Google Threat Intelligence Group (GTIG) published its Q2 2026 threat tracker, and the findings paint a clear picture: adversaries have moved well beyond simple prompt-based interactions with AI models. They are now building autonomous attack frameworks that compress what used to take days into hours.
From Prompting to Autonomous Attack Pipelines
GTIG's core observation is that threat actors have graduated from feeding static prompts into large language models to deploying multi-agent systems that handle entire attack phases without human intervention. In one incident, Mandiant investigators watched a financially motivated actor compromise a cloud resource, then use an AI coding chatbot and preconfigured instruction sets to plan, build, and execute a mass credential harvesting campaign in under six hours. The framework autonomously managed vulnerability scanning, performed real-time troubleshooting, and rotated IP addresses to route traffic through legitimate addresses. Human-in-the-loop latency, which historically gave defenders a window to detect and respond, has effectively collapsed.
GTIG also identified an exposed command-and-control server running a system called "Recon" that combined agentic configuration files (AGENTS.md, KNOWLEDGE.md) with modular directories to organize and validate over 23,800 harvested secrets in real time. The operation shifted from passive endpoint-focused infostealers to offensive AI-driven harvesting with minimal human oversight.
Open Source Supply Chain Under Pressure
The proliferation of AI-assisted coding has increased the volume and variety of open source packages available, including model context protocol servers, inference engines, and vector databases. GTIG argues that this acceleration has also reduced scrutiny of third-party dependencies. The group pointed to several concrete examples: malicious AI resource downloads detected across enterprise environments in North America and Asia in early 2026, an AI coding agent that incorporated a malicious cryptocurrency-themed dependency into a legitimate project in April 2026, and packages that secretly installed LLM proxy services to bypass regional access restrictions in May 2026.
The financially motivated group UNC6780 (also tracked as TeamPCP) exemplifies this risk. Since March 2026, the actor has run large-scale supply chain compromises across PyPI, npm, and Docker Hub. After initial compromise, UNC6780 deploys credential stealers to extract proprietary data, then monetizes through direct sales or partnerships with ransomware groups. The group's DUSTMAKER credential stealer includes more than half a dozen functionalities specifically designed to interact with AI tools, including targeting developer credentials for AI platforms. In one documented case, UNC6780 handed off access to a separate extortion actor who used LAPSUS branding to demand payment after exfiltrating a company's proprietary AI repository via a malicious GitHub Actions workflow.
AI Assets Themselves Are Now Targets
Beyond using AI as an attack tool, adversaries are increasingly going after the models, source code, and compute resources themselves. In June 2026, GTIG reported on a multi-year campaign by UNC6508, a PRC-nexus group, targeting academic, medical, and military research institutions in North America. The actor compromised cloud environments to deploy local LLM infrastructure using open-weight models, avoiding commercial API monitoring while co-opting victim compute resources. The group also actively researches vulnerabilities in AI models.
Data theft extortion operations are following a similar pattern. Mandiant investigated multiple incidents across technology, healthcare, and media sectors where actors stole proprietary AI models, prompts, source code, and related research. In one healthcare compromise, the attacker stole corporate data alongside AI research and a proprietary model, then threatened public release. A separate incident at an AI media generation company resulted in exfiltration of source code, prompts, skills, and secrets, with the attacker using those assets as extortion leverage.
Agentic Frameworks Across the Attack Lifecycle
GTIG observed state-sponsored and cybercrime groups using AI as force multipliers across every phase of the attack lifecycle, from reconnaissance and social engineering lure creation to malware obfuscation and post-exploitation troubleshooting. One PRC-nexus group used Gemini to design a dynamic penetration testing framework intended to observe target state, reason through actions, and execute tasks in unpredictable environments. GTIG disabled the assets associated with that activity before it reached operational status.
The broader trend is clear. Agentic AI frameworks allow smaller groups to operate at the velocity and scale previously associated with well-resourced nation-state teams. For defenders, the compressed attack timeline means detection and response tooling needs to keep pace with adversaries who no longer wait for a human operator to approve each step.