Autonomous AI Agents Stole Thousands of Credentials in Less Than Six Hours

Google Threat Intelligence Group has documented a financially motivated operation in which autonomous AI agents harvested thousands of third-party credentials from compromised cloud infrastructure in under six hours.

The attackers combined an AI coding chatbot with a controlling prompt, specialized agent roles, and reusable Markdown instruction files. Together, those components formed an operational framework capable of scanning systems, collecting credentials, resolving execution problems, and rotating IP addresses with limited human supervision.

The affected organization has not been named, and the date of the intrusion is not known. GTIG also did not disclose the initial access method, exact credential count, cloud provider, or technical indicators associated with the incident.

Even with those gaps, the operation marks a practical change in how AI can support cybercrime. The system did not merely write phishing messages or produce isolated code snippets. It coordinated multiple stages of an active intrusion.

A Multi-Agent Pipeline Replaced Hands-On Attack Management

The framework used preconfigured instructions as attack playbooks. Each agent could be assigned an operational function, while the broader system connected those functions into an automated pipeline.

Reported capabilities included:

• Vulnerability and exposed-service scanning.
• Credential discovery and collection.
• Troubleshooting when tasks failed.
• IP rotation to sustain activity or complicate detection.
• Management of the scanning workflow as conditions changed.

This architecture reduced the need for an operator to manually supervise every command. GTIG assessed that the framework could adapt during execution and address problems in real time, allowing the attacker to maintain momentum across multiple stages.

The result was speed. Thousands of credentials belonging to third parties were compromised before defenders had much opportunity to investigate, contain the cloud intrusion, and revoke exposed secrets.

It is not known whether the system independently selected vulnerabilities, executed exploits, or validated each stolen credential. No CVE identifiers or affected software versions have been disclosed. The incident therefore should not be treated as a conventional vulnerability advisory or as evidence that a particular AI product was compromised.

Instead, it demonstrates how agents can link reconnaissance, collection, troubleshooting, and evasion into a continuous workflow. Human operators still establish objectives and provide instructions, but they no longer need to control each action directly.

TeamPCP Targets the Software Supply Chain and CI/CD Secrets

GTIG has also connected a broader set of software supply-chain compromises to TeamPCP, a financially motivated group also tracked as Altered Spider and UNC6780. Its targets have included the PyPI, npm, and Docker Hub ecosystems.

Compromising developer packages, container images, or associated accounts can provide access to environments where high-value secrets are routinely present. Build systems may contain cloud tokens, package-publishing credentials, source-code access keys, signing material, AI-assistant configurations, and deployment permissions.

TeamPCP has deployed two credential-stealing malware families, SANDCLOCK and DUSTMAKER, after obtaining access.

SANDCLOCK was used in March and April 2026 and has been associated publicly with activity called CanisterWorm. Written primarily in Python and aimed at Linux systems, it can interact with Kubernetes, steal cloud and developer credentials, target cryptocurrency wallets, and attempt container escape.

DUSTMAKER was used in April 2026 and thereafter. This cross-platform JavaScript payload is optimized for continuous integration and continuous delivery environments. It lacks SANDCLOCK’s container-escape capability, but concentrates on stealing credentials that can support extortion. Some variants also target cryptocurrency wallets.

DUSTMAKER adds a specifically AI-oriented layer. It can poison AI-assistant workspaces and use prompt injection to evade defensive controls. Those techniques were not present in the earlier SANDCLOCK variants described by GTIG.

Workspace poisoning is particularly dangerous when developers allow coding agents to read repository documentation, Markdown files, configuration artifacts, or project-level instructions. A malicious instruction embedded in trusted-looking workspace content may influence the assistant’s behavior, suppress warnings, expose secrets, or direct it to execute unsafe actions.

TeamPCP monetizes stolen access through direct sales and through relationships with ransomware and data-theft extortion groups. A supply-chain compromise can therefore become an entry point for several downstream attackers.

AI Models, Prompts, and Research Are Now Theft Targets

Attackers are not using AI solely as an offensive tool. They are also targeting the infrastructure and intellectual property behind enterprise AI systems.

GTIG observed operations against healthcare, government, and media organizations involving attempts to steal proprietary models, prompts, AI skills, source code, research, and API credentials. Threat actors also sought access to AI development systems and reused compromised cloud environments to run unauthorized workloads.

