GTIG Q2 2026 Report: Attackers Now Run Agentic Workflows
The Short Answer
Google Threat Intelligence Group’s AI Threat Tracker: From Prompting to Autonomy (published September 8, 2026, covering Q2 2026) documents the shift its title describes: adversaries who used to ask a chatbot for help are now running agentic workflows that plan, execute, troubleshoot and iterate with minimal human involvement — compressing the window defenders have to respond. The report draws on Mandiant incident response, threat-actor tracking and Google’s own platform defences.
Five Q2 2026 trends, in GTIG’s words:
- Expanding software supply-chain risk — attackers target developers, AI coding assistants and LLM security scanners.
- Targeting proprietary AI IP — models, code, prompts and research, in healthcare, government and media.
- Shift toward agentic AI and automation — multi-agent frameworks that run scanning pipelines, fix their own errors and harvest credentials at scale.
- Multi-stage lifecycle augmentation — AI as force multiplier from reconnaissance to post-exploitation, plus information-operations scaling.
- Illicit account procurement and LLMjacking — stolen developer credentials, purchased AI accounts, hijacked enterprise cloud for compute.
The six-hour credential heist
The case that defines the report: a suspected financially motivated actor compromised an organisation’s cloud infrastructure, then deployed an autonomous multi-agent framework there. Using an AI coding chatbot, a prompt and a set of preconfigured markdown instruction files as operational playbooks, the actor planned, built and executed a mass credential-harvesting campaign in under six hours, compromising thousands of third-party credentials. The agent instructions let the AI manage the vulnerability-scanning pipeline, troubleshoot in real time and run IP-rotation logic without a human — and because it ran from the victim’s cloud, attack traffic came from legitimate IP addresses.
A related find: an exposed command-and-control server hosting a framework dubbed “Recon,” whose directory listing showed AGENTS.md, KNOWLEDGE.md, agentic_vuln_research.md, a .openclaw/ directory and memory/ — i.e. a standard open-source agent harness repurposed for offence. It later became a live dashboard managing over 23,800 harvested secrets, including cloud and AI API keys. GTIG calls this the transition “from passive, endpoint-focused infostealers to offensive agentic harvesting.”
UNC6780: attacking the coding agents themselves
The supply-chain section is the most directly relevant to anyone running Claude Code, Cursor, Codex or OpenHands. UNC6780 (TeamPCP), financially motivated and active since March 2026 against PyPI, npm and Docker Hub, has built AI-specific tradecraft into its DUSTMAKER credential stealer:
| Technique | What it does |
|---|---|
| Trojanised MCP servers | Compromised dev accounts publish backdoored forks (e.g. tiktoken_mcp) to PyPI and inject code into official repos (e.g. azure-functions-mcp-extension), so payloads and malicious workspace hooks are ingested on clone |
| Hidden-directory persistence | Drops files into .claude/, .cursor/, .vscode/ — folders EDR watches less closely than registry keys or cron |
| Config hijacking | Uses those files to create build/startup commands that run when the IDE or AI extension opens the workspace |
| Prompt injection of the agent | Malicious config instructs the coding assistant to run scripts such as setup.mjs during routine work |
| CI/CD token theft | Detects GitHub Actions, extracts OIDC tokens from runner memory, publishes compromised packages with valid SLSA Build 3 attestations — which pass AI coding agents’ automated trust checks |
| Masquerading | Creates pipeline tasks named things like “Copilot Setup”, then deletes workflow logs via API |
| Defeating LLM scanners | Embeds bio/nuclear-weapons text as comments atop loader scripts so LLM security scanners refuse and skip analysis |
GTIG’s assessment: AI-assisted coding has increased the volume of open-source packages and the speed of development, “likely resulting in reduced scrutiny of third-party packages,” and contributed to the large supply-chain compromises seen in 2025 and early 2026. In April 2026 an AI coding agent was publicly confirmed to have pulled a malicious crypto-themed dependency into a live trading project.
Nation-state experiments
- A PRC-nexus espionage group used Gemini to design a dynamic, automated penetration-testing agent (observe target state, reason, execute port scanning and service parsing). It got as far as building the framework; Google disabled the assets.
- Another PRC-nexus group used the tool CC Switch to rotate between Claude, Gemini and Codex, building an automated exploitation and post-exploitation pipeline for exploit scripts, spear-phishing lures and debugging.
- Iranian (CALANQUE ION / APT42) and other PRC (RAVINE CASTLE / APT24) groups continue to use Gemini across reconnaissance, lure creation, malware obfuscation and influence operations.
- Underground actors combined Ghidra with the Gemini CLI agent to reverse-engineer WinRAR SFX components, distributing technical markdown for downstream LLM-assisted exploitation rather than a binary.
GTIG is explicit that it “has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild,” but says frontier-model incident disclosures (models autonomously finding zero-days and executing intrusions) and the adoption curve suggest that is where this is going. Google says the activity triggered Gemini’s safety responses, that it disabled associated assets, and that DeepMind used the cases to harden classifiers and the model.
What defenders should change this quarter
- Treat agent config directories as code. Diff and alert on changes to
.claude/,.cursor/,.vscode/,AGENTS.md, hooks and MCP configs in every repo; they are now a persistence and prompt-injection channel. - Do not let attestations substitute for review. DUSTMAKER’s packages carry valid SLSA attestations. Pin versions, verify maintainers, and gate new MCP servers through a vetting layer (see AIR Security, Tenable’s Exchange Inspector, CrowdStrike Falcon Guardian — all launched the same week).
- Protect CI runners’ memory and tokens. OIDC token extraction from GitHub Actions is the pivot that lets a stealer become a trusted publisher.
- Assume LLM scanners can be refused into silence. Adversarial text designed to trigger safety refusals is a known bypass; back LLM scanning with conventional static analysis.
- Watch for LLMjacking. Unexpected GPU or model-API spend in your cloud is now an intrusion indicator, not just a cost anomaly.
- Compress your own response loop. If an attacker can go from cloud foothold to thousands of credentials in six hours, detection SLAs measured in days are obsolete.