AI Agents Ran a Credential Attack in Six Hours—Defenders Lose Reaction Time

On September 8, 2026, Google Threat Intelligence Group published a report describing a Q2 incident in which a suspected financially motivated attacker compromised an organization’s cloud infrastructure, then used an autonomous multi-agent framework to plan, build and execute mass credential harvesting in less than six hours. According to the GTIG incident account, the framework scanned for vulnerabilities, adapted to operational failures, rotated IP addresses and compromised thousands of third-party credentials.

BleepingComputer’s September 8 report describes the same Q2 campaign and its six-hour duration, but the underlying evidence remains Google’s private incident-response telemetry rather than an independently published forensic record. The defensible conclusion is therefore specific: agents accelerated several connected stages after cloud access had already been obtained, shortening the time available for defenders to correlate signals and authorize containment.

The six-hour timeline begins after the cloud compromise

The disclosed duration is not a complete intrusion timeline. It covers planning, construction and execution of the credential-harvesting campaign after the attacker had compromised a cloud resource; the public account does not say how the initial access occurred or how long it took.

1. Cloud foothold: the attacker operated from victim infrastructure, allowing attack traffic to use legitimate IP addresses. The relevant defensive evidence is a workload or service identity behaving outside its normal role, especially when it creates jobs, accesses new secrets or changes network activity.
2. Framework preparation: an AI coding chatbot, a prompt and preconfigured Markdown instructions became the operational framework. Build logs, new files, container launches and AI-service audit records may expose this transition if the environment records them.
3. Automated operation: agents managed vulnerability scanning, credential harvesting, troubleshooting and IP rotation without manual intervention at each step. Correlated workload, egress and authentication telemetry matters more here than any single alert.
4. Credential impact: the campaign produced thousands of compromised third-party credentials in Google’s assessment. The public report does not identify the credential types, affected organizations or number of subsequent account intrusions.

No exact timestamp is available for any individual phase, so the evidence does not support dividing the six hours into invented minute-by-minute intervals. What it establishes is an uninterrupted sequence in which automation could recover from errors and continue operating while a human-led response process was still escalating.

Agents removed the pauses defenders often rely on

The novelty is orchestration, not a new category of credential theft. Scanners, scripts and IP rotation already existed, but the multi-agent framework connected those functions and handled changing conditions without waiting for an operator to diagnose every failure.

That makes alert correlation a timing control. A cloud identity that creates tooling, begins broad outbound scanning and changes egress patterns in rapid succession presents a different risk from three unrelated events reviewed in separate queues. Detection systems need to preserve that sequence and raise its priority while the activity is still in progress.

The first enforceable gate belongs between cloud access and campaign execution. Newly created credentials, privilege changes, access to secret stores and expansion of network reach can be subjected to short lifetimes, narrow scopes or policy checks. Those measures do not identify an AI agent by themselves; they limit what any compromised workload can do before additional authorization is granted.

Identity containment must beat the harvesting cycle

Once harvesting starts, defenders need visibility at both ends of the operation: the cloud workload generating traffic and the authentication systems receiving credential attempts. Useful correlations include a sudden increase in outbound probes, access attempts across many identities, token use from an unfamiliar workload and successful authentication followed by secret discovery or privilege changes.

The operational metric is elapsed time from the first high-confidence correlated signal to revocation or isolation. If an alert waits for sequential triage, ownership checks, management escalation and a manually scheduled response, those steps can consume much of a campaign that completes in under six hours.

Containment can be accelerated without giving automation unlimited authority. Predefined conditions can suspend a short-lived token, restrict a workload’s egress or require fresh approval for privileged operations, while destructive actions remain auditable and reversible. Phishing-resistant authentication can reduce the value of captured passwords, but machine credentials also need restricted scope, rapid revocation and separation from production secrets.

The supply-chain activity was a separate campaign

The report also discusses UNC6780, which Google tracks as TeamPCP, but that activity should not be merged with the unnamed six-hour incident. The Register’s account of Google’s findings describes the group’s compromises across PyPI, npm and Docker Hub, as well as techniques aimed at AI coding assistants and large-language-model security scanners.

The connection is defensive rather than attributive. Repository instructions, dependencies and hidden project files can influence an automated development workflow before a person examines the result. The corresponding boundary sits where untrusted repository content meets build credentials, CI/CD tokens or deployment rights.

Dependency provenance, records of package resolution and approval before a build receives production secrets can interrupt that route. AI-assisted jobs should receive task-specific credentials instead of inheriting a developer’s complete access, and repository-supplied instructions should not be able to expand those permissions on their own.

The evidence supports urgency, not a fully autonomous cyberwar

The public record does not identify the victim, attacker, initial-access method, affected services, indicators of compromise or exact phase timings. It also does not establish that every harvested credential led to a successful downstream intrusion. The suspected financial motive and the scale of credential compromise remain GTIG assessments based on evidence that has not been released for outside examination.

The same reporting distinguishes this incident from a fully autonomous, end-to-end pipeline that independently discovers unknown vulnerabilities and completes an entire intrusion. What has been documented is narrower but operationally important: after attackers obtained cloud access, agents kept a multi-stage credential campaign moving quickly enough to challenge response procedures built around human pauses.

Until the victim, infrastructure indicators or additional forensic data are disclosed, attribution cannot be independently tested. The immediate consequence is nevertheless concrete: cloud, identity and supply-chain controls must detect connected behavior and enforce bounded stops during the attack sequence, not only after a conventional incident-response cycle has assembled the full picture.

Also read:

• Researchers Stirred Up Chaos for AI Agents—And Watched Them Lose Their Minds in Record Time. Spoiler: It Was Brutal.
• Autonomous AI Agents Breach Hugging Face in First-of-Its-Kind Attack; U.S. Considers FINRA-Style Oversight Body for Frontier Models
• How to Back Up Google Authenticator Before You Lose or Replace Your Phone