Google Mandiant: AI agents harvested thousands of credentials in six hours — no human needed

Google's Threat Intelligence Group (GTIG) — formerly Mandiant — just published its Q3 2026 AI Threat Tracker, and the headline finding is stark: financially motivated threat actors used an autonomous multi-agent AI framework to plan, build, and execute mass credential harvesting in under six hours.

From the report:

• Thousands of third-party credentials compromised from cloud infrastructure.
• AI coding chatbot + markdown agent instruction playbooks handled vulnerability scanning, troubleshooting, and IP rotation.
• Reduced human-in-the-loop latency — agents operated with minimal oversight.
• A separate incident revealed an exposed "Recon" C2 dashboard managing 23,800+ harvested secrets (cloud keys, AI API keys, database credentials).

This isn't a proof-of-concept. This is production-grade autonomous exploitation in the wild.

The report's title — "From Prompting to Autonomy" — signals the shift: threat actors are moving from manual AI-assisted tasks to fully autonomous agent workflows.

What happened: six-hour autonomous credential harvest

Timeline (Q2 2026 incident observed by GTIG)

GTIG observed a financially motivated threat group compromise cloud infrastructure and deploy an AI agent framework. Here's what the agents did without human intervention:

Hour 1–2: Reconnaissance and vulnerability scanning

• Agent 1 scanned exposed services (S3 buckets, misconfigured databases, open APIs).
• Agent 2 cross-referenced Common Vulnerabilities and Exposures (CVEs) against discovered services.
• Agents flagged high-priority targets with valid credentials or weak authentication.

Hour 3–4: Exploitation and credential extraction

• Agent 3 automated exploitation attempts (SQL injection, default credentials, API token leaks).
• When an exploit failed, the agent troubleshot the failure and tried alternative payloads.
• Extracted credentials were stored in a structured database.

Hour 5–6: Lateral movement and IP rotation

• Agent 4 used stolen credentials to pivot to adjacent systems.
• Agent 5 managed IP rotation to avoid detection (switching proxies, VPNs, and compromised hosts).
• Final count: thousands of third-party credentials exfiltrated.

What's different from traditional attacks:

• No manual scripting — the agents wrote their own exploitation code.
• Self-healing — when an exploit failed, agents debugged and retried.
• Reduced dwell time — six hours from initial access to mass exfiltration.

The "Recon" C2 dashboard: 23,800+ secrets

GTIG also discovered an exposed command-and-control dashboard — codenamed "Recon" by the threat group — that managed 23,800+ harvested secrets, including:

• Cloud credentials (AWS, Azure, GCP).
• AI API keys (OpenAI, Anthropic, Google).
• Database credentials (PostgreSQL, MySQL, MongoDB).
• SaaS tokens (Slack, GitHub, Stripe).

Why this matters:

Traditional credential theft requires manual triage — attackers review logs, filter noise, and categorize stolen secrets.

Recon's dashboard was fully automated. The AI agents:

• Categorized credentials by value (cloud admin > read-only API).
• Tested validity (live vs. expired keys).
• Prioritized targets (financial services > low-value SaaS).

Translation: The attack wasn't just autonomous — it was optimized for maximum ROI.

From prompting to autonomy: what changed

GTIG's report highlights the shift from AI-assisted attacks (2024–2025) to autonomous AI attacks (2026+).

Phase 1: Prompting (2024–2025)

Threat actors used ChatGPT, Claude, or open models to:

• Write phishing emails.
• Generate malware code snippets.
• Automate reconnaissance (e.g., "scrape this site for emails").

Human in the loop: The attacker reviewed outputs, tweaked prompts, and executed commands manually.

Phase 2: Autonomy (2026+)

Threat actors now use multi-agent frameworks where:

• Agent 1 handles reconnaissance.
• Agent 2 writes exploits.
• Agent 3 tests and debugs.
• Agent 4 exfiltrates data.
• Agent 5 covers tracks.

Human in the loop: Minimal. The attacker sets high-level goals ("extract cloud credentials from this IP range") and the agents execute.

Why this is urgent:

Traditional security assumes human dwell time — attackers need hours or days to move laterally, escalate privileges, and exfiltrate data.

Autonomous agents collapse that timeline to hours.

If your detection tools assume 24–48 hours to respond, you're already too late.

UNC6780 / TeamPCP: hiding stealers in .claude and .cursor directories

GTIG's report also noted that the threat group UNC6780 (also tracked as TeamPCP) deployed the DUSTMAKER info-stealer malware, which hides stolen credentials in .claude and .cursor directories.

Why this works:

• Developers using Claude Desktop or Cursor IDE have .claude/ and .cursor/ folders in their home directories.
• Security tools often whitelist these paths to avoid blocking legitimate IDE activity.
• DUSTMAKER hides stolen credentials in these directories, masquerading as IDE cache files.

What gets stolen:

• Environment variables (API keys, database passwords).
• Browser cookies (session tokens).
• SSH keys and cloud credentials.

