Google Saw an Agent Harvest Credentials in Six Hours. Autonomy Is Still Missing.

Google Threat Intelligence Group published its Q2 tracker on 8 September 2026. The line that will get indexed is the six-hour harvest. The line that should travel with it is the one GTIG put under vulnerability research: it has not yet seen fully autonomous attack pipelines against targets in the wild.

Those two sentences are easy to fuse. They are not the same claim.

High A financially motivated actor used an agent to harvest thousands of third-party credentials after a cloud foothold. High because of speed and scale once inside, not because GTIG documented a self-directed break-in.

What Mandiant actually watched#

In Q2 2026, Mandiant responded to a suspected financially motivated actor that had already compromised an organization's cloud infrastructure. From that foothold the actor used an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and run a mass credential-harvesting campaign in less than six hours.

The playbooks were markdown. GTIG says those files drove automated scanning and harvesting and that thousands of third-party credentials were compromised. The agent instructions let the model manage the scanning pipeline, troubleshoot failures in real time, and rotate source addresses without a person in every loop. Traffic left through the victim's own cloud IPs.

That is a force-multiplier on a foothold you already lost. It is not a story about a model discovering the organization from the public internet and walking in unsupervised.

Recon is a second finding#

GTIG separately found an exposed command-and-control server hosting a framework it called Recon. The first listing showed agentic files: AGENTS.md, KNOWLEDGE.md, agentic_vuln_research.md, plus .openclaw/ and memory/ directories. Shortly after detection, that directory became a live dashboard meant to organize, validate, and manage more than 23,800 harvested secrets, including API keys for cloud and AI services.

GTIG describes Recon as a shift from passive endpoint stealers to offensive agentic harvesting. Google says it disabled the assets behind that activity. The tracker does not say Recon is the six-hour Mandiant case. Keep the clocks and the actors unmerged until someone publishes a join.

What GTIG says is still missing#

The same report walks through nation-state interest in automated pentest frameworks, a PRC-nexus attempt to design an agent that observes target state and runs discovery, and underground sharing of markdown knowledge files instead of finished exploit binaries. Those are experiments and prototypes.

On the claim that matters for headlines, GTIG is direct: recent model-security disclosures show frontier systems can find zero-days and run intrusions in lab conditions, but GTIG has not observed threat actors deploying fully autonomous pipelines against targets in the wild. What it has seen is faster conversion of public n-days, more agent-managed harvesting after a foothold, and less time for a human to notice.

John Hultquist, GTIG's chief analyst, told SiliconANGLE the working assumption is that every serious actor is using AI somehow. The part that worries him is criminals gravitating to attacks faster than defenders can respond. That is a latency argument. It is not an autonomy verdict.

Adjacent pressure, not the same incident#

The tracker also records coordinated distillation campaigns against Google's models, some exceeding 100 million prompts, run through proxies and rotating stolen accounts. Underground demand for Claude, Gemini, Cursor Pro, and Devin credentials has risen, with asking prices more than doubling in 2026 on forums GTIG tracks. Infostealer controllers have started grabbing AI-assistant config stores, not only browser profiles.

Those facts explain why stolen cloud and AI keys showed up in Recon's dashboard. They do not turn the six-hour case into a model-extraction story.

Google's same post announces AI Threat Defense, an architecture that wires Gemini, Wiz, CodeMender, and Mandiant intel, and Gemini 3.8 Flash Cyber for vulnerability detection and automated patching. We are not scoring those products here. They are the vendor's stated follow-through on the telemetry it just published.

What to do#

If you run cloud and you let coding agents or chatbots touch production-shaped credentials:

1. Treat a cloud foothold as a harvest window measured in hours, not days. Isolate egress, rotate keys that the instance could see, and assume third-party tokens taken from that seat are already being replayed.
2. Hunt for agentic leftovers the way you hunt for C2: markdown playbooks, AGENTS.md-style instruction files, and dashboards that classify secrets. GTIG published those names because they were sitting in an open directory.
3. Do not wait for a CVE. There is not one. Shrink the blast radius of any workload that can scan the internet from a trusted IP.
4. Keep the workspace-poisoning story on a separate ticket. UNC6780's Dustmaker campaign against coding-assistant directories is in the same GTIG post and is a different control failure.

The indexable query is "AI agents steal credentials in six hours." The accurate sentence is: after a cloud foothold, an agent ran the harvest that fast, and GTIG still has not seen the fully autonomous pipeline in the wild.