Attackers built and ran an agent campaign in six hours

The number to remember from Google's new threat report is six. On September 8, 2026, the Google Threat Intelligence Group published its latest AI Threat Tracker, and the case study at its center is an intruder who compromised a cloud account and then planned, built and executed a mass credential harvesting campaign in under six hours. Not six hours from a prepared toolkit. Six hours from access to thousands of stolen third-party credentials.

What actually happened

Per GTIG's report, which draws on Q2 2026 incident response work, a suspected financially motivated actor got into an organization's cloud infrastructure and deployed an autonomous multi-agent framework inside it. The agent ran the vulnerability scanning pipeline, troubleshot its own failures in real time, and handled IP rotation logic without a human driving it. The operational playbooks were markdown files fed to an AI coding assistant.

The detail worth sitting with: the attack ran from the victim's own cloud infrastructure, so the traffic left from legitimate IP addresses. The compromised account was not the target. It was the launch pad.

GTIG's broader finding is the shift from prompting to autonomy — human-in-the-loop latency is being engineered out, which compresses the window defenders have historically depended on. The report also names an automated reconnaissance framework that harvested over 23,800 secrets, including API keys, and notes that underground AI account prices have more than doubled in 2026, as reported by Help Net Security.

One honest caveat, and GTIG states it plainly: it "has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild." This is automation of the tedious middle, not a robot adversary.

Why a six-hour attack chain matters for your business

Most small-business security planning assumes a gap. You get breached, something looks odd, someone notices in a day or two, you rotate credentials and clean up. That plan was never great. At six hours it does not exist.

Your detection interval is now the whole control. If you review logs weekly, an agent-driven campaign completes, exfiltrates and cleans up four times over before anyone opens the dashboard. You do not need a SOC. You need alerts that page a human on the two or three events that actually matter: a new API key created, an IAM role changed, an unfamiliar region spinning up compute.

Credentials are the payload, so shorten their life. Twenty-three thousand secrets harvested by one framework is a statement about how many long-lived keys are sitting in repos, CI configs and .env files. Anything permanent is a permanent liability. Short-lived tokens and scoped keys turn a six-hour breach into a six-hour breach that expires.

Egress from your own cloud is the blind spot. Nearly everyone monitors what comes in. This campaign left from inside, wearing the victim's IP address. If your cloud account can reach the entire internet on any port — and by default it can — you have no way to tell your traffic from theirs.

None of that is exotic. It is the boring list, done, before the tooling on the other side gets another order of magnitude faster.

Sources: Google Threat Intelligence Group, Help Net Security.