Threat intelligence analysts at Google Cloud say they have observed one of the clearest examples yet of attackers letting artificial intelligence run an entire hacking operation largely on its own. In a campaign the researchers say unfolded from planning to execution in under six hours, an autonomous AI agent framework scanned for weaknesses, harvested credentials, and adapted to obstacles along the way with minimal ongoing input from a human operator — walking away with more than 23,800 stolen secrets, including cloud and AI-service API keys.

From AI-Assisted to AI-Run Attacks

Security researchers have spent the past couple of years warning about attackers using AI chatbots to write phishing emails or debug malware code. What Google Cloud describes is a step beyond that: a multi-agent system driven by preconfigured Markdown files that function as operational playbooks, orchestrated through a command-and-control framework the researchers have named “Recon.” Rather than a human directing each action, the setup paired an AI coding assistant with a prompt and a set of prepared instructions, then let the system scan for vulnerabilities, gather exposed credentials, troubleshoot its own errors, and rotate the internet-facing addresses it operated from — all while the human operator’s role shrank to occasional oversight.

Google Cloud frames this as part of “the wider move from simple AI prompts to autonomous workflows,” a trend the company’s threat intelligence team has been tracking as AI coding tools become more capable of multi-step, self-correcting task execution rather than single-shot code generation.

Speed and Scale

The numbers involved illustrate why defenders are increasingly worried about agentic attacks outpacing human-speed response. The entire operation — from initial planning through active exploitation — is reported to have taken less than six hours. In that window, the AI-driven system harvested more than 23,800 credentials and secrets, a haul that would typically require considerably more manual effort and time to achieve through traditional scanning and exploitation methods.

Adding to the difficulty of detection, the attackers reportedly abused a victim’s own cloud environment as a launch point, which let malicious traffic blend in and appear to originate from legitimate, trusted network addresses rather than obviously external infrastructure.

A Familiar Threat Actor, a New Method

Google Cloud connects this activity to a broader campaign it tracks as DUSTMAKER, attributed to a group identified as UNC6780 — also known in the industry as TeamPCP. That group has previously targeted AI development tools and CI/CD pipelines, suggesting a consistent interest in compromising the software supply chain and the infrastructure organizations use to build and deploy AI-powered applications. The use of autonomous agents in this case appears to represent an evolution in the group’s tradecraft rather than a one-off experiment.

What Organizations Should Do

Google Cloud’s threat intelligence team is urging organizations to treat this shift toward autonomous, agent-driven attacks as a call to tighten credential hygiene and monitoring, specifically recommending that defenders:

• Treat all cloud and AI-service API keys as high-value secrets requiring strict access controls, not routine configuration values
• Enforce least-privilege access so that a single exposed key cannot cascade into broader account or infrastructure compromise
• Rotate credentials immediately after any suspected exposure, rather than waiting for confirmation of misuse
• Monitor for unusual scanning activity and unexpected public exposure of internal services
• Closely review automated CI/CD and build workflows for unauthorized changes or unusual runner usage
• Set alerts for the creation of new service accounts and for large or unusual exports of secrets

As AI coding and agent frameworks continue to mature, researchers expect attackers to keep folding them into offensive operations — meaning the six-hour timeline documented here may soon look slow by comparison rather than alarmingly fast.