Attacker agents ran a mass credential harvest from inside the victim's own cloud in six hours

In Q2 2026 Mandiant investigated a suspected financially motivated threat actor that compromised an organization's cloud infrastructure and deployed an autonomous multi-agent framework, using an AI coding chatbot, a prompt and agent instructions to plan, build and execute a mass credential-harvesting campaign in less than six hours; thousands of third-party credentials were compromised.

GTIG researchers wrote that the agent instructions enabled the AI to autonomously manage the vulnerability scanning pipeline, perform real-time troubleshooting and execute IP rotation logic without manual intervention.

A PRC-nexus cyber espionage actor used Gemini to design a dynamic automated penetration testing framework intended to observe target state, reason through actions and execute tasks, with planned discovery functions including port scanning and service parsing; the activity was limited to attempts to build the framework and GTIG disabled the associated assets.

Shortly after it was detected, the exposed directory became a production dashboard designed to organize, validate and manage more than 23,800 harvested secrets in real time, including API keys for cloud and AI services.

GTIG says it has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild, even as adversarial adoption of agentic AI suggests use could be evolving toward that.

A second PRC-nexus espionage actor used CC Switch to query Claude, Gemini or Codex to write custom exploit scripts, generate spear-phishing lures and debug errors, used Burp Suite to probe web applications and the open-source Phalanx framework for automated exploitation, and deployed Shai-Hulud for command-and-control and credential harvesting.

Google observed threat actors carrying out distillation attacks against its AI models, targeting visual and audio understanding, image generation and video generation capabilities.

TeamPCP, also known as Altered Spider and UNC6780, is a financially motivated actor that has conducted large-scale software supply chain compromises targeting PyPI, npm and Docker Hub, followed by deployment of credential stealers, with the stolen data monetized via direct sale or partnerships with ransomware and data theft extortion groups.

GTIG said autonomous agents can research vulnerabilities, scan server-side infrastructure and execute targeted exploits, and described the activity as a transition from passive, endpoint-focused infostealers to offensive agentic harvesting.

GTIG said the cost of premium model access and high-performance compute is one of the primary barriers for threat actors seeking to operationalize AI.

GTIG said it has observed attackers with diverse motivations targeting proprietary AI models across healthcare, government and media sectors, exfiltrating API credentials, and co-opting victim cloud environments to sustain unauthorized AI workloads.

UNC6508, a China-nexus threat actor, is suspected to have compromised cloud environments to deploy local LLM infrastructure using a local, open-weight model rather than a commercial frontier model, thereby evading monitoring by AI model providers.

Google observed several data theft extortion operations in which threat actors stole proprietary AI data including models, skills, prompts, source code and related research.

GTIG told The Hacker News that SANDCLOCK was used in March and April 2026, is a component of what has publicly been called CanisterWorm, was primarily written in Python, operates on Linux and interacts with Kubernetes, includes container escape functionality, and targeted cryptocurrency wallets as well as cloud and developer credentials.

GTIG said DUSTMAKER, the successor to SANDCLOCK, was used in April 2026 and beyond, is a cross-platform JavaScript payload optimized for CI/CD pipelines, contains no container escape functionality, and focuses on credential theft to facilitate extortion.

GTIG said the AI-targeting techniques, specifically poisoning of AI assistant workspaces and use of prompt injection for defense evasion, are exclusive to DUSTMAKER and were not present in earlier SANDCLOCK variants.

John Hultquist, chief analyst at GTIG, said all threat actors can be assumed to be using AI in some capacity, that agentic application creates a scaled, faster adversary, and that criminals such as those who ran the six-hour mass exploitation campaign will gravitate to attacks that are faster than defenders can respond to.

Google said integration of AI-assisted coding tools has increased threat actors' targeting of developers, AI coding assistants and LLM security scanning tools, raising open-source supply chain risk.

GTIG describes a gradual maturation of tradecraft, with adversaries using commercial and open-weight models to turn public disclosures and patch delays into working n-day exploit code, refining payloads in controlled environments and progressing toward functional multi-stage exploit chains.

About one month separates TeamPCP's first use of SANDCLOCK from its first use of DUSTMAKER, so the actor's AI-assistant targeting techniques arrived with a retool completed inside roughly a month.

The six-hour campaign was investigated in Q2 2026 and described in the Q3 2026 AI Threat Tracker, so at least one quarter elapsed between the incident and its public description.