Google: Criminals Stole Thousands of Passwords in Under Six Hours Using Autonomous AI Agents

Google Threat Intelligence Group published a report titled "From Prompting to Autonomy: The Evolution of Adversarial AI" on September 8, 2026, describing a case in which criminals assembled a fully autonomous attack system from an AI coding chatbot, a single prompt, and a set of agent instructions. The result was a mass credential-theft campaign carried out in under six hours from the moment attackers gained access to the victim's infrastructure.

How the Autonomous Attack Worked

According to GTIG, attackers no longer needed to manually drive each stage of the intrusion. It was enough to assemble the framework from ready-made components: an AI chatbot capable of writing and executing code, a single outbound prompt describing the objective, and a set of instructions governing the agent's behavior. Pre-programmed markdown playbooks guided the entire process of scanning infrastructure and extracting credentials without further human intervention.

This is the first case documented by Google in which reconnaissance, exploitation, and credential harvesting were merged into a single automated chain running in real time, rather than separate, manually operated steps spread across days or weeks.

Who Is Behind the Attacks

The report names several actors responsible for the new wave of attacks. The UNC6780 group, also tracked as TeamPCP, poisoned the LiteLLM gateway, used to integrate various language model providers, in March 2026, and then distributed trojanized Model Context Protocol servers to developers using the PyPI, npm, and Docker Hub ecosystems.

The second actor described is UNC6508, a China-linked group that has for several years run a campaign targeting American academic, medical, and military institutions, focusing in particular on stealing data related to AI research. Google also observed another China-linked group attempting to build an automated penetration-testing framework based on the Gemini model.

Malware That Learns Context

The DUSTMAKER malware found by researchers exploited systems' trust in developer tool directories, hiding its files in folders associated with the Claude, Cursor, and Visual Studio Code coding assistants. These locations are less frequently scanned by traditional security software, since they are treated as a trusted developer working environment.

GTIG also described samples of malicious code containing injected prompts referencing biological and nuclear weapons. The purpose of such text fragments is not real-world action but an attempt to mislead AI-based security systems that automatically scan and classify suspicious code for high-risk content.

The Market for Stolen AI Access

Besides stealing credentials for corporate systems, the report describes the growing practice of LLMjacking, the hijacking of paid AI service accounts. The server managing a platform called Recon handled a database of 23,800 stolen secrets, including API keys and credentials, which were then sold on criminal forums. According to the cited data, the average price of an account providing access to AI services on such forums more than doubled in 2026.

Criminals, like those who carried out a mass exploitation campaign in just six hours, will gravitate toward attacks faster than we are able to respond to them - John Hultquist, Chief Analyst at Google Threat Intelligence Group

What This Means for Businesses

For security teams, the key issue is the sheer leap in time scale. The classic incident-response model, detecting an intrusion, analyzing it, and responding within hours or days, loses its meaning when the entire attack cycle, from initial access to mass data exfiltration, closes in under six hours. Google recommends monitoring unusual activity in the AI tool directories used by developers and treating API keys for language models as an asset just as sensitive as administrative passwords.

The report is also relevant to Polish companies using tools such as GitHub Copilot, Claude Code, or Cursor in the daily work of development teams. The popularity of trojanized Model Context Protocol servers shows that the software supply chain has expanded to include a new category of risk: AI extensions and integrations installed directly in developer environments.

Google says GTIG will continue publishing updates as new AI-enabled attacker techniques emerge, while the company is also developing its own AI-based defensive tools, including the Big Sleep system for detecting unknown vulnerabilities and CodeMender for automatically patching code flaws.