Threat actors are giving AI agents a bigger role in cyberattacks
Google Threat Intelligence's Q3 2026 tracker shows threat actors using AI agents for autonomous credential harvesting, including a six-hour campaign compromising thousands of credentials.
Google Threat Intelligence Group's Q3 2026 AI Threat Tracker, based on Mandiant incident response and platform telemetry, documents adversaries shifting toward AI-driven multi-step attack workflows. Mandiant investigated a financially motivated actor that compromised cloud infrastructure and used an AI coding chatbot plus agent instructions to run vulnerability scanning, troubleshooting, and IP rotation autonomously, harvesting thousands of third-party credentials in under six hours; an exposed 'Recon' C2 server held over 23,800 harvested secrets including cloud and AI API keys. Separately, two PRC-nexus espionage actors experimented with Gemini, Claude, and Codex to build automated penetration testing and exploitation frameworks, with Shai-Hulud used for C2 and credential harvesting. GTIG says no fully autonomous attack pipelines have yet been observed in the wild.
- Six-hour autonomous credential-harvesting campaign compromised thousands of third-party credentials via multi-agent framework.
- Exposed Recon C2 dashboard managed over 23,800 harvested secrets, including cloud and AI service API keys.
- PRC-nexus espionage actors used Gemini, Claude, and Codex to prototype automated pentesting and exploit pipelines.
- GTIG notes shift from passive infostealers toward offensive agentic harvesting; no fully autonomous pipelines in the wild yet.
- Premium model access and compute costs remain a barrier for threat actors operationalizing AI.
- Malware
- Shai-Hulud
- Organizations
- Countries
- China
From the original article
3 min read at helpnetsecurity.com
AI agents are automating parts of cyberattacks with less human involvement, including vulnerability scanning, credential harvesting, and troubleshooting, according to Google Threat Intelligence Group’s Q3 2026 AI Threat Tracker. (Source: Google) The report draws on Mandiant incident response engagements, threat actor tracking, and live platform defenses.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.