{"slug": "autonomous-ai-agents-harvest-cloud-credentials-in-under-6-hours-google-warns", "title": "Autonomous AI Agents Harvest Cloud Credentials in Under 6 Hours, Google Warns", "summary": "Google Threat Intelligence Group documented a Q2 2026 incident in which a suspected financially motivated threat actor compromised cloud infrastructure and deployed an autonomous multi-agent attack framework that planned, built, and executed a large-scale credential-harvesting campaign in under six hours. Google said the framework combined AI-driven automation with attacker-defined instructions and existing offensive tooling to coordinate vulnerability scanning, credential collection, troubleshooting, and infrastructure adjustments, marking a shift from basic AI prompting toward agentic AI workflows. Google warned that agentic automation can compress the window between initial access and credential theft, meaning detecting a compromised cloud identity within 20 minutes may be very different from discovering it six hours later.", "body_md": "**Google Threat Intelligence Group has documented a major shift in how cybercriminals are using artificial intelligence in real-world attacks.**\n\nIn Q2 2026, Google observed a suspected financially motivated threat actor compromise cloud infrastructure and deploy an autonomous multi-agent attack framework capable of supporting a large-scale credential-harvesting campaign.\n\nThe operation was planned, built, and executed in **under six hours**.\n\nThe important part is not simply that attackers used AI. Cybercriminals have already been using generative AI for research, coding, social engineering, and troubleshooting. What stands out here is the move toward **agentic workflows** that can reduce the amount of human intervention required during an attack.\n\nFor cloud and DevOps teams, that matters because the time between an initial compromise and large-scale credential theft may be getting much shorter.\n\n## What Google Observed\n\nAccording to Google Threat Intelligence Group, the attacker first compromised an organization’s cloud infrastructure and then deployed an autonomous multi-agent framework designed to support vulnerability scanning and credential harvesting.\n\nThe framework combined AI-driven automation with attacker-defined instructions and existing offensive tooling.\n\nInstead of requiring a human operator to manually perform every step, agents could help coordinate tasks such as scanning, credential collection, troubleshooting, infrastructure adjustments, and follow-on actions.\n\nGoogle describes this as part of a broader shift from basic AI prompting toward **agentic AI workflows and AI-enabled automation**.\n\nOfficial source: [Google Threat Intelligence Group — From Prompting to Autonomy: The Evolution of Adversarial AI](https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai) .\n\n## Why the Six-Hour Timeline Is the Real Warning\n\nThe six-hour timeline may be the most important part of the incident.\n\nTraditional incident-response processes often assume defenders have some time between initial access, reconnaissance, credential theft, and expansion into other systems.\n\nAgentic automation can compress that timeline.\n\nIf an AI-enabled workflow can automatically react to failures, retry tasks, adjust techniques, and continue collecting credentials, attackers may be able to make meaningful progress while defenders are still investigating the original alert.\n\n**In practical terms, detecting a compromised cloud identity within 20 minutes may be very different from discovering it six hours later.**\n\n## Why Cloud Environments Are High-Value Targets\n\nModern cloud and DevOps environments contain large numbers of machine identities and automation credentials.\n\nThese can include:\n\n- AWS access keys\n- cloud service-account credentials\n- API keys\n- GitHub tokens\n- CI/CD secrets\n- artifact registry credentials\n- deployment identities\n- AI service API keys\n- repository access tokens\n\nOnce attackers obtain one useful credential, they may be able to access additional services, workloads, repositories, or deployment systems.\n\nThis is why exposed cloud credentials remain such a serious security problem. TechUpdate24 previously covered another example involving [leaked AWS keys and the risks of exposed cloud credentials](https://techupdate24.com/leaked-aws-keys-truffle-security-admin-access/) .\n\nCompromised cloud infrastructure can also make malicious traffic harder to distinguish from legitimate activity because requests may originate from real cloud workloads rather than obviously malicious infrastructure.\n\n## What Makes an Agentic Attack Different From a Normal Script?\n\nAutomation in cyberattacks is not new. Attackers have used scanners, bots, scripts, and malware for decades.\n\nThe key difference is adaptability.\n\nA traditional script usually follows predefined logic. When it encounters an unexpected condition, it may fail or require manual intervention.