In the wild
Realized harm
GTIG Q3 2026 tracker: an exposed 'Recon' C2 server ran an agentic reconnaissance and credential framework (AGENTS.md, .openclaw) managing over 23,800 harvested secrets
AIR-2026-0225 AIR record · 2026-09-google-gtig-recon-c2-secrets
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
Shortly after initial detection, the exposed directory transitioned to a live, production frontend dashboard designed to organize, validate, and manage over 23,800 harvested secrets in real time, including API keys for cloud and AI services.cloud.google.com
The record
Disclosed
2026-09-08
Product
OpenClaw-based agentic framework ('Recon')
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation
System type
Generative model
Who acted
Agent acted — an agentic reconnaissance framework harvested and managed 23,800+ secrets from an exposed C2
Attack surface
Agent framework
Autonomy level
Fully autonomous
Initial vector
Agentic reconnaissance and credential management framework
Impact type
Credential theft, Unauthorized access
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
over 23,800 harvested secrets managed in real time, including API keys for cloud and AI services, exposed on a live production dashboard
Capability abused
Taxonomy & references
Curator notes
Google Threat Intelligence Group Q3 2026 AI Threat Tracker 'From Prompting to Autonomy' (2026-09-08); Google blog is the primary source of record. GTIG found the exposed C2 server hosting agentic configuration/knowledge files (AGENTS.md, KNOWLEDGE.md, agentic_vuln_research.md) and modular directories (.openclaw/, memory/). Treated as a distinct observation from the six-hour Mandiant credential-harvesting campaign (record 2026-09-google-gtig-multiagent-credential-harvest); the source lists them as two separate observations and does not link the actors. impact_realized=true: the dashboard managed real harvested secrets.
Supporting sources
Cite as
Enkrypt AI. "GTIG Q3 2026 tracker: an exposed 'Recon' C2 server ran an agentic reconnaissance and credential framework (AGENTS.md, .openclaw) managing over 23,800 harvested secrets". AIR, AIR-2026-0225. https://agentincident.vercel.app/i/AIR-2026-0225/ (accessed 2026-10-19).