Attackers went from stolen cloud credentials to mass credential harvest in under six hours
Google's threat intelligence group logged that case in the second quarter of 2026, in the same report that counts distillation runs of more than 100 million prompts against its own generation models. Both started with compromised accounts.
The Board Room · Leadership desk
What happened
- Google also counted distillation campaigns of more than 100 million prompts against its audio, video and image generation models, run through proxy networks on thousands of compromised accounts.
- The NSA, FBI and CISA published an advisory accusing China-based AI labs of industrial-scale distillation against US frontier AI models.
- GTIG tracked a group it calls UNC6780 using several tactics to trick AI coding assistants and large language model security scanners as part of open source supply chain compromises.
Why it matters
- What it limits constraint A containment process whose first human approval arrives at the start of the next business day cannot act inside a window that closes in under six hours, so the authority to revoke cloud roles has to sit with the on-call engineer or with automation.
- What it costs cost When adversaries hijack enterprise cloud infrastructure to run unauthorized high-performance compute, the victim's account carries the bill for the attacker's inference.
- What it sets up precedent With three US agencies naming industrial-scale distillation, who holds downstream API access and how partner resale is controlled is now a policy question for enterprises as well as a live issue for the abuse teams at model vendors.
Next story · Security · Sep 30
Google traces most of 2026's exploitation growth to fast n-day weaponizationConfirmed4 publishers
The six-hour case turned on stolen credentials and a set of markdown files. Mandiant's investigators found a financially motivated actor using compromised cloud infrastructure credentials to stand up an autonomous multi-agent attack framework [2]. "Using preconfigured markdown instruction sets as operational playbooks, the threat actor conducted automated scanning and credential harvesting, compromising thousands of third-party credentials," the GTIG researchers said [8]. The agent instructions, they said, "enabled the AI to autonomously manage the vulnerability scanning pipeline, perform real-time troubleshooting, and execute Internet Protocol (IP) rotation logic without manual intervention" [3].
The window from cloud compromise to mass harvest ran under six hours [1]. Approval timing is the constraint: an escalation path whose first human decision to revoke a cloud role lands the next morning finishes after the campaign does.
GTIG says adversaries have moved from basic prompting to agentic workflows and automation, cutting human-in-the-loop latency on the attacker's side and compressing the traditional window for response [7].
The other number in the report is larger and slower. Google counted distillation campaigns involving more than 100 million prompts against its audio, video and image generation models, launched through proxy networks using thousands of compromised account credentials [10]. Divide one by the other: a thousand accounts would mean at least 100,000 prompts each, ten thousand accounts at least 10,000 each [17].
Ismael Valenzuela, VP of labs, threat research, and intelligence at Arctic Wolf, told CSO Online that these campaigns reach companies outside frontier AI: "Businesses not directly associated with frontier AI models may be tempted to disregard these campaigns as irrelevant due to them being a national security issue, but the exposure of model access to customers or partners makes API keys and service accounts valuable targets, with abuse of access to those models appearing as legitimate" [12].
Mandiant's second-quarter extortion work gives the inventory question a shape. Investigators saw data extortion groups steal AI models, skills, prompts, source code and related research [5]. In one breach at a healthcare organization, the attacker took drug research and other corporate data, including a proprietary AI model [13]. In another, attackers compromised an AI media generation company and took proprietary source code, prompts, skills, model scripts and secrets [14].
On direction, the record holds. On frequency, it is one case. Google's own summary and CSO Online's account describe the same intrusion [1][2], and the quarterly report draws on Mandiant incident response engagements, global threat actor tracking and live platform defenses [16]. One case at that speed is a demonstration. The choice it puts in front of a security owner this quarter is narrow: whether model weights, prompt libraries, service accounts and API keys sit on the asset register with a named owner, the way a production database does. GTIG says the activity reached AI labs along with government, military, healthcare and media organizations [6].
What to watch
- Whether GTIG's next quarterly tracker reports the six-hour agentic pattern more than once, which would turn a single case into a rate.
- Whether model providers publish account-level abuse thresholds or restrict resale of API access to customers and partners.
- Follow-through on the NSA, FBI and CISA distillation advisory, including whether specific labs or specific access channels are named.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption62
- Hype gap+15
- Incentives72
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In Q2 2026, GTIG observed threat actors compromise a cloud resource, then plan, build and execute an agent-enabled mass credential harvesting campaign in under six hours.
- [2]
Mandiant observed a financially motivated threat actor use compromised cloud infrastructure credentials to deploy an autonomous multi-agent attack framework, which enabled the attacker to plan, build and execute a mass credential harvesting campaign in less than 6 hours.
- [3]
GTIG researchers said the agent instructions "enabled the AI to autonomously manage the vulnerability scanning pipeline, perform real-time troubleshooting, and execute Internet Protocol (IP) rotation logic without manual intervention".
- [4]
GTIG says enterprise AI assets, from model weights to cloud compute quotas, are high-value targets for espionage, extortion and resource theft, with adversaries targeting proprietary AI models and source code, exfiltrating API credentials, and co-opting victim cloud environments to sustain unauthorized AI workloads.
- [5]
During the second quarter of 2026, Google's Mandiant incident response arm investigated breaches by data extortion groups that involved theft of AI models, skills, prompts, source code and related research.
- [6]
The threat activity did not affect just AI labs, but also government, military, healthcare and media organizations that might train or fine-tune their own models.
- [7]
Since its May 2026 report, Google Threat Intelligence Group has observed forward leaning adversaries transition from basic prompting to agentic AI workflows and AI-enabled automation, dramatically reducing human-in-the-loop latency and compressing the traditional window for defenders to respond.
- [8]
"Using preconfigured markdown instruction sets as operational playbooks, the threat actor conducted automated scanning and credential harvesting, compromising thousands of third-party credentials," the researchers said.
- [9]
To circumvent access costs, adversaries are stealing developer credentials, purchasing compromised AI platform accounts, and hijacking enterprise cloud infrastructure to run unauthorized high-performance compute workloads.
- [10]
Google observed model distillation campaigns involving more than 100 million prompts targeting its audio, video and image generation capabilities, launched through proxy networks using thousands of compromised account credentials.
- [11]
The US National Security Agency, the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency published an advisory accusing China-based AI labs of engaging in industrial-scale distillation against US frontier AI models.
- [12]
"Businesses not directly associated with frontier AI models may be tempted to disregard these campaigns as irrelevant due to them being a national security issue, but the exposure of model access to customers or partners makes API keys and service accounts valuable targets, with abuse of access to those models appearing as legitimate," Ismael Valenzuela, VP of labs, threat research, and intelligence at Arctic Wolf, told CSO.
- [13]
In one case, a threat actor breached a healthcare organization and stole drug research and other corporate data, including a proprietary AI model.
- [14]
In a separate incident, attackers compromised an AI media generation company and stole proprietary source code, prompts, skills, model scripts and secrets.
- [15]
GTIG tracked UNC6780 using multiple tactics to trick AI coding assistants and large language model security scanners into its open source software supply chain compromises.
- [16]
The GTIG report is grounded in telemetry from frontline Mandiant incident response engagements, global threat actor tracking and live platform defenses.
- [17]
More than 100 million prompts spread across thousands of compromised accounts implies at least 100,000 prompts per account if 1,000 accounts were used, and at least 10,000 per account if 10,000 were used.
Sources
2 independent publishers whose own reporting we read for this story.
- cloud.google.comGTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI | Google Cloud Blog
1 article · September 16, 2026
- csoonline.comThreat actors are coming for your AI assets to operationalize their use of AI | CSO Online
1 article · September 16, 2026