\n\nAn AI-assisted agentic workflow can potentially interpret an intermediate result, adjust the next step, troubleshoot a problem, and continue toward an attacker-defined objective.\n\nThat does not mean an AI agent is an independent hacker capable of doing anything on its own. It still depends on permissions, infrastructure, tools, data, and attacker-defined goals.\n\nBut it can reduce the amount of human attention required to keep an operation moving.\n\n## AI Is Moving Across More of the Attack Lifecycle\n\nGoogle says threat actors are increasingly moving beyond simple prompting and experimenting with AI across broader operational workflows.\n\nThat can include reconnaissance, social engineering, malware development, troubleshooting, post-compromise activity, and automation.\n\nThis is an important distinction for defenders.\n\nAI misuse should no longer be viewed only as a chatbot-security problem. It is increasingly becoming an orchestration layer that can sit on top of existing offensive tools and techniques.\n\n## CI/CD Pipelines Are Becoming High-Value Targets\n\nGoogle has also documented financially motivated threat actors targeting software development and CI/CD environments as part of broader software supply-chain operations.\n\nGoogle Threat Intelligence Group has tracked activity targeting open-source repositories and package ecosystems, including attacks involving compromised packages, repositories, and developer infrastructure.\n\nThese environments are especially attractive because CI/CD systems often hold powerful machine identities.\n\nA compromised build runner may have access to:\n\n- production deployment credentials\n- container registries\n- cloud APIs\n- source-code repositories\n- package registries\n- infrastructure-as-code environments\n\nIf those credentials are long-lived or overly privileged, one compromised pipeline can become a bridge into multiple systems.\n\nGoogle and Mandiant provide additional hardening guidance here: [Mitigation Guidance for Supply Chain Compromise](https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise) .\n\n## AI Agents Also Create an Authorization Problem\n\nAgentic systems do not only introduce a malware problem. They also introduce an identity and authorization problem.\n\nIf an autonomous agent receives broad permissions, access to secrets, or the ability to execute actions across multiple services, a compromised or manipulated agent can become significantly more dangerous.\n\nThat is why least privilege becomes even more important in agentic environments.\n\nTechUpdate24 previously examined a related problem in our coverage of [AWS Bedrock AgentCore security risks and agent authorization](https://techupdate24.com/aws-bedrock-agentcore-hijacked-ai-security/) .\n\n## AI Coding Tools Create a New Supply-Chain Attack Surface\n\nAnother emerging concern is the way AI coding tools process repository content and development-workspace files.\n\nModern coding assistants may rely on project instructions, configuration files, hidden directories, or agent-specific context to understand how they should behave inside a repository.\n\nThat creates a new security problem: malicious content can potentially be designed not only for a developer, but for the AI tool assisting that developer.\n\nThis means security reviews may increasingly need to consider both traditional malicious code and instructions intended to manipulate AI agents.\n\n## Prompt Injection Is Becoming an Enterprise Security Issue\n\nPrompt injection is often discussed in the context of chatbots, but the risk becomes more serious when an AI system has access to files, terminals, repositories, developer tools, or automation workflows.\n\nIf an AI assistant automatically processes attacker-controlled content, malicious instructions may attempt to influence what the tool does next.\n\nPotential goals could include:\n\n- executing commands\n- accessing secrets\n- modifying files\n- ignoring security controls\n- downloading additional scripts\n\nThe broader lesson is that agent-facing files and configuration should increasingly be treated as part of the software supply-chain attack surface.\n\n## What Cloud and DevOps Teams Should Monitor\n\nTrying to detect whether “AI” is involved in an attack is usually not the most useful defensive approach.\n\nInstead, teams should focus on the observable behavior produced by fast automated attacks.\n\nUseful signals include:\n\n- large bursts of API enumeration\n- unexpected creation of service accounts\n- rapid access to multiple secrets\n- unusual CI/CD runner jobs\n- repository tokens used from unfamiliar infrastructure\n- unexpected privilege changes\n- new workloads created shortly after credential use\n- unusual cloud API activity from automation identities\n- multiple authentication attempts across services in a short period\n\nNo single event proves an agentic attack.\n\nThe strongest signal may be the **speed and combination of events**.\n\n## A Practical 30-Minute Response Checklist\n\nIf a cloud credential, build runner, or developer environment is suspected of compromise, the priority should be preventing the attacker from continuing to automate the incident.