Google says attackers moved from prompting AI for help to letting it run the attack

Google Threat Intelligence Group (GTIG) published its latest AI Threat Tracker on September 8, 2026. Its argument: the threat actors it tracks have moved from using AI as a prompting assistant to running agentic workflows that need little human supervision. The report's central claim is that "human-in-the-loop latency is dramatically reduced." The lead example is a financially motivated actor who compromised a piece of cloud infrastructure in the second quarter of 2026, then used an autonomous multi-agent framework to plan, build, and execute a mass credential-harvesting campaign. It compromised thousands of third-party credentials in under six hours, with the AI system managing the vulnerability-scanning pipeline and troubleshooting in real time.

A dashboard for stolen secrets

GTIG also describes a framework it calls "Recon": a command-and-control server, exposed and discovered by researchers, hosting agentic configuration files (among them AGENTS.md, KNOWLEDGE.md, and agentic_vuln_research.md) built to organize and manage more than 23,800 harvested secrets in real time. Separately, the report ties a China-nexus group to a penetration-testing framework built on Google's Gemini model, designed to automate discovery-phase tasks like port scanning and service enumeration.

GTIG stops short of claiming fully autonomous zero-day discovery. It says it has not yet observed threat actors running fully autonomous attack pipelines against real targets for that purpose. It does say AI is already shortening the time from a public vulnerability disclosure to working exploit code.

Why the framing matters

Prompting versus autonomy is a narrower, more falsifiable claim than the generic "AI supercharges hackers" line in most vendor threat reports. It also comes from a company with its own incident-response arm (Mandiant) and its own frontier model (Gemini), so Google has something to lose whichever way the finding cuts.

Recon is the concrete artifact. It is a C2 server that lets a human operator manage more than 23,800 stolen secrets through the same kind of agent-configuration files a developer uses to steer a coding assistant. That is what AI-orchestrated cybercrime looks like once you go looking for it. For defenders, the practical change is the shrinking gap between disclosure and working exploit.