AI Agents Ran a Mass Credential Attack in Under 6 Hours, Google Says

TL;DR

Google's Threat Intelligence Group published its Q3 2026 AI Threat Tracker on 8 September. Mandiant watched an attacker "plan, build, and execute a mass credential harvesting campaign in less than six hours."

The agent ran itself. Instructions let it "autonomously manage the vulnerability scanning pipeline, perform real-time troubleshooting, and execute Internet Protocol (IP) rotation logic without manual intervention."

One exposed control panel was managing "over 23,800 harvested secrets in real time", including API keys for cloud and AI services.

Stolen model access is now a priced market. Underground "prices per account more than doubling in 2026", with demand concentrated on Claude and Gemini credentials.

Two days earlier we reported three labs putting their best cyber models behind vetting programmes. The gate controls the sale. It does not control the use.

What did Google actually observe?

An attack that a small team could not have run last year, run by what looks like a small team.

GTIG's Q3 2026 tracker describes "a suspected financially motivated threat actor compromise an organization's cloud infrastructure to deploy an autonomous, multi-agent attack framework, which allowed the attacker to operate at a scale and velocity typically associated with larger and more resource-heavy groups."

The inputs were modest: "an AI coding chatbot, a prompt, and a set of agent instructions." The output was a mass credential harvesting campaign, live, in under six hours.

The instruction format is the detail worth pausing on. GTIG describes "preconfigured markdown instruction sets as operational playbooks." Not custom malware. Markdown files.

Why does six hours matter more than it sounds?

Because of what it fits inside.

A security operations team typically works in shifts. Six hours fits inside a single 8-hour rotation. The entire lifecycle, from the initial cloud compromise through building the framework to running the campaign at scale, completes without a shift handover, without a morning stand-up, and without anyone arriving to a queue that looks different from yesterday's.

GTIG names the mechanism directly: the agent instructions ran "without manual intervention, significantly reducing the human-in-the-loop latency." That phrase is doing quiet work. The human is still there. What has been removed is the pause between one step and the next, and that pause was most of what gave defenders time.

How much output is that, really?

Enough that the arithmetic is worth doing, with the imprecision stated.

GTIG reports the six-hour run "compromising thousands of third-party credentials." Separately, it found an exposed command-and-control server whose dashboard was organising "over 23,800 harvested secrets in real time."

Bound the vague word and the two numbers connect:

if "thousands" is 2,000 23,800 / 2,000 ≈ 12 runs

if "thousands" is 5,000 23,800 / 5,000 ≈ 5 runs

5 to 12 runs x 6 hours

= 30 to 72 hours of machine time

A stockpile of nearly 24,000 secrets is on the order of one working week of runtime. That is a bound, not a measurement, and the two figures come from different incidents in the same report. But the order of magnitude is the point: this is not a campaign that needed a year, a budget or a staff.

The exposed server also left its own configuration visible: AGENTS.md, KNOWLEDGE.md, agentic_vuln_research.md, and directories named .openclaw/ and memory/. Attack tooling now has the file layout of an ordinary agent project, because that is what it is.

Who is doing this?

Named groups, moving up the stack rather than sideways.

GTIG describes BASIN CASTLE, a PRC-nexus espionage group previously tracked as BASIN and TEMP.Hex, that "has integrated generative AI across successive phases of the attack lifecycle". Not one phase. The report walks through four:

Phase. What the model was used for

Initial reconnaissance. "Identification of specific high-profile individuals for targeting"

Initial compromise. Generating and localising lure content, including translating Chinese into formal English diplomatic reports for spear-phishing

Establish foothold. Evasion and obfuscation, including "dynamic API resolution via PEB parsing, rolling XOR encryption of C2 IP addresses"

Internal reconnaissance. Troubleshooting PowerShell errors during Active Directory discovery

A separate PRC-nexus group went further and tried to build the tool itself: "an agentic architecture capable of observing target state, reasoning through actions, and executing tasks in unpredictable environments." GTIG says that one did not get built, and that it "took action against these actors by disabling the assets associated with this activity."