\n\n- **Revoke exposed credentials immediately.**\n- **Disable compromised tokens or service accounts.**\n- **Review recent IAM and permission changes.**\n- **Check which secrets were accessed.**\n- **Inspect CI/CD runners for unexpected jobs.**\n- **Review repository and package-registry access.**\n- **Preserve audit logs before deleting workloads.**\n- **Temporarily isolate suspicious systems if needed.**\n\nThe first goal is not to prove whether AI was used.\n\nThe goal is to remove the credentials, permissions, and infrastructure that an automated attacker could continue using.\n\n## Long-Lived Credentials Are an Even Bigger Risk\n\nAgentic automation strengthens the case for reducing long-lived cloud credentials.\n\nA permanent access key or personal access token may remain useful long after the original compromise.\n\nGoogle and Mandiant recommend stronger identity controls, reduced reliance on long-lived secrets, and tighter protection around development and software supply-chain systems.\n\nWhere supported, organizations should prefer short-lived credentials, workload identities, federated authentication, and narrowly scoped permissions.\n\nFor DevOps teams, that means reviewing whether build pipelines really need permanent credentials at all.\n\nA deployment job that only needs access for a few minutes should ideally receive a short-lived identity with narrowly scoped permissions.\n\n## Least Privilege Matters More When Attacks Move Faster\n\nAI does not create permissions that do not already exist.\n\nIf an attacker steals a low-privilege credential, the damage may remain limited.\n\nIf the same attacker steals an administrator-level token used by multiple pipelines, the impact can be much larger.\n\nOrganizations should review:\n\n- service-account permissions\n- GitHub Actions permissions\n- cloud IAM roles\n- artifact-registry access\n- deployment credentials\n- secrets-manager permissions\n\n## Incident Response May Need to Become Faster Too\n\nThe broader lesson from Google’s report is not simply that attackers are using AI.\n\nIt is that AI can reduce attacker waiting time.\n\nSecurity teams should therefore measure how quickly they can:\n\n- detect credential misuse\n- revoke compromised identities\n- disable malicious automation\n- identify accessed secrets\n- isolate affected workloads\n\nA response process built around slow manual review may struggle against an attack capable of completing major stages in hours.\n\n## AI Does Not Replace Traditional Hacking — It Accelerates It\n\nGoogle’s findings do not suggest that AI has replaced traditional cyberattack techniques.\n\nAttackers still need credentials, vulnerabilities, infrastructure, permissions, and tools.\n\nWhat AI can change is the speed and scale at which those resources are used.\n\nThat distinction is important because the defensive answer is not a special “anti-AI firewall.”\n\nThe strongest protections remain familiar:\n\n- short-lived credentials\n- least privilege\n- strong audit logging\n- CI/CD hardening\n- rapid credential revocation\n- software supply-chain security\n- continuous monitoring\n\n## Bottom Line\n\nThe most important lesson from Google’s six-hour credential-harvesting case is not that autonomous AI agents make cyberattacks unstoppable.\n\nIt is that they can reduce human delay.\n\nA compromised identity that once gave defenders several hours to react may now be used much more aggressively and automatically.\n\nFor cloud and DevOps teams, the priorities are clear: eliminate unnecessary long-lived credentials, reduce excessive permissions, monitor automation identities closely, and build incident-response processes capable of revoking access quickly.\n\nThe AI agents cloud credential theft scenario highlights why short-lived identities, least privilege, and rapid credential revocation are becoming increasingly important for cloud security teams.\n\n**In an agentic threat environment, the organization that detects and responds faster may have the real advantage.**", "url": "https://wpnews.pro/news/autonomous-ai-agents-harvest-cloud-credentials-in-under-6-hours-google-warns", "canonical_source": "https://techupdate24.com/autonomous-ai-agents-cloud-credential-theft/", "published_at": "2026-09-15 16:03:20+00:00", "updated_at": "2026-09-15 16:17:56.434474+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "artificial-intelligence", "ai-policy"], "entities": ["Google", "Google Threat Intelligence Group", "AWS", "GitHub", "TechUpdate24"], "alternates": {"html": "https://wpnews.pro/news/autonomous-ai-agents-harvest-cloud-credentials-in-under-6-hours-google-warns", "markdown": "https://wpnews.pro/news/autonomous-ai-agents-harvest-cloud-credentials-in-under-6-hours-google-warns.md", "text": "https://wpnews.pro/news/autonomous-ai-agents-harvest-cloud-credentials-in-under-6-hours-google-warns.txt", "jsonld": "https://wpnews.pro/news/autonomous-ai-agents-harvest-cloud-credentials-in-under-6-hours-google-warns.jsonld"}}