More than 23,800 valid cloud and AI service credentials were harvested in under six hours during a fully autonomous credential-theft campaign against a victim’s cloud environment, according to a new report from Google Threat Intelligence Group (GTIG) and the Cloud Security Alliance. The incident, traced to Q2 2026, reveals attackers using AI agents not just as assistants but as operators of complex attack chains, compressing timelines and evading detection.
How the Attack Unfolded
The threat actor gained initial cloud access through more conventional means, then handed off control to an AI coding chatbot system. Using a single crafted prompt and agent instructions built in markdown format, the system performed vulnerability scanning, credential harvesting, error troubleshooting, and outbound IP rotation— all autonomously. This eliminated the need for ongoing human oversight once the pipeline started. Detection and breach timelines were compressed significantly by use of the victim’s own cloud IP addresses for exfiltration, masking malicious activity as legitimate network behavior. GTIG confirmed the campaign compromised thousands of credentials belonging to AI providers and cloud services. Simultaneously, an exposed command-and-control dashboard — internally called “Recon” — was discovered organizing over 23,800 harvested secrets.
Wider Context: Non-Human Identities & Credential Lifecycle Risks
This case is one among several recent campaigns illustrating attackers embedding autonomous decision-making deeper into cyber intrusions. GTIG associated other operations — for example, by a group tracked as TeamPCP or UNC6780 — with use of credential stealers such as DUSTMAKER and SANDCLOCK. These malicious tools have been distributed via supply chain vectors like compromised packages on PyPI, npm, and Docker Hub, harvested OpenID Connect tokens from GitHub Actions, and hidden files in directories frequently accessed by AI tools or developer environments.
One of the most alarming shifts: workflow permissions and credential storage designed for human operators now aiding attackers. Agentic pipelines are exploiting weak identity and access management (IAM) policies, especially where AI-issued secrets are treated no differently from human ones. Attackers are leveraging the increasing overlap between AI tooling and traditional software supply chains to elevate risk. The incident demonstrates that secrets management and IAM now represent a critical defense boundary, sometimes more important than endpoint detection alone.
Though attribution remains partial, the campaign has been attributed to financially motivated threat actors. Damage estimates continue to surface: stolen API keys and cloud credentials are being used to run up infrastructure costs and assist extortion, model theft, or distillation attacks. It’s still under investigation how many organizations beyond the initial victim had their credentials exposed or misused.
Defensive takeaways include stricter monitoring of non-human identities, rotating credentials aggressively, segregating execution roles and minimizing agent permissions. Visibility into agent behavior is often lacking; that gap is what allowed this breach to proceed at breakneck speed without detection.
What this means: The evolution of autonomous agent-driven attacks marks a radical shift in how threat actors operate. Traditional security tools and IAM configurations need to catch up. If organizations don’t treat AI agents and API keys with the same skepticism as edge-exposed credentials, similar breaches will increasingly become the norm.
