AI agents are automating parts of cyberattacks with less human involvement, including vulnerability scanning, credential harvesting, and troubleshooting, according to Google Threat Intelligence Group’s Q3 2026 AI Threat Tracker.
(Source: Google)
The report draws on Mandiant incident response engagements, threat actor tracking, and live platform defenses. Researchers observed attackers moving from basic prompts toward workflows where AI systems handle several connected tasks.
A six-hour credential theft campaign
In Q2 2026, Mandiant investigated a suspected financially motivated threat actor that compromised an organization’s cloud infrastructure and deployed an autonomous multi-agent framework.
The attacker used an AI coding chatbot, a prompt, and agent instructions to plan, build, and execute a mass credential-harvesting campaign in less than six hours. Thousands of third-party credentials were compromised.
“The agent instructions enabled the AI to autonomously manage the vulnerability scanning pipeline, perform real-time troubleshooting, and execute IP rotation logic without manual intervention,” GTIG researchers wrote.
The attacker operated from the victim’s cloud infrastructure, which allowed attack traffic to pass through legitimate IP addresses.
Access to AI services and the computing resources needed to run them has also become part of the threat activity GTIG is tracking.
“In order to experiment with generative AI tools, threat actors must obtain and maintain access to those tools,” GTIG said. “The cost of premium model access and high-performance compute is one of the primary barriers for threat actors seeking to operationalize AI.”
More than 23,800 harvested secrets found on one server
GTIG identified an exposed command-and-control server hosting an automated reconnaissance and credential management framework called “Recon.” The server exposed configuration and knowledge files, including AGENTS.md, KNOWLEDGE.md, and agentic_vuln_research.md, along with .openclaw/ and memory/ directories.
(Source: Google)
Shortly after it was detected, the exposed directory became a production dashboard designed to organize, validate, and manage more than 23,800 harvested secrets in real time, including API keys for cloud and AI services.
GTIG said autonomous agents can research vulnerabilities, scan server-side infrastructure, and execute targeted exploits. Researchers described the activity as a transition from “passive, endpoint-focused infostealers to offensive agentic harvesting.”
Cyber espionage actors experiment with automated frameworks
A PRC-nexus cyber espionage threat actor used Gemini to design a dynamic, automated penetration testing framework intended to observe the state of a target, reason through actions, and execute tasks in unpredictable environments. Planned discovery functions included port scanning and service parsing. The activity was limited to attempts to build the framework, and GTIG disabled the assets associated with it.
In a separate case, another PRC-nexus cyber espionage threat actor experimented with AI development tools for an AI-assisted automated exploitation and post-exploitation pipeline.
Using CC Switch, it queried Claude, Gemini, or Codex to write custom exploit scripts, generate spear-phishing lures, and debug errors. The operation also involved Burp Suite to probe web applications and identify vulnerabilities, and Phalanx, an open-source penetration testing framework, for automated exploitation routines. During post-exploitation activity, Shai-Hulud was deployed for command-and-control and credential harvesting.
No sign of autonomous pipelines
GTIG says it “has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild,” even as adversarial adoption of agentic AI “suggests threat actor use of AI could be evolving towards this use case.”
GTIG describes “a gradual maturation of tradecraft,” with adversaries using commercial and open-weight models to turn public disclosures and patch delays into working n-day exploit code, refining payloads in controlled environments and progressing “toward constructing functional, multi-stage exploit chains.”
“We continuously harden our AI models against misuse by feeding insights from active threat monitoring directly into our safety classifiers and guardrails,” researchers concluded.
