Google Threat Intelligence Group has documented a major shift in how cybercriminals are using artificial intelligence in real-world attacks.
In Q2 2026, Google observed a suspected financially motivated threat actor compromise cloud infrastructure and deploy an autonomous multi-agent attack framework capable of supporting a large-scale credential-harvesting campaign.
The operation was planned, built, and executed in under six hours.
The important part is not simply that attackers used AI. Cybercriminals have already been using generative AI for research, coding, social engineering, and troubleshooting. What stands out here is the move toward agentic workflows that can reduce the amount of human intervention required during an attack.
For cloud and DevOps teams, that matters because the time between an initial compromise and large-scale credential theft may be getting much shorter.
What Google Observed #
According to Google Threat Intelligence Group, the attacker first compromised an organization’s cloud infrastructure and then deployed an autonomous multi-agent framework designed to support vulnerability scanning and credential harvesting.
The framework combined AI-driven automation with attacker-defined instructions and existing offensive tooling.
Instead of requiring a human operator to manually perform every step, agents could help coordinate tasks such as scanning, credential collection, troubleshooting, infrastructure adjustments, and follow-on actions.
Google describes this as part of a broader shift from basic AI prompting toward agentic AI workflows and AI-enabled automation.
Official source: Google Threat Intelligence Group — From Prompting to Autonomy: The Evolution of Adversarial AI .
Why the Six-Hour Timeline Is the Real Warning #
The six-hour timeline may be the most important part of the incident.
Traditional incident-response processes often assume defenders have some time between initial access, reconnaissance, credential theft, and expansion into other systems.
Agentic automation can compress that timeline.
If an AI-enabled workflow can automatically react to failures, retry tasks, adjust techniques, and continue collecting credentials, attackers may be able to make meaningful progress while defenders are still investigating the original alert. In practical terms, detecting a compromised cloud identity within 20 minutes may be very different from discovering it six hours later.
Why Cloud Environments Are High-Value Targets #
Modern cloud and DevOps environments contain large numbers of machine identities and automation credentials.
These can include:
- AWS access keys
- cloud service-account credentials
- API keys
- GitHub tokens
- CI/CD secrets
- artifact registry credentials
- deployment identities
- AI service API keys
- repository access tokens
Once attackers obtain one useful credential, they may be able to access additional services, workloads, repositories, or deployment systems.
This is why exposed cloud credentials remain such a serious security problem. TechUpdate24 previously covered another example involving leaked AWS keys and the risks of exposed cloud credentials .
Compromised cloud infrastructure can also make malicious traffic harder to distinguish from legitimate activity because requests may originate from real cloud workloads rather than obviously malicious infrastructure.
What Makes an Agentic Attack Different From a Normal Script? #
Automation in cyberattacks is not new. Attackers have used scanners, bots, scripts, and malware for decades.
The key difference is adaptability.
A traditional script usually follows predefined logic. When it encounters an unexpected condition, it may fail or require manual intervention.
An AI-assisted agentic workflow can potentially interpret an intermediate result, adjust the next step, troubleshoot a problem, and continue toward an attacker-defined objective.
That does not mean an AI agent is an independent hacker capable of doing anything on its own. It still depends on permissions, infrastructure, tools, data, and attacker-defined goals.
But it can reduce the amount of human attention required to keep an operation moving.
AI Is Moving Across More of the Attack Lifecycle #
Google says threat actors are increasingly moving beyond simple prompting and experimenting with AI across broader operational workflows.
That can include reconnaissance, social engineering, malware development, troubleshooting, post-compromise activity, and automation.
This is an important distinction for defenders.
AI misuse should no longer be viewed only as a chatbot-security problem. It is increasingly becoming an orchestration layer that can sit on top of existing offensive tools and techniques.
CI/CD Pipelines Are Becoming High-Value Targets #
Google has also documented financially motivated threat actors targeting software development and CI/CD environments as part of broader software supply-chain operations.
Google Threat Intelligence Group has tracked activity targeting open-source repositories and package ecosystems, including attacks involving compromised packages, repositories, and developer infrastructure.
These environments are especially attractive because CI/CD systems often hold powerful machine identities.
A compromised build runner may have access to:
- production deployment credentials
- container registries
- cloud APIs
- source-code repositories
- package registries
- infrastructure-as-code environments
If those credentials are long-lived or overly privileged, one compromised pipeline can become a bridge into multiple systems.
Google and Mandiant provide additional hardening guidance here: Mitigation Guidance for Supply Chain Compromise .
AI Agents Also Create an Authorization Problem #
Agentic systems do not only introduce a malware problem. They also introduce an identity and authorization problem.
If an autonomous agent receives broad permissions, access to secrets, or the ability to execute actions across multiple services, a compromised or manipulated agent can become significantly more dangerous. That is why least privilege becomes even more important in agentic environments.
TechUpdate24 previously examined a related problem in our coverage of AWS Bedrock AgentCore security risks and agent authorization .
