In the wild
Realized harm
GTIG Q3 2026 tracker: a financially motivated actor used an AI coding chatbot and an autonomous multi-agent framework to build and run a mass credential-harvesting campaign in under six hours
AIR-2026-0224 AIR record · 2026-09-google-gtig-multiagent-credential-harvest
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The threat actor leveraged an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours.cloud.google.com
The record
Disclosed
2026-09-08
Product
AI coding chatbot plus multi-agent attack framework (unnamed)
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation
System type
Generative model
Who acted
Agent acted — a multi-agent framework autonomously scanned, harvested credentials and rotated IPs within six hours
Attack surface
Agent framework
Autonomy level
Fully autonomous
Initial vector
Autonomous multi agent vulnerability scanning
Impact type
Credential theft, Unauthorized access
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
thousands of third-party credentials compromised; the actor operated from compromised victim cloud infrastructure to route traffic through legitimate IP addresses
Capability abused
Taxonomy & references
Curator notes
Google Threat Intelligence Group Q3 2026 AI Threat Tracker 'From Prompting to Autonomy' (2026-09-08), Mandiant Q2 2026 investigation; the Google blog is the primary source of record. The actor deployed an autonomous multi-agent framework on compromised cloud infrastructure using preconfigured markdown instruction sets as operational playbooks. Treated as a distinct observation from the exposed 'Recon' C2 server (separate record 2026-09-google-gtig-recon-c2-secrets): the source presents them as two separate observations and does not attribute them to the same actor.
Supporting sources
Cite as
Enkrypt AI. "GTIG Q3 2026 tracker: a financially motivated actor used an AI coding chatbot and an autonomous multi-agent framework to build and run a mass credential-harvesting campaign in under six hours". AIR, AIR-2026-0224. https://agentincident.vercel.app/i/AIR-2026-0224/ (accessed 2026-10-19).