News · 2026-09-08

Google says attackers have moved from prompting to autonomous AI agents

Google's Threat Intelligence Group reported on September 8, 2026 that a financially motivated attacker used an AI coding chatbot, a prompt and a set of agent instructions to plan, build and execute a mass credential-harvesting campaign in less than six hours, compromising thousands of third-party credentials. The report frames this as a threshold being crossed: adversaries have stopped using AI as a writing assistant and started using it as an operator that runs the attack itself.

Key facts

• The campaign ran end to end in under six hours and compromised thousands of third-party credentials.
• The attacker used preconfigured markdown instruction sets as operational playbooks to drive automated scanning and harvesting.
• Google names state-linked clusters using similar workflows, including SANDWORM RELIC (Russia, APT44), CALANQUE ION (Iran, APT42), several PRC-nexus groups and DPRK clusters.
• Primary source: Google Cloud's threat intelligence blog, From Prompting to Autonomy, published September 8, 2026; covered the same day by The Hacker News.

The distinction Google is drawing is easy to miss and matters enormously. For three years the standard story about AI and cybercrime was that models write better phishing emails. That is a quality improvement to one step of an attack. What GTIG describes is different in kind. In its own words: "Google Threat Intelligence Group (GTIG) has observed forward leaning adversaries transition from basic prompting to agentic AI workflows and AI-enabled automation. In these operations, human-in-the-loop latency is dramatically reduced, compressing the traditional window for defenders to respond."

Human-in-the-loop latency is the quiet phrase doing the work. Most defensive security assumes an attacker is a person: someone who has to wake up, read scan output, decide what looks promising, write a follow-up script, notice it broke, and fix it. Each of those pauses is time a defender can use. Strip the pauses out and the same attack that used to unfold over a week unfolds between two log reviews.

The mechanism is almost mundane, which is what makes it significant. The attacker did not need a bespoke offensive AI. They wrote their playbooks as markdown files — the same plain-text instruction format developers use to give coding agents standing orders — and pointed a commercial AI coding chatbot at them. Those instructions were enough for the agent to autonomously manage a vulnerability scanning pipeline, troubleshoot problems as they came up, and rotate its own IP addresses to avoid blocking. The analogy is the gap between hiring a consultant who answers your questions and hiring a contractor who takes the keys, works through the night, and calls a plumber when a pipe bursts. Same expertise; entirely different amount of your attention required.

This is not confined to criminals chasing money. Google's report catalogues state-linked actors adopting the same pattern: clusters it tracks as SANDWORM RELIC, tied to Russian military intelligence; CALANQUE ION, an Iranian government-backed group also known as APT42; multiple PRC-nexus groups including BASIN CASTLE and RAVINE CASTLE; and North Korean clusters. Google writes that these groups "are increasingly upgrading these workflows, creating highly autonomous systems capable of reasoning through complex tasks and making dynamic decisions without the need for human oversight." John Hultquist, GTIG's chief analyst, put the broader concern this way: "Like everyone else, we're concerned about the vulnerability problem, but AI is being applied to several other areas..."

Why it matters for anyone running systems: the economics of scanning have changed. Attackers previously had to choose targets, because attention was the scarce resource. An agent that can be handed a playbook and left running does not choose — it enumerates. That shifts the risk profile for exactly the organisations that used to be safe through obscurity, and it puts a premium on the unglamorous controls that do not depend on a human noticing something: credential rotation, short-lived tokens, egress monitoring, and rate limits that trigger on behaviour rather than on identity. It also sharpens the case for treating agent instruction files as a security boundary rather than as documentation, which is the same lesson from the defensive side that this site covered when the UK's NCSC warned that shadow AI inherits enterprise privileges and when seven live agents sent $12,431 in unsolicited invoices.

The honest caveat is that Google does not name the tool that was abused, does not attribute the six-hour campaign to a specific named actor, and — as the vendor of both a major AI platform and a major security business — has an interest in the framing. The report is an observation log from one company's visibility, not an industry-wide measurement, and "thousands of credentials" is not broken down by type or severity. What is not really contestable is the direction: the playbook-plus-agent pattern is cheap, requires no novel research, and is now documented in the wild. If you want the underlying concepts, start with prompt injection, AI agents and sandboxing AI agents.

Primary source, verified: read the paper →

Ground Truth. (2026, September 8). Google says attackers have moved from prompting to autonomous AI agents. Ground Truth. https://groundtruth.day/news/google-says-attackers-have-moved-from-prompting-to-autonomous-ai-agents.html

@misc{groundtruth:google-says-attackers-have-moved-from-prompting-to-autonomous-ai-agents,
  title  = {Google says attackers have moved from prompting to autonomous AI agents},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {sep},
  url    = {https://groundtruth.day/news/google-says-attackers-have-moved-from-prompting-to-autonomous-ai-agents.html}
}

Topics: cybersecurity · ai-security · ai-agents · threat-intelligence · credential-theft · prompt-injection