AI · 14 Aug 2026 · Rob Nidschelm

An Agentic Attack Framework Was Managing 23,800 Stolen Secrets

Updated 8 September 2026: Google Threat Intelligence Group has published new frontline evidence showing how quickly agentic attack workflows are becoming operational. In one incident, a financially motivated actor used a compromised cloud resource and a multi-agent framework to plan, build and execute a mass credential-harvesting campaign in less than six hours. In a separate exposed system, Google found an agentic reconnaissance and credential-management framework organising more than 23,800 harvested secrets in real time.

The evidence sharpens the conclusion of this article. Attackers are no longer using AI only to write code, translate lures or answer tactical questions. They are giving agentic systems operational playbooks, cloud infrastructure and enough authority to manage scanning, troubleshoot failures, rotate network addresses and organise stolen credentials with little manual intervention.

A six-hour campaign changed the economics of credential theft

During the second quarter of 2026, Mandiant investigated a suspected financially motivated actor that compromised an organisation’s cloud infrastructure and deployed an autonomous multi-agent attack framework. Google says the operator supplied an AI coding chatbot with a prompt and preconfigured instruction files, then used the resulting system to build and run a mass credential-harvesting campaign in under six hours.

The framework automatically managed vulnerability scanning, handled operational errors and implemented IP rotation while working from legitimate victim cloud addresses. It compromised thousands of third-party credentials. The important change was not a new exploit. It was the reduction in human attention required to turn infrastructure, instructions and familiar attack techniques into a working campaign.

The exposed dashboard held 23,800 secrets

Google separately identified an exposed command-and-control server hosting an automated reconnaissance and credential-management framework called Recon. Its directory contained agent configuration and knowledge files alongside modular automation components. The exposed service later became a production dashboard for organising, validating and managing more than 23,800 harvested secrets, including cloud and AI service API keys.

This is a practical boundary crossing. Traditional infostealers collect whatever they can reach on an endpoint. The Recon framework used autonomous agents to research vulnerabilities, scan server-side infrastructure, execute targeted exploitation and manage the resulting secrets as an operational inventory. That makes stolen credentials easier to validate, prioritise and reuse at scale.

AI assistants also became part of the supply-chain attack surface

Google also connected the financially motivated group UNC6780, also known as TeamPCP, to attempts to manipulate AI coding assistants and language-model security scanners during open-source supply-chain compromises. Malicious project configuration files instructed coding assistants to run attacker-controlled commands during routine developer activity. Other samples placed provocative prompt-injection text above malicious JavaScript in an apparent attempt to make AI security tools refuse or skip analysis.

This creates two defensive problems at once. The assistant may execute repository content as instructions, while the scanner may treat attacker-controlled comments as policy rather than data. Development teams should isolate agent execution, require confirmation for command and workflow changes, review hidden project configuration, and ensure that security analysis does not silently fail when it encounters adversarial text.

Google has not seen the final form yet

The evidence does not support claiming that fully autonomous attackers are independently discovering zero-days and completing entire intrusions against live targets. Google explicitly says it has not yet observed threat actors deploy that complete pipeline in the wild. Human operators still choose objectives, obtain access, provide infrastructure and set the operational boundaries.

That limitation should not provide comfort. The observed systems already compress the work between those human decisions. A campaign that can build itself in hours, keep scanning when one route fails and manage tens of thousands of secrets changes the defender’s available response time even when a person remains somewhere in the loop.

What defenders should change now

• Treat cloud compute, service accounts and AI platform quotas as attack infrastructure that must be monitored for abnormal provisioning, scanning and outbound traffic.
• Hunt for rapid, parallel credential testing and vulnerability discovery that moves faster than a conventional operator could reasonably sustain.
• Reduce the usable lifetime of stolen API keys and machine credentials through short-lived tokens, narrow scopes and automated rotation.
• Keep AI coding agents away from production secrets and require explicit approval before they run commands, modify workflows or install dependencies.
• Scan hidden project instructions and configuration files as untrusted content, including files intended specifically for coding agents.
• Design security scanners to record and escalate analysis refusals instead of silently skipping files that contain adversarial prompt text.
• Pre-authorise narrow containment actions for high-confidence machine-speed abuse so responders are not trapped behind a human approval queue.