That last sentence is the good news in the report, and it is also the shape of the defence: the model provider caught it because the work happened on the model provider's platform.

The market number nobody is quoting

There is one figure in this report that behaves like an economic indicator, and it is being skipped in the coverage.

GTIG tracks underground forums and reports that buyer demand "concentrat[es] heavily on purchasing Claude and Gemini credentials, alongside rising demand for autonomous coding IDEs like Cursor Pro and Devin, reflected in average underground marketplace prices per account more than doubling in 2026."

A price that more than doubles in a year, with demand rising, means demand outran supply. More buyers than stolen accounts. That is a market telling you what frontier model access is worth to someone who intends to misuse it, and it is the only number in this space that is set by attackers rather than estimated by defenders.

Set it beside the other scale figure in the same report: distillation campaigns against Google's models, "some exceeding 100 million prompts", aimed at extracting model logic and chain-of-thought. One hundred million prompts is not a researcher. It is a programme.

What this does to the story we ran on Monday

It inverts it, and the inversion is the finding.

Two days ago we wrote that three labs shipped cyber-capable models and gated every one of them. Anthropic's verification programmes, Google's Fairwind, OpenAI's Daybreak Blue. Nothing self-serve, applications only, US-scoped in one case.

Read that against this week's threat report and the picture completes.

Defenders apply. Attackers buy. The vetting programmes control who is sold access. They do not control who obtains it, because the route this report documents is credential theft into a market with doubling prices. A gate on the front door is a real control against one thing and no control at all against the other.

That is not an argument against the gates. It is an argument that the gate is not the whole control, and anyone treating "we cannot get the model, so neither can they" as a security assumption has it backwards.

What should a security or platform team do this week?

Treat your AI credentials as production secrets, because a market prices them that way. API keys for cloud and AI services were exactly what the exposed dashboard was hoarding. Rotate them on a schedule, scope them tightly, and alarm on use from an unexpected region.

Watch for your own tooling running somewhere you did not put it. GTIG describes attackers who "co-opt victim cloud environments to sustain unauthorized AI workloads." That shows up as a cost anomaly before it shows up as a security alert, and finance often sees it first.

Assume the attack completes inside one shift. Controls that depend on a person noticing, escalating and deciding are now competing with a loop that has had the human latency removed. Anything gated on business hours is gated on a window the attacker does not need.

Log egress from your agents, not just their outcomes. The same lesson the OpenAI wiki incident produced yesterday applies from the other direction: an action log shows tasks completed, not where the traffic went.

FAQ

Was this attack using a jailbroken model?

GTIG describes the use of "an AI coding chatbot, a prompt, and a set of agent instructions." The report frames the significance as the automation and the speed, not a novel bypass.

Are the six-hour campaign and the 23,800 secrets the same incident?

No. They are separate observations in the same quarterly report. The comparison above is an order-of-magnitude bound, not a claim that one produced the other.

Did Google stop the penetration-testing framework?

For that specific case, yes. GTIG says the activity "was limited to attempts to build the framework" and that it disabled the associated assets.

What is model distillation in this context?

Adversaries attempting to extract proprietary model logic, reasoning capability and chain-of-thought by querying a model at very large volume. GTIG reports coordinated campaigns "some exceeding 100 million prompts".

Does this affect an ordinary business, or only large targets?

The credentials harvested were third-party. Being small does not remove you from a scanning pipeline that costs its operator nothing to point at everyone.

The last mile

The striking thing in this report is not sophistication. It is ordinariness. Markdown playbooks. A coding chatbot. A dashboard. Directories called memory/.

The attackers are doing what every enterprise AI programme is trying to do, which is get an agent to run a multi-step process reliably without a person in the middle. They appear to be further along, and the reason is not better technology. It is that they have no change board, no compliance review and no tolerance for a pilot that never ships.

The defensive answer is not a better model, which is gated anyway. It is knowing, at any moment, what your own agents are doing, which credentials they hold, where their traffic goes and what it costs. That is instrumentation of the systems a business already runs on, and it is the layer Cognilium works in. It is also, on the evidence of this report, the difference between finding out in six hours and finding out in six weeks.