The potential outcomes extend beyond a conventional data breach. Stolen API keys can let attackers consume paid services under a victim’s identity. Compromised cloud accounts can host costly inference workloads, while stolen models and research may support espionage, extortion, competitive replication, or resale.

Google has also observed distillation attacks targeting visual and audio understanding, image generation, and video generation. In this type of activity, an attacker repeatedly queries a protected model and uses its outputs to train or improve another system, attempting to reproduce capabilities without acquiring the original model directly.

Commodity information stealers contribute to the access market. Lumma Stealer, Vidar, and ACR Stealer are identified as likely sources of credentials for AI services and development environments. Their collection targets have expanded to include AI developer configuration files, tokens, and other artifacts associated with coding assistants and LLM APIs.

Once stolen, this material can expose far more than a chatbot account. It may provide access to source repositories, cloud deployments, project histories, proprietary prompts, connected tools, and privileged automation.

Local Models Reduce Provider Visibility

A China-linked actor tracked as UNC6508 is suspected of compromising cloud environments and installing local LLM infrastructure. Rather than relying on a commercial frontier-model API, the actor used an open-weight model inside the victim environment.

That choice removes a significant monitoring layer. API providers can inspect usage patterns, apply abuse controls, suspend accounts, and investigate malicious prompts. A locally operated model does not generate equivalent external telemetry.

The attacker can also use the victim’s computing resources to sustain inference workloads. Unexpected GPU use, new model files, container deployments, listening services, and sharp changes in cloud consumption may therefore indicate both resource theft and malicious AI activity.

GTIG highlighted the availability of “abliterated” or otherwise uncensored model variants as an additional concern. These models can be operated without centralized safety enforcement for reconnaissance, phishing, malicious scripting, or tool orchestration.

The issue is not simply whether open models are accessible. Defenders must account for AI workloads that run entirely inside compromised infrastructure.

State and Criminal Groups Are Expanding AI Use

The pattern extends across espionage, fraud, influence operations, and extortion.

Basin Castle, also known as Mustang Panda, has used Claude, Gemini, and Codex for exploit scripts, spear-phishing, target research, and troubleshooting during intrusions. Ravine Castle, also tracked as APT24, COULEE, and Pitty Tiger, has used Gemini for intelligence collection, capability development, and influence activity.

Sandworm, also known as APT44 and Sandworm Relic, has used Gemini in operations against Ukraine for intelligence collection, social engineering, and workflow automation. The Iran-linked Calanque Ion, or APT42, has applied generative AI to reconnaissance and targeted social engineering.

North Korea-linked actors have used AI for IT-worker fraud, bulk registration of LLM API accounts through hijacked identities, supply-chain manipulation, social engineering, and automated backdoor development. UNC6240, also known as ShinyHunters, used Claude Code to bypass Cloudflare controls and analyze stolen directories for extortion.

A China-aligned espionage group also used Gemini while developing an automated penetration-testing framework designed to observe targets, reason about possible actions, scan ports, parse services, and operate in changing environments.

These examples show that agentic AI is becoming an operational layer. It can help attackers make decisions and coordinate tools, not just generate content.

Defenders Need to Treat Agent Instructions as Executable Risk

Organizations should first rotate and revoke any exposed cloud, developer, CI/CD, LLM API, and cryptocurrency-wallet credentials. They should then look for unusual token use, bulk credential access, unexpected API registrations, rapid IP rotation, automated scanning, and unexplained cloud or GPU consumption.

Priority defensive actions include:

• Isolating build runners and limiting their access to production secrets.
• Enforcing package integrity, dependency pinning, provenance checks, and controlled publishing.
• Reviewing Markdown and other instruction files consumed by coding agents.
• Monitoring repositories and workspaces for prompt-injection content.
• Logging AI-assistant actions, API calls, tool execution, and administrative changes centrally.
• Detecting unauthorized model files, inference servers, containers, and local AI services.
• Segmenting development, production cloud, and AI experimentation environments.
• Restricting unapproved AI tools without relying on restrictions as the only control.
• Protecting models, prompts, research, and source code as high-value intellectual property.

No public indicators of compromise have been provided for the six-hour credential-harvesting operation. That leaves defenders to focus on behavioral evidence rather than a fixed signature list.

The central risk is already concrete: AI agents can compress an intrusion timeline by coordinating tasks that previously demanded continuous operator attention. When credentials, build systems, and cloud resources are interconnected, six hours may be enough to turn one compromised environment into access across many others.