Google Threat Intelligence Group has documented an attack run end to end not by a person but by a team of AI agents. A financially motivated crew pointed an autonomous, multi-agent framework at a target and harvested thousands of third-party credentials in under six hours. A human set the goal and barely touched the keyboard after that. “We can assume that all threat actors are using AI in some capacity,” says GTIG chief analyst John Hultquist.
What happened
The setup is almost insultingly simple: an AI chatbot, one prompt, and a set of agent instructions. From that they assembled a framework where each agent owns a stage and the roles are written into an ordinary markdown file that acts as a playbook. The system then ran itself: it scanned networks, found and pulled credentials, fixed its own errors on the fly, and rotated IPs to stay quiet.
Two fresh credential stealers featured in the campaign: SANDCLOCK (Python, aimed at Linux and Kubernetes) and DUSTMAKER (cross-platform JavaScript, aimed at CI/CD build pipelines). Add the usual agentic toolkit: defense evasion through prompt injection, container escape, and supply-chain compromise via PyPI, npm and Docker Hub. The result was stolen API keys from healthcare, government and media, access to the victim cloud (promptly repurposed to run the attackers own AI workloads), and theft of proprietary models, prompts and source code.
Why six hours matters more than any new malware
Speed breaks the logic of defense. Security assumes the attacker needs time: recon, tooling, mistakes, pauses. Those hours and days are exactly when monitoring and response kick in. An autonomous agent compresses all of it into a single sprint, and the old response cadence simply cannot keep up.
The second shift is scale and the barrier to entry. This used to take an experienced team; now it takes a goal and a set of instructions, and the AI does the grunt work. We covered where cheap, unrestricted models lead in our breakdown of uncensored AI for $5. This is the same logic, packaged into a ready-made attack pipeline.
This is what we do all day — and here is what we have learned
We do not just read this in reports. Over the past year we have run more than 200 ethical hacking engagements, and in a good share of them the AI acted not as an assistant but as the operator of the attack. Our AI Brain runs the very playbooks attackers use: there are modes where a human drives the engagement in tandem with the AI, and configurations where the AI plans and orchestrates every stage on its own. The honest finding: as an attack conductor, models behave very differently. Some hold the objective and chain steps cleanly, others lose the thread fast or run into their own guardrails. That is exactly why this capability has to be tested against your own infrastructure in advance, not guessed at from the news.
We have seen these techniques before — done by hand
The techniques in the report are not new, and that matters. Stealing access to build pipelines and the software supply chain made headlines long ago. In 2020, a poisoned SolarWinds update reached thousands of organizations. In 2021, the Codecov breach exposed secrets from many companies CI/CD pipelines. In 2022, attackers stole a LastPass engineers working credentials and used them to reach cloud storage.
The difference is that back then a human stood behind every step, which meant time and limited scale. AI removes both limits. The old playbooks did not go away, they just got fast and autonomous.
What to do
The good news: old techniques have known defenses. They just have to be made automatic and stress-tested.
- Credentials are the keys to the kingdom. Phishing-resistant MFA, short-lived tokens and regular secret rotation devalue whatever gets stolen.
- Lock down CI/CD and the supply chain. No secrets in code, least privilege for pipelines, dependency vetting. Find the gaps with a secure code review.
- Probe the perimeter the way an AI agent would. That is the path we exercise in external network penetration testing, running continuously via Brain.
- Defend your own AI systems. Their credentials and configs are now a target in their own right. Test them with AI agent penetration testing and put a runtime boundary around them with Airlock.
- Rebuild response for the new speed. A red team assessment should assume you have hours, not days.
The takeaway
An autonomous attack in six hours is not a story about a smart, evil AI. It is a story about the drudgery of an attack being outsourced to a machine. A related problem is that these agents are their own planner, executor and auditor at once, which we unpacked in our piece on segregation of duties for AI agents. The defensive conclusion is simple: assume the attacker has a tireless operator, and test your readiness in advance, ideally with a red team assessment rather than after the leak.