For the last three years, AI security mostly meant one thing: a jailbroken chatbot writing a phishing email or debugging some malware on request. That was the training-wheels phase. According to new findings from Google’s Threat Intelligence Group (GTIG), it’s over.
GTIG’s report, From Prompting to Autonomy: The Evolution of Adversarial AI describes something categorically different from prompt-and-paste hacking. Attackers are now wiring large language models into multi-agent systems. These systems plan an intrusion, execute it, and notice when something breaks. Then they fix it themselves. A human checks in only occasionally, if at all.
The clearest example is almost absurdly efficient. A financially motivated group broke into an organization’s cloud environment. In under six hours, its AI agent stack designed, built, and launched a full-scale credential-harvesting operation. The attacker needed just one coding chatbot, one prompt, and a stack of markdown instruction files. From there, autonomous agents scanned for vulnerabilities and siphoned third-party credentials on their own. They rotated IP addresses and routed the whole operation through hijacked-but-legitimate cloud infrastructure to dodge detection. They even troubleshot their own failures along the way — the same way a human operator would, just without the coffee breaks.
Sit with that six-hour number for a second. Most enterprise security teams can’t even convene an incident response call that fast, let alone patch a vulnerability. Defense economics have always rested on one quiet assumption: attackers face the same limits of human time, fatigue, and error that defenders do. GTIG’s report is an early obituary for that assumption.
Meet “Recon”
The six-hour case shows AI accelerating an existing playbook. A second discovery shows AI building an entirely new kind of infrastructure. Investigators found an exposed command-and-control server hosting a framework its operators called Recon. This wasn’t a stolen-password dump — it was a purpose-built reconnaissance and credential-management system that managed more than 23,800 stolen secrets, API keys included, in real time.
The server’s file directory read less like a hacker’s toolkit and more like a small company’s internal ops folder: agent instruction sets, knowledge base files, and configuration artifacts, all coordinating an automated back office for stolen credentials. The structure will look familiar to anyone who has followed how legitimate AI agents get their instructions. The same SKILL.md-style packaging that teaches agents to build software is, apparently, also teaching them to run a criminal back office.
That distinction matters. A stash of stolen passwords just sits in a text file as a liability. A living framework that ingests, tags, verifies, and resells those credentials at scale is a business. Criminal marketplaces have leaned on human labor for two decades: vetting logs, checking which credentials still work, packaging them for resale. Recon suggests that labor is disappearing from the criminal supply chain the same way it’s disappearing from legitimate enterprises.
The state-sponsored angle
GTIG’s report doesn’t stop at financially motivated crews. China-linked espionage actors experimented with AI development tools to stitch together automated exploitation and post-exploitation pipelines. So far, they’re prototyping AI-run attack chains, not deploying them at scale. Russia-based UNC5792 took a narrower but telling approach: it used AI models to run monitoring bots that continuously sweep Telegram channels for intelligence its state handlers want. That task used to need a human analyst’s attention. Now it runs as background automation.
Elsewhere, GTIG flagged a separate campaign, UNC6780 (“TeamPCP”), running supply-chain attacks alongside a Gemini distillation operation that burned through 100 million prompts. AI abuse isn’t just about breaking into networks. It also means stealing the models themselves, prompt by prompt, to build cheaper knockoffs.
The asterisk Google wants you to notice
To its credit, GTIG doesn’t oversell this into a robot-uprising narrative. The report draws a clear line: fully autonomous hacking hasn’t shown up in the wild yet. No AI system has independently discovered a zero-day and exploited it against a real target end-to-end, with zero human oversight anywhere in the chain. Google also says Gemini itself flagged a meaningful share of this misuse in real time. That triggered account bans and operation takedowns before the campaigns could scale further.
That caveat does real work, and it’s worth reading past the scary headline to catch it. AI hasn’t learned to hack unassisted. What changed is the coordination layer — the tedious human work of stitching recon, exploitation, credential harvesting, evasion, and cleanup into one continuous operation. Software now handles that layer, and software doesn’t get tired, distracted, or careless at 3 a.m. Attackers never lacked creativity. They lacked logistics. Multi-agent frameworks just solved that problem for them.
Why this is actually a defender’s problem, not an AI problem
The instinct here is to treat this as an “AI is dangerous” story. Treat it as an operations story instead. Every advantage GTIG describes — faster iteration, self-healing pipelines, round-the-clock execution, adaptive troubleshooting — is the exact same pitch AI vendors make to legitimate DevOps and SRE teams every day. Attackers haven’t discovered some exotic new capability. They’re applying the same productivity tooling that’s reshaping software engineering to the much older discipline of breaking into networks. Here’s the uncomfortable symmetry: any enterprise celebrating how fast its AI coding agents now ship features is looking at a rough preview of how fast its adversaries can now ship exploits.
For defenders, the practical takeaway isn’t “block all AI.” Detection timelines built around human attacker cadence assumed hours or days between initial access and lateral movement. Rewrite that assumption around a six-hour worst case instead. Credential rotation, anomaly detection, and cloud egress monitoring that once held up against a lone human operator won’t hold up against one who delegated the busywork to an agent that never sleeps.
Related: Is Janitor AI Safe in 2026? The Privacy Risks Most Users Ignore
