Cyberattackers are now using sophisticated artificial intelligence (AI) frameworks to automate every stage of their attacks, including credential theft on a massive scale. According to a report from the Google Threat Intelligence Group (GTIG), threat actors have moved beyond simple AI-powered coding assistants and are instead integrating multiple AI capabilities into their attack workflows.
These multi-agent frameworks can coordinate multiple tasks, troubleshoot failures, and adapt their actions with minimal human intervention. This shift towards more autonomous systems has significant implications for cybersecurity defenders, as it reduces the “human-in-the-loop” latency and response windows that they have to work with.
In one notable incident, a financially motivated attacker compromised an organization’s cloud infrastructure and deployed an autonomous multi-agent framework. Within six hours, the threat actor had planned, built, and deployed a mass credential-harvesting campaign using an AI coding chatbot, a prompt, and markdown agent instructions. The AI agents managed the vulnerability-scanning pipeline, harvested thousands of third-party credentials, and troubleshot problems in real time.
This approach has been observed in other incidents as well. For example, researchers found an exposed command-and-control (C2) server hosting an automated reconnaissance and credential-management framework called “Recon.” Its files included instructions for AI agents, knowledge files, and OpenClaw artifacts related to the framework that managed in real-time more than 23,800 harvested secrets.
The use of AI in cyberattacks is not limited to credential theft. State-backed groups continue to use AI for reconnaissance, phishing, malware development, exploitation, post-exploitation, data processing, and propaganda. In fact, once attackers have valid credentials, only 37% of their actions are blocked, highlighting the need for improved defenses.
The report notes that while fully autonomous hacking has not become widespread yet, threat actors are increasingly experimenting with AI-powered development tools to build automated exploitation and post-exploitation pipelines. This trend is expected to continue, making it even more challenging for defenders to detect and respond to attacks in a timely manner.
In response to these emerging threats, Google’s Gemini model has proven effective in catching many of these abuses early and responding accordingly. However, this highlights the need for cybersecurity professionals to stay vigilant and adapt their defenses to keep pace with the evolving threat landscape.
To mitigate the risks associated with AI-powered attacks, it is essential for organizations to implement robust defense strategies that include multi-factor authentication, regular security updates, and continuous monitoring of their systems and networks. Additionally, education and awareness programs can help employees understand the risks associated with AI-powered attacks and how to identify potential threats.
Source: Bleeping Computer — 2026-09-08