AI Agents Harvested Thousands of Credentials in Under Six Hours

The gap between "we found a way in" and "we have thousands of your credentials" used to be measured in days of patient, manual work. On September 8, Google's Threat Intelligence Group published a report describing a case where that gap was under six hours — and most of the work in between was done by AI agents, not people. This is not a benchmark result or a red-team demo. It is Mandiant incident data on a real financially motivated actor, and it moves the "AI does the attacking" story from proof-of-concept into the operational column.

What Google's GTIG actually observed

In its report From Prompting to Autonomy: The Evolution of Adversarial AI, GTIG describes a suspected financially motivated actor that compromised an organization's cloud infrastructure and then, from inside it, deployed an autonomous, multi-agent attack framework. In GTIG's words, this "allowed the attacker to operate at a scale and velocity typically associated with larger and more resource-heavy groups."

The mechanics are worth reading closely, because they are mundane in a way that makes them repeatable:

• The operator started with an AI coding chatbot, a prompt, and a set of agent instructions — effectively a markdown playbook — and used it to plan, build, and execute the campaign.
• The agent instructions let the AI autonomously manage the vulnerability-scanning pipeline and perform real-time troubleshooting when something broke, with no operator babysitting each step.
• The framework executed IP-rotation logic without manual intervention, and because it ran from the victim's own cloud, it routed attack traffic through legitimate IP addresses the target already trusted.
• End state: thousands of third-party credentials compromised, in under six hours, start to finish.

The Hacker News and BleepingComputer both covered the report; the throughline in every write-up is the same phrase GTIG keeps returning to — the campaign "dramatically reduced human-in-the-loop latency."

From prompting to autonomy — the arc that matters

Read the title of the report as a timeline. A year ago, GTIG's earlier reporting on adversarial AI documented threat actors using models the way everyone else does: draft a phishing lure, translate a ransom note, ask for a snippet of PowerShell. That was prompting — a human in the chair, copying answers out of a chat window.

The September report documents the next rung: agentic use, where the model is handed a goal and a loop and left to run. The distinction is not academic. When a human drives, the operation moves at human speed and every branch is a decision someone has to make. When an agent drives, the branches are code, and the operation moves at the speed of the API.

GTIG is careful — more careful than most of the coverage — about how far this has gone:

"While recent model security incident disclosures demonstrate that frontier models can autonomously identify zero-days and execute network intrusions, GTIG has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild."

That caveat is the honest center of the story. What GTIG saw is a gradual maturation: adversaries "layering AI capabilities" onto tradecraft they already had, using commercial and open-weight models to accelerate the conversion of public disclosures and patch delays into working n-day exploit code, and moving "from basic script generation and logic flaw identification toward constructing functional, multi-stage exploit chains." Nobody has yet fielded a fire-and-forget machine that picks its own targets and breaches them unattended. But the credential-harvesting case shows how little of the loop still needs a human, and how fast the remaining humans can move once the boring parts are automated.

Why "six hours" is the number defenders should fear

The instinct is to fixate on the credential count. The number that actually reshapes your threat model is the clock. Defensive economics have always leaned on the fact that attacks take time — time to set up infrastructure, time to scan, time to triage results, time to pivot when a scanner throws an error at 2 a.m. and the operator is asleep. Every one of those delays is a window a defender can act inside.

An agentic framework shrinks those windows toward zero, and it does so unevenly across the kill chain:

Phase	Traditional human crew	Agentic framework (per GTIG)
Tooling + framework build	days	one prompt, minutes
Scan pipeline management	manual, shift-limited	autonomous, continuous
Troubleshooting a broken step	waits for an operator	real-time, in-loop
IP rotation / evasion	scripted, supervised	executed without intervention
Credentials at scale	variable, hands-on	thousands in under 6h

The operational consequence is that the detection-to-containment budget most SOCs quietly assume — the hours between a scan showing up in the logs and an analyst getting to it — is now larger than the entire attack. If your mean time to notice is measured in days, an agentic credential campaign is finished, its loot fenced, and its cloud foothold repurposed before your first ticket is triaged.

There is a second-order effect the report names directly: the actor ran from the victim's cloud, through legitimate IPs. Reputation-based and geo-based blocking — a large fraction of what perimeter tooling actually does — is blind to traffic that originates inside a trusted tenant. The evasion here isn't clever malware; it's an address book you already whitelisted.

