Google Threat Intelligence: a Multi-Agent Framework Harvested Thousands of Credentials in Under Six Hours, and AI Coding Tools Became a Primary Target

Cloud infrastructure and open-source registries (PyPI, npm, Docker Hub); technology, healthcare, pharmaceutical, and media organizations in North America and Europe; academic, medical, and military research institutions

Google Threat Intelligence Group published its quarterly adversarial-AI report, "From Prompting to Autonomy: The Evolution of Adversarial AI," on September 8, 2026. The headline case is a financially motivated actor that assembled a multi-agent framework from an AI coding chatbot, preconfigured markdown playbooks, and agent instructions covering autonomous scanning, credential harvesting, error troubleshooting, and IP rotation, then used it to compromise thousands of credentials in under six hours while operating from the victim's own network addresses. GTIG names UNC6780 (tracked elsewhere as TeamPCP) as the group running large-scale supply chain compromises across PyPI, npm, and Docker Hub, using a credential stealer it calls DUSTMAKER that pulls tokens out of GitHub Actions runner process memory so republished packages pass automated trust checks, and that specifically targets `.claude` and `.cursor` directories on developer machines. One command-and-control server, named "Recon," held more than 23,800 harvested secrets including cloud and AI service API keys, and GTIG says the group sells AI tool credentials on to other criminal groups. GTIG also reports that UNC6508, the PRC-nexus actor behind a multiyear campaign against North American academic, medical, and military research institutions, is suspected of deploying open-weight models inside compromised cloud environments so its prompting never touches commercial API monitoring, and that a China-linked espionage group tried and failed to build an automated penetration-testing framework on Gemini before Google disabled the assets. John Hultquist, GTIG's chief analyst, framed it as "At this point, we can assume that all threat actors are using AI in some capacity and their operations have benefited"

Not a vulnerability. Two shifts recorded at once: AI coding tools and the credentials they store have become a named collection target in their own right, and adversaries are handing multistep intrusion decisions to models, which compresses the interval a defender has to respond. Running open-weight models on attacker-controlled infrastructure removes provider-side abuse monitoring from the picture entirely