The operational threshold moved again

The earlier evidence showed that autonomous attack systems could coordinate reconnaissance, credential testing and lateral movement. Google’s new findings show the operational machinery around that capability: compromised cloud resources, reusable agent instructions, automated troubleshooting, live credential inventories and attempts to manipulate the AI tools used by developers and defenders.

The practical lesson is not that human attackers have disappeared. It is that each operator can now supervise more targets, more experiments and more stolen access than a conventional team could manage manually. Defenders still have time to adapt, but considerably less of it.

Taiwan’s confirmation of AI-assisted attacks on government agencies and a security company’s reconstruction of an autonomous campaign against an Asian government point to the same operational shift: attackers can now run parallel, adaptive intrusion workflows while many defenders are still constrained by human investigation and approval cycles.

The important question is no longer whether artificial intelligence can help someone write phishing emails or generate exploit code. It is what changes when agents can map systems, test credentials, search for alternatives and redirect an intrusion with limited human involvement.

That threshold appears to have been crossed.

What Taiwan actually confirmed

Taiwan’s Ministry of Digital Affairs said government agencies detected AI-assisted attacks from overseas during July. According to Reuters, monitoring units began issuing alerts on 20 July and the affected agencies completed their incident response.

The ministry did not identify the agencies, publish a technical incident report or connect its disclosure to a named threat group. That restraint matters because a second account published at almost the same time is more detailed, but does not line up perfectly with the official timeline.

What Dream says it recovered

Cybersecurity company Dream said its researchers recovered the working directory of an autonomous attack system used against government entities in Asia in early July. Its published account describes twelve attack waves over four days using publicly available tooling.

Dream says the system cracked 85 employee accounts, used 84 of them to move into internal systems, and obtained more than 2,500 personnel records along with database credentials and network architecture. It then widened the operation to government IT suppliers, a nuclear safety agency, a government email system and seven energy companies.

Financial Times reporting identified the target as Taiwan, while Reuters reported Taiwan’s separate confirmation of AI-assisted government attacks. Dream itself did not publicly name the country. The early-July campaign described by Dream and Taiwan’s alerts from 20 July should therefore not be presented as one proven incident without further evidence.

The distinction does not weaken the security lesson. It strengthens it. Within one month, defenders were dealing with both an officially acknowledged AI-assisted campaign and a detailed reconstruction of an autonomous operation using commodity agent frameworks against a government environment in the region.

This was not just faster scripting

Security automation is not new. Vulnerability scanners, password-spraying tools and scripted exploitation have been part of offensive operations for decades.

The difference is adaptive coordination.

An agentic system can keep a goal in view while changing the route used to reach it. One agent can map exposed services while another researches a product, a third tests credentials and a fourth examines the results. A failed technique becomes input for a new attempt rather than the end of a pre-written script.

That makes the attack less dependent on continuous human attention. The operator still chooses targets, provides infrastructure and sets objectives, but the system can execute far more of the decision loop on its own.

Dream’s most important observation is that the campaign did not depend on extraordinary exploits. It relied on ordinary weaknesses and enough autonomy to find and combine them at scale.

The defender’s bottleneck is now time

Most security teams still work through queues. An alert is generated, enriched, assigned, investigated and escalated. Containment may require approval from system owners, management or legal teams. Those checks are often necessary, but they create latency.

An autonomous attacker does not wait for a morning handover or a change-management meeting. It can probe multiple paths simultaneously and keep working while one route is blocked.

This creates an asymmetric problem. Organisations do not need to be unusually insecure to be vulnerable. They only need enough ordinary gaps spread across identity, legacy systems, suppliers and remote services for an agent to keep searching until a viable chain appears.

Government networks are especially exposed because they are rarely one network. They are federations of agencies, contractors, service providers and critical-infrastructure operators with uneven budgets, technology and visibility. Trust relationships that make public services function also give an adaptive attacker more places to pivot.

What defenders should change now

The answer is not to purchase an “AI security” product and assume the speed problem is solved. Defensive automation without boundaries can create its own operational risk.