The other half: malware that attacks the AI in your pipeline

The credential campaign is the headline, but the same report documents the flip side of agentic tradecraft — malware built to subvert the AI tooling defenders and developers now rely on. The clearest specimen is DUSTMAKER, a cross-platform credential stealer tuned for CI/CD environments. What it does is a preview of where supply-chain attacks are heading:

• It reads OIDC tokens straight out of the GitHub Actions runner's process memory, then uses them to publish poisoned packages carrying valid SLSA Build L3 provenance attestations — signed, attested, and trusted by every downstream consumer. If you think a green provenance check means the artifact is clean, we wrote about exactly this failure mode months ago: signed is not safe.
• It drops payloads into hidden agent-config directories — .claude/, .cursor/, .vscode/ — and uses prompt injection inside those config files to instruct the developer's AI assistant to run arbitrary commands, turning the coding agent into the malware's own executor.
• Its JavaScript loaders embed adversarial prompts aimed at LLM-based security scanners, so the automated review step that was supposed to catch it is talked out of flagging it.

That is the part worth sitting with: the attacker is not only using AI to move faster, it is targeting the AI you deployed to defend yourself. A security scanner that reads attacker-controlled text and acts on it is a confused deputy with a language model bolted on. GTIG also tracked actors like UNC6780 (TeamPCP) doing this at the ecosystem level — tricking AI coding assistants and LLM scanners into waving through open-source supply-chain compromises.

Defending against agentic attack campaigns

There is no single patch here, because there is no single CVE — this is a tradecraft shift, and the defenses are architectural. Concrete first moves:

1. Treat every credential as short-lived. The campaign's whole value was the thousands of reusable secrets it collected. Aggressively scope and rotate API keys, prefer workload identity federation over long-lived tokens, and put a hard TTL on anything an agent could scrape. A credential that expires in an hour is worth little to a six-hour campaign.
2. Watch egress from your own cloud, not just ingress to it. The actor operated from a trusted tenant. Behavioral egress monitoring — a host that historically only ingests suddenly fanning out scans, a workload beaconing to never-seen infrastructure, sustained credential-shaped requests to third parties — is the surface that catches this. Reputation lists will not.
3. Assume your AI tooling is an attack surface. Sandbox what coding agents can execute, treat repository config files (.claude/, .cursor/, .vscode/) as untrusted input, and never let an LLM security scanner take an action based solely on text it read from the artifact under review.
4. Do not trust provenance as a clean-bill. SLSA attestations prove where a build ran, not that its inputs were honest. Pair provenance with behavioral analysis of what the package actually does on install.
5. Compress your own response loop. The uncomfortable truth of the six-hour number is that quarterly pentests and next-morning SIEM digests are now slower than the attack. If the offense runs continuously, the defense has to as well.

The uncomfortable symmetry: testing an autonomous attacker

That last point is where the honest conclusion lands, and it is not a comfortable one for the annual-pentest model. You cannot meaningfully rehearse against a machine that builds a campaign in six hours by scheduling a human consultant for two weeks next quarter. The tempo has to match.

This is the problem Zero Hunt was built around, because the answer to an autonomous multi-agent attacker is an autonomous multi-agent validator running on the same clock. Zero Hunt's engine is a 10-agent AI swarm — Recon, Exploit, Web, Credential, Post-Exploit, Pivot, Tactic and Report agents under an AI Controller — that coordinates the way the GTIG framework did, except pointed at your own perimeter with your authorization. It writes per-target exploit code with a local LLM rather than replaying ExploitDB, and every new skill is backtested in the AI Gym (316/317 Vulhub exercises, the NYU CTF and Vulhub-Bench corpora) before it touches a production engagement. Crucially, its change-triggered campaigns fire a full assessment within the hour of a new asset appearing on the perimeter — the same collapse of the response window, working for you instead of against you. And because it runs 100% on-prem against a local model, you are not shipping your attack surface off to the commercial frontier models the report shows adversaries querying for exploit code.

The credential-harvesting half has a traffic answer too. Zero Hunt's AI Traffic Analysis model — four inference heads over billions of PCAP sequences, at 2.7+ Gbit/s on the appliance GPU — reads the behavior of a harvesting run: the scan fan-out, the credential-shaped egress, the IP-rotation cadence, the sudden outbound from a host that only ever ingested. It does this on the wire, while it is happening, which is the only place that traffic routed through your own trusted cloud IPs is still honest. Reputation blocking sees a whitelisted address; the model sees a workload doing something it has never done before.

Six hours is not a number you out-staff. It is a number you out-tempo, or you lose the race before you know it started.