Google Threat Intelligence Group (GTIG) has revealed a disturbing escalation in cyberattacks: a single financially motivated group managed to compromise thousands of third-party credentials using an autonomous, multi-agent AI framework, executing the breach in under six hours. This marks a serious evolution in how threat actors are using AI not just as an aid, but as the engine behind large-scale, fast-moving attacks.
How the Attack Happened
The attacker first breached a cloud environment and then deployed a system composed of an AI coding chatbot, a crafted prompt, and a set of markdown instructions for multiple agents. Once activated, the agent network scanned for vulnerabilities, harvested credentials, rotated IPs to avoid detection, and routed traffic through compromised infrastructure — all with minimal human input.
The campaign targeted AI coding tools and open-source ecosystems. The group known as TeamPCP (also tracked as UNC6780) has been linked to earlier supply-chain compromises across PyPI, npm, Docker Hub, and GitHub. Their malware tools, like SANDCLOCK and its successor DUSTMAKER, iterate on credential-stealing capabilities, now adding new techniques such as prompt injection and workspace poisoning specifically aimed at AI assistants.
Broader AI-Focused Threat Strategy
TeamPCP isn’t alone in using AI in malicious operations. GTIG also reports that a China-linked espionage actor known as UNC6508 has hijacked cloud environments to deploy local models that dodge monitoring by commercial providers. Stealing models, prompt files, source code — and even conducting distillation attacks against vision, audio, and video models — are now standard tradecraft in the shadowy threatscape.
Other groups are using large language models (LLMs) such as Gemini, Claude, and Codex to automate various stages of their operations: crafting phishing campaigns, writing custom exploit scripts, reconnaissance, and even debugging during active intrusions. The goal is to offload decision-making to AI agents, reducing response time and increasing scale.
To evade detection, malware authors hide malicious files in directories that AI development tools normally use for configuration (for example, “.claude”, “.cursor”, “.vscode”). DUSTMAKER, in particular, uses hidden workspace elements, prompt injections, and disguises tasks in CI/CD pipelines under AI tool names to mask its activity.
Risk Landscape and What’s Next
Despite the escalation, fully autonomous attack pipelines—ones that build zero-day exploits without human involvement—have not yet been observed in the wild according to GTIG. What is happening instead is a hybrid model: AI agents doing most of the heavy lifting, with human operators still involved in planning or oversight.
The shift toward targeting AI infrastructure—developer environments, coding assistants, and model training code—is particularly dangerous. Stolen AI credentials, local models, or proprietary research data can fuel espionage, extortion, or resource theft. Attackers that were once satisfied with compromising endpoints are now going after the supply chains, and even the AI models themselves.
Defenders face a shrinking reaction window. When AI agents autonomously conduct stages of attack—scanning, exploit testing, credential theft—traditional security controls may be too slow or blind to catch the early indicators. Detection needs to push further left, monitoring AI coding tools, workspace directories, CI/CD pipelines, and even how prompts are injected.
When threat actors do get caught, the damage may already be done. Thousands of credentials stolen, cloud workloads compromised, intellectual property exfiltrated. The risk isn’t just reputation or data loss—it’s the erosion of trust in how AI is integrated into software development and enterprise infrastructure.
What this means is clear: organizations must adopt AI-specific threat models. Securing models, prompts, developer tools, and pipelines is now as critical as patching CVEs. Collaboration between security, devops, and AI research teams should become standard. Guardrails and visibility aren’t just best practices—they’re necessities to stay ahead of adversaries who are learning to move faster than detection.
