Cyberattacks are beginning to use AI in a more automated way, according to new research from Google Threat Intelligence Group (GTIG). In a report published September 8, GTIG said it has observed threat actors moving beyond simple prompting and integrating agentic AI into multiple stages of real-world attack operations.
The most striking example involved an attacker that compromised cloud infrastructure and then used an AI coding chatbot, a prompt and preconfigured agent instructions to plan, build and execute a mass credential-harvesting campaign in less than six hours. Google said the system autonomously managed vulnerability scanning, troubleshooting and IP rotation, while thousands of third-party credentials were compromised.
From AI Assistance to Agentic Attacks
AI has already been used by attackers for reconnaissance, phishing content, malware development and vulnerability research. GTIG’s latest findings point to a different phase: attackers are increasingly connecting those capabilities into workflows that can make decisions and adjust their actions with much less human intervention.
Google said it observed multi-agent frameworks that could coordinate scanning pipelines, resolve operational errors and carry out credential harvesting at scale. The company describes this as a reduction in “human-in-the-loop” latency, meaning there is less time between an attacker deciding on an action and an automated system carrying it out.
A Six-Hour Credential-Harvesting Operation
One case in the report demonstrates why the change matters. A financially motivated threat actor first gained access to an organisation’s cloud infrastructure. From there, the attacker used an AI coding chatbot together with a prompt and Markdown-based instructions as an operational playbook.
According to GTIG, the resulting multi-agent framework handled automated scanning and credential harvesting, performed real-time troubleshooting and rotated IP addresses without manual intervention. The operation compromised thousands of third-party credentials in under six hours.
The use of a victim’s cloud infrastructure also allowed the attack traffic to appear to originate from legitimate infrastructure, complicating traditional network-based detection.
Attackers Are Also Targeting AI Assets
GTIG’s report says the threat is moving in both directions: AI is being used to attack organisations, while AI systems and the infrastructure around them are becoming targets themselves.
Google observed attempts to steal proprietary AI models, source code, prompts and research, along with API credentials and access to cloud environments that can be repurposed for unauthorised AI workloads. The company also highlighted “LLMJacking”, in which stolen accounts or compromised cloud resources are used to access costly AI services or computing capacity.
AI developer environments are an emerging target as well. GTIG said credential-stealing malware has been directed at configuration files used by AI coding assistants, which can contain API keys or model-routing information.
The Supply-Chain Problem
The report also links the rise of agentic AI attacks to the software supply chain. AI-assisted development and open-source software can accelerate production, but the same ecosystems give attackers additional opportunities to compromise developers, dependencies and AI security tools.
GTIG said it has tracked UNC6780, also known as TeamPCP, conducting large-scale compromises across ecosystems including PyPI, npm and Docker Hub. In one case, an attacker created a malicious GitHub Actions workflow targeting a company’s proprietary AI repository, while another threat actor later exfiltrated a copy of that repository.
Not Yet Fully Autonomous — But the Direction Is Clear
Google’s findings are significant, but they do not mean fully autonomous hacking has become routine. GTIG explicitly said it has not observed threat actors deploying fully autonomous exploitation pipelines against targets in the wild.
Instead, the current evidence shows a gradual transition. Attackers are combining existing commercial and open-weight AI models with automation, scripts and specialist tools to shorten the time needed for reconnaissance, vulnerability research and credential theft.
That distinction matters. The immediate risk is not an AI system independently attacking any organisation on demand. It is that relatively small teams can use AI agents to automate enough individual steps that an attack can be carried out faster and at greater scale.
Why This Matters for Indian Businesses
For organisations in India, the trend is particularly relevant as businesses expand their use of cloud platforms, AI coding tools and third-party software. A compromised developer credential or cloud account can expose not just conventional corporate data, but also API keys, AI workloads and source code.
Defensive priorities therefore extend beyond buying an “AI security” product. Companies need strong identity controls, least-privilege access, protection for developer secrets, visibility into cloud activity, software-supply-chain controls and rapid incident response. AI systems themselves also need to be treated as valuable infrastructure rather than isolated productivity tools.
What Comes Next
GTIG’s latest report suggests that the cybersecurity industry is entering an arms race in which both attackers and defenders can use increasingly capable AI agents. Google’s own response includes model-level safeguards, threat intelligence and automated defensive systems designed to detect and disrupt malicious activity.
The important takeaway is more practical than futuristic: the attack lifecycle is getting faster. Security teams that still depend on slow, manually coordinated investigation and response could find their reaction window shrinking as adversaries automate more of the work.
For now, the evidence supports a measured conclusion. AI has not eliminated the need for human attackers, but it is already making some cyber operations faster, more scalable and more adaptable. The next phase of cybersecurity will increasingly be about defending against automated systems, not just individual hackers.