Practical preparation starts with controls that reduce the number of decisions an attacker gets to make:

• Enforce phishing-resistant multi-factor authentication for privileged and remotely accessible accounts, and monitor unusual authentication sequences across agencies and suppliers.
• Treat internet-facing asset discovery as a continuous process. An attacker running in parallel will find forgotten systems faster than a quarterly assessment.
• Pre-authorise a narrow set of containment actions, such as disabling a clearly compromised account or isolating an endpoint, so high-confidence alerts do not wait for a meeting.
• Segment supplier, government and critical-infrastructure trust relationships. A compromised identity should not become a passport across organisations.
• Hunt for machine-speed behaviour: rapid credential testing, repeated enumeration, abrupt shifts between attack paths and concurrent activity across unrelated systems.
• Exercise incident response against several simultaneous intrusion paths, not one linear scenario with a single attacker at the keyboard.

Defenders also need to secure the agents they deploy. Taiwan’s National Institute of Cyber Security has warned that highly privileged agent tools can be exposed to indirect prompt injection, malicious third-party skills and the erosion of long-running safety instructions. Machine-speed defence needs isolation, logging, explicit permissions and human control over high-impact actions.

Attribution cannot be the first dependency

Researchers reportedly found Simplified Chinese in operator material while stolen data used Traditional Chinese. That may inform an assessment, but it does not by itself prove state sponsorship or identify a specific group.

Autonomous systems can make attribution harder by using commodity infrastructure, changing techniques more often and reducing the human mistakes that investigators traditionally use as clues. Attribution remains important for diplomacy and law enforcement, but containment cannot wait for it.

The first defensive questions are simpler: Which identities are compromised? Which trust relationships can they reach? Which attack paths are still open? What can be safely contained now?

The operational threshold has moved

BlackTree previously examined what happens when AI agents leave the sandbox. The Taiwan disclosures show the other side of that transition: agents are no longer only a laboratory containment problem. They are becoming an operational tool for real intrusions.

The shift is not that every attacker suddenly has nation-state capability. It is that one operator can supervise more reconnaissance, more experimentation and more simultaneous attack paths than a conventional team could sustain manually.

Defence therefore has to move closer to the speed of the system it is facing. That means fewer standing privileges, smaller trust zones, better shared telemetry and carefully governed automation that can act before a human queue becomes the attacker’s advantage.

The autonomous cyberattack has arrived. The dangerous part is not that it thinks like a brilliant hacker. It is that it can keep testing ordinary weaknesses without getting tired, losing focus or waiting for permission.

Update, 2 September: Unit 42 saw the ten-hour version of this attack

Unit 42 has now documented a separate ransomware intrusion in which a human operator used multiple frontier AI agents to compress what investigators estimated would normally require about two weeks of coordinated work into less than ten hours. The agents executed more than 50 MITRE ATT&CK techniques while the operator retained control of the objective and consequential decisions.

The significance is not a novel zero-day. Unit 42 says the attacker entered through a public API endpoint, then delegated reconnaissance, secrets discovery and lateral movement to specialised agents. Those agents mapped internal microservices, searched source repositories for embedded credentials, reached the organisation’s secrets-management system and obtained root access.

The attack also crossed into the software-delivery and AI control planes. The agents triggered unauthorised CI/CD builds, exfiltrated cloud credentials and attempted to place backdoors in Terraform configurations. Mandatory branch protection stopped that final change, showing that deterministic controls can still interrupt an adaptive automated campaign.

After stealing cloud keys, the attacker used the victim’s own AI endpoints as post-compromise infrastructure. That creates a difficult detection problem because malicious orchestration can resemble expected model traffic while the victim absorbs the computing cost. Unit 42 also observed overlapping persistence across SSH keys, serverless functions, container restart policies and cloud identities.

Defenders should hunt for the operational shape of an agent loop: bursts of API requests, rapid switches between failed and successful authentication, parallel activity across repositories and infrastructure, structured Markdown files used to pass state between agents, and unexpected model use from privileged identities. Containment plans must revoke credentials, terminate sessions, freeze compromised pipelines and isolate affected cloud accounts together. Sequential response gives an automated attacker time to rebuild access elsewhere.