AI Coding Tools Create a New Supply-Chain Attack Surface #
Another emerging concern is the way AI coding tools process repository content and development-workspace files.
Modern coding assistants may rely on project instructions, configuration files, hidden directories, or agent-specific context to understand how they should behave inside a repository.
That creates a new security problem: malicious content can potentially be designed not only for a developer, but for the AI tool assisting that developer.
This means security reviews may increasingly need to consider both traditional malicious code and instructions intended to manipulate AI agents.
Prompt Injection Is Becoming an Enterprise Security Issue #
Prompt injection is often discussed in the context of chatbots, but the risk becomes more serious when an AI system has access to files, terminals, repositories, developer tools, or automation workflows.
If an AI assistant automatically processes attacker-controlled content, malicious instructions may attempt to influence what the tool does next. Potential goals could include:
- executing commands
- accessing secrets
- modifying files
- ignoring security controls
- down additional scripts
The broader lesson is that agent-facing files and configuration should increasingly be treated as part of the software supply-chain attack surface.
What Cloud and DevOps Teams Should Monitor #
Trying to detect whether “AI” is involved in an attack is usually not the most useful defensive approach.
Instead, teams should focus on the observable behavior produced by fast automated attacks.
Useful signals include:
- large bursts of API enumeration
- unexpected creation of service accounts
- rapid access to multiple secrets
- unusual CI/CD runner jobs
- repository tokens used from unfamiliar infrastructure
- unexpected privilege changes
- new workloads created shortly after credential use
- unusual cloud API activity from automation identities
- multiple authentication attempts across services in a short period
No single event proves an agentic attack.
The strongest signal may be the speed and combination of events.
A Practical 30-Minute Response Checklist #
If a cloud credential, build runner, or developer environment is suspected of compromise, the priority should be preventing the attacker from continuing to automate the incident.
- Revoke exposed credentials immediately.
- Disable compromised tokens or service accounts.
- Review recent IAM and permission changes.
- Check which secrets were accessed.
- Inspect CI/CD runners for unexpected jobs.
- Review repository and package-registry access.
- Preserve audit logs before deleting workloads.
- Temporarily isolate suspicious systems if needed.
The first goal is not to prove whether AI was used.
The goal is to remove the credentials, permissions, and infrastructure that an automated attacker could continue using.
Long-Lived Credentials Are an Even Bigger Risk #
Agentic automation strengthens the case for reducing long-lived cloud credentials.
A permanent access key or personal access token may remain useful long after the original compromise.
Google and Mandiant recommend stronger identity controls, reduced reliance on long-lived secrets, and tighter protection around development and software supply-chain systems.
Where supported, organizations should prefer short-lived credentials, workload identities, federated authentication, and narrowly scoped permissions.
For DevOps teams, that means reviewing whether build pipelines really need permanent credentials at all. A deployment job that only needs access for a few minutes should ideally receive a short-lived identity with narrowly scoped permissions.
Least Privilege Matters More When Attacks Move Faster #
AI does not create permissions that do not already exist.
If an attacker steals a low-privilege credential, the damage may remain limited.
If the same attacker steals an administrator-level token used by multiple pipelines, the impact can be much larger.
Organizations should review:
-
service-account permissions
-
GitHub Actions permissions
-
cloud IAM roles
-
artifact-registry access
-
deployment credentials
-
secrets-manager permissions
Incident Response May Need to Become Faster Too #
The broader lesson from Google’s report is not simply that attackers are using AI.
It is that AI can reduce attacker waiting time.
Security teams should therefore measure how quickly they can:
- detect credential misuse
- revoke compromised identities
- disable malicious automation
- identify accessed secrets
- isolate affected workloads
A response process built around slow manual review may struggle against an attack capable of completing major stages in hours.
AI Does Not Replace Traditional Hacking — It Accelerates It #
Google’s findings do not suggest that AI has replaced traditional cyberattack techniques.
Attackers still need credentials, vulnerabilities, infrastructure, permissions, and tools.
What AI can change is the speed and scale at which those resources are used.
That distinction is important because the defensive answer is not a special “anti-AI firewall.”
The strongest protections remain familiar:
- short-lived credentials
- least privilege
- strong audit logging
- CI/CD hardening
- rapid credential revocation
- software supply-chain security
- continuous monitoring
Bottom Line #
The most important lesson from Google’s six-hour credential-harvesting case is not that autonomous AI agents make cyberattacks unstoppable.
It is that they can reduce human delay.
A compromised identity that once gave defenders several hours to react may now be used much more aggressively and automatically.
For cloud and DevOps teams, the priorities are clear: eliminate unnecessary long-lived credentials, reduce excessive permissions, monitor automation identities closely, and build incident-response processes capable of revoking access quickly. The AI agents cloud credential theft scenario highlights why short-lived identities, least privilege, and rapid credential revocation are becoming increasingly important for cloud security teams.
In an agentic threat environment, the organization that detects and responds faster may have the real advantage.