An Attacker's Multi-Agent Framework Stole Thousands of Credentials in Under Six Hours
A financially motivated attacker ran reconnaissance, exploitation, and cleanup with almost no human in the loop — using the same design patterns you'd use to build a helpful agent. That symmetry is the actual story. What Google's threat researchers found Google's Threat Intelligence Group (GTIG) published its Q3 2026 AI Threat Tracker documenting a mass credential-harvesting campaign carried out largely by a multi-agent framework rather than a human operator. According to GTIG's report and coverage from The Hacker News, SiliconANGLE, and Help Net Security, a suspected financially motivated actor gained access to an organization's cloud infrastructure, then deployed an autonomous multi-agent system from inside that environment — which let requests originate from legitimate-looking IP addresses rather than obviously malicious infrastructure. The attacker reportedly built the framework using an AI coding chatbot, a set of instructions, and preconfigured Markdown files functioning as operational playbooks — essentially the same "agent skills" pattern legitimate teams use to give an LLM reusable, structured procedures. Per Mandiant's incident-response analysis cited in GTIG's report, the resulting system managed the vulnerability-scanning pipeline, collected credentials, resolved technical problems as they came up, and rotated IP addresses — without a human approving each step. Google says the entire operation, from setup to compromising thousands of third-party credentials, took under six hours. The part that should worry engineers, specifically Most public discussion of "agentic security risk" focuses on prompt injection against your own agents, or an assistant being tricked into leaking your data. This is a different and arguably more mundane threat: the same reliability engineering that makes agents useful — self-correction, retries, graceful handling of transient failures — is exactly what makes an attack pipeline resilient enough to run unattended for hours. A scan