Attackers start using AI Agents for work: harvesting thousands of credentials in 6 hours

On 8 September, Google Threat Intelligence Group (GTIG) released a report titled "From Prompting to Autonomy: The Evolution of Adversarial AI". The report disclosed that the financially motivated group UNC6780, after compromising a cloud environment, used an AI programming chatbot along with preset Agent instructions to complete large-scale credential harvesting in less than 6 hours. Multi-Agents automatically executed vulnerability scanning, real-time troubleshooting, and IP rotation throughout the process without requiring step-by-step human intervention. GTIG Chief Analyst John Hultquist's assessment was straightforward: attackers naturally choose attack methods that are faster than defenders can respond.

I. What Happened in 6 Hours

This is the most vivid segment in the GTIG report: after gaining a foothold in the cloud environment, the attackers did not manually write scripts, try one by one, and manually troubleshoot errors as in the past. They initiated a multi-Agent workflow—one Agent responsible for vulnerability scanning, another handling real-time troubleshooting, and a third automatically rotating IP addresses. The traffic originated from the victim's own cloud address, making it appear no different from normal business traffic.

It took less than 6 hours from compromise to establishing large-scale credential harvesting capabilities. Post-incident investigations by the Google Threat Intelligence Group confirmed that thousands of third-party credentials were obtained.

II. Who is UNC6780

UNC6780 (tracking ID TeamPCP) is a financially motivated threat group. Since March 2026, the group has been launching poisoned packages on a large scale across PyPI, npm, and Docker Hub. They release trojanised forks of Model Context Protocol (MCP) servers and inject malicious code into GitHub repositories that AI programming assistants are likely to clone.

Their credential stealer DUSTMAKER has a key design feature: it drops or modifies malicious files in hidden project directories of AI programming tools and IDEs, with paths including .claude, .vscode, and .cursor. These directories are naturally part of developers' daily workflows; with malicious files mixed inside them, it is extremely difficult to trigger any alarm.

III. How Attackers Bypass AI Security Scanning

Some loaders of DUSTMAKER embed prompt injection text in the form of comments at the top of JavaScript code, with content involving extreme biological and nuclear weapons topics. GTIG assesses that the attackers' intention is to make LLM-based security scanners reject or skip the analysis of the malicious code below.

This is a two-way game: defenders use AI to scan malicious code, while attackers use prompt injection to blind AI scanners. Google stated that Gemini's security response mechanism was triggered in related activities, subsequently leading to broader disruption.

The group also hijacks workspace configurations to achieve persistence, pushing prompt injection instructions to get AI assistants to run attacker scripts, creating CI/CD tasks named after AI, while deleting workflow logs.

IV. AI Itself Becomes the Booty

The GTIG report also records a trend change: attackers are starting to target enterprises' proprietary AI assets themselves as high-value goals. The Google Threat Intelligence Group investigated multiple data theft extortion cases in Q2, where attackers stole models, Skills, prompts, source code, and research findings from tech, healthcare, and media companies in North America and Europe. In an intrusion within the healthcare sector, drug research data and proprietary models were taken and used as leverage for extortion.

The underground market is keeping pace. GTIG data shows that throughout 2026, demand for Claude and Gemini accounts, as well as programming IDEs such as Cursor Pro and Devin, continued to rise, with average prices more than doubling. Info-stealers are now also specifically targeting the configuration storage directories of AI assistants—where plaintext API keys are often stored.

V. How Enterprises Should Respond

GTIG's practical advice for defenders can be summarised into four points:

1. Assume that AI Agents are already in the attackers' toolkit: Stop asking "will someone use AI to attack me". UNC6780 has already used them in real-world attacks; defence detection rules must be designed at machine speed, and can no longer rely on human-paced playbooks.

2. Treat the AI programming supply chain as a high-risk surface: AI tool configuration directories such as .claude, .cursor, and .vscode need to be included in the monitoring scope. AI-generated tasks in CI/CD pipelines must be audited, and logs must not be automatically deleted.

3. API key and credential management: Plaintext API keys in AI assistant configuration storage are new targets of attack. Use key management services, rotate them regularly, and monitor abnormal AI API call volumes.

4. GPU resource usage monitoring: If unauthorised high-performance GPU instances or AI workloads appear in cloud environments, this is a signal that AI assets are being misappropriated. Establish anomaly detection baselines for GPU resources.

VI. Cyritex's Anti-AI Attack Capabilities

When attackers start using AI Agents to speed up attacks, defenders also need to use AI to match the speed of their opponents. Cyritex's closed-loop security operations cover the entire chain from discovery to validation to response.

CyriIntel, Cyritex's Advanced Persistent Threat Intelligence Smart Platform integrates 30+ global intelligence sources to continuously track more than 900 APT groups and ransomware syndicates. At the AI attack level, the platform has tracked 350,725 malicious AI Skills (as of August 2026, with a malicious rate of approximately 20%), covering 15 artifact types including npm, PyPI, Maven, and Go. Techniques used by groups like UNC6780, such as MCP server poisoning and AI tool directory persistence, are all within the scope of our intelligence monitoring.

CyriGate, Cyritex's Software Supply Chain Anti-Poisoning Smart Gateway covers 623,400+ threat records and monitors 2,032,940+ AI Skills in real-time, establishing real-time interception across three lines of defence: developer workstations, CI/CD pipelines, and AI programming tools. Local queries take <5ms, cloud backup takes <2s, and intelligence is ingested within T+6 hours. When poisoned packages such as DUSTMAKER attempt to enter the development environment, they are blocked before landing.

CyriBAS, the Smart Security Validation Platform CyriAI transforms real threat intelligence into harmless attack playbooks in real-world environments. When attackers initiate multi-step attacks using AI Agents, security teams can use automated validation to test whether their detection and response capabilities can keep up with machine speed.

Last week, we wrote about AI Agents being poisoned by external content (llms.txt attacks). This week, Google GTIG's report fills in the other side: attackers are not just exploiting AI Agents, they are beginning to manipulate AI Agents themselves to accelerate attacks. Both the offensive and defensive sides are adopting AI, compressing the time gap from "days" to "hours". Defenders' detection and response tempos need to match this new speed benchmark.

Reference Sources

[1] Google Threat Intelligence Group, "From Prompting to Autonomy: The Evolution of Adversarial AI", 2026-09-08

[2] Google Threat Intelligence Group — UNC6780/TeamPCP Campaign Analysis, Q2 2026

[3] GTIG Chief Analyst John Hultquist public comments, 2026-09

Cyritex · Intelligence-driven operations, AI-built closed loop