agent skills" pattern legitimate teams use to give an LLM reusable, structured procedures. Per Mandiant's incident-response analysis cited in GTIG's report, the resulting system managed the vulnerability-scanning pipeline, collected credentials, resolved technical problems as they came up, and rotated IP addresses — without a human approving each step. Google says the entire operation, from setup to compromising thousands of third-party credentials, took under six hours.
Most public discussion of "agentic security risk" focuses on prompt injection against your own agents, or an assistant being tricked into leaking your data. This is a different and arguably more mundane threat: the same reliability engineering that makes agents useful — self-correction, retries, graceful handling of transient failures — is exactly what makes an attack pipeline resilient enough to run unattended for hours.
A scanning script that dies on the first unexpected HTTP response needs a human to restart it. An agent that "resolves technical problems as they arise" doesn't. That's the entire value proposition of agentic tooling, and it's now showing up on the offensive side at effectively the same maturity level as it shows up in developer tools. There is no special dangerous capability here beyond what a decent coding agent already has — which is precisely the point: the barrier to running a multi-day human-operated campaign as a six-hour autonomous one has dropped to "know how to write agent instructions."
If your organization runs agentic coding tools, CI-integrated assistants, or internal automation with cloud credentials in scope, this campaign is a preview of what compromise of that infrastructure looks like from the attacker's side, not just the defender's. A few concrete implications: GTIG's report describes the campaign's structure and outcome but, per the available public reporting, doesn't name the specific AI coding chatbot the attacker used, nor does it publish the full Markdown playbooks (for obvious reasons). That means teams can't yet check their own environment against specific indicators of compromise beyond general behavioral patterns — this is a capability disclosure more than an incident-response playbook. Expect more operational detail to surface as other vendors and incident responders corroborate or extend the findings.
This story was written with the assistance of an AI writing program.