Mitigation:

• Audit .claude/ and .cursor/ directories for suspicious files.
• Monitor file writes to these paths.
• Block unknown binaries from writing to IDE directories.

Want to test frontier models without exposing your secrets?

If you're experimenting with AI agents, your API keys, environment variables, and cloud credentials are at risk.

👉 **[Start Pro trial (4 days)](https://www.trustai.center/login?next=%2Fapp%2Fsettings%2Fbilling%3Fplan%3Dpro%26auto%3D1&utm_source=news&utm_medium=organic&utm_campaign=news_article_google-mandiant-ai-agents-credential-harvest-six-hours)** — TrustAI Vault masks secrets before they reach the model.

What you get:

• Multi-model chat (GPT-4o, Claude Sonnet 4.5, Gemini).
• Automatic redaction of API keys, passwords, PII, and business secrets.
• Audit logs for every prompt and response.
• Team budgets and GDPR/AI Act alignment.

[Start 4-day trial →](https://www.trustai.center/login?next=%2Fapp%2Fsettings%2Fbilling%3Fplan%3Dpro%26auto%3D1&utm_source=news&utm_medium=organic&utm_campaign=news_article_google-mandiant-ai-agents-credential-harvest-six-hours)

What this means for enterprise security teams

1. Autonomous agents move faster than detection tools

Traditional incident response assumes:

• 24–48 hours for initial triage.
• 72 hours for containment.
• 7–14 days for full remediation.

Autonomous agents compress this to hours. If you're not monitoring in real-time, you'll discover the breach after credentials are sold.

What you need:

• Real-time credential monitoring — alert on API key usage outside expected IP ranges.
• Behavioral anomaly detection — flag unusually fast lateral movement.
• Automated credential rotation — rotate secrets immediately when anomalies are detected.

2. Secrets hygiene is no longer optional

The 23,800 secrets on the Recon dashboard weren't stolen through sophisticated zero-days. They came from:

• Hard-coded API keys in public GitHub repos.
• Environment variables leaked in Docker images.
• Credentials in CI/CD logs.
• Expired tokens never rotated.

What you need:

• Secret scanning in repos (GitHub Advanced Security, GitGuardian, TruffleHog).
• Environment variable encryption (AWS Secrets Manager, Azure Key Vault).
• Automatic token rotation for API keys (90-day maximum lifetime).
• Access logging for all secrets (who accessed what, when).

3. AI API keys are now a high-value target

GTIG's report specifically called out AI API keys (OpenAI, Anthropic, Google) as targets.

Why attackers want them:

• Data exfiltration — send sensitive documents to an AI for summarization, then exfiltrate the output.
• Prompt injection — inject malicious prompts into production AI systems.
• Cost exploitation — run up $10,000+ bills on stolen API keys.

What you need:

• API key scoping — never use production API keys in development.
• Rate limiting — cap API usage per key (e.g., $100/day).
• Usage alerts — notify when a key exceeds expected usage.

4. The threat surface is no longer just your perimeter

Traditional security focuses on:

• Firewalls and VPNs.
• Endpoint detection and response (EDR).
• Network intrusion detection systems (NIDS).

Autonomous agents bypass all of this if they compromise a single developer laptop with:

• Valid cloud credentials.
• Active session tokens.
• API keys in environment variables.

What you need:

• Assume breach posture — segment networks, enforce least privilege, and log everything.
• Zero-trust architecture — verify every request, even from inside the perimeter.
• Credential-free deployments — use ephemeral tokens and service identities, not long-lived keys.

How TrustAI Vault protects against agent-based threats

TrustAI Vault is designed for the post-autonomous world where agents can operate without human oversight.

Here's how Vault prevents the attack patterns GTIG documented:

1. Secrets never reach the model

When you paste code, logs, or environment variables into Vault:

• API keys, passwords, and tokens are automatically masked.
• The model sees [REDACTED] instead of sk-proj-abc123.
• You get the analysis or answer without exposing secrets.

Example:

Before Vault (exposed): Your secrets are visible. After Vault (protected): Secrets are replaced with [REDACTED]. The model can still help you debug, but your credentials never leave your control.

2. Audit logs for every interaction

Vault logs:

• Every prompt sent to a model.
• Every response returned.
• Every file analyzed.
• Every action taken.

If an attacker compromises a team member's account, you can trace exactly what data was exposed.

3. Team budgets and access controls

Vault enforces:

• Per-user spending limits — prevent cost exploitation attacks.
• Model restrictions — control which models teams can access.
• Data policies — block entire categories of data (e.g., "no PII in prompts").

For solo founders: automate without exposing your stack

Building a startup? You're moving fast, but you can't afford a credential leak.

👉 **[TrustAI Solo](https://solo.trustai.center?utm_source=news&utm_medium=organic&utm_campaign=news_article_google-mandiant-ai-agents-credential-harvest-six-hours)** — AI agents that work for you, not against you.

• Autonomous workflows for content, outreach, and ops.
• Built-in Vault protection for secrets and PII.
• No code, no complexity — just results.

[See how Solo works →](https://solo.trustai.center?utm_source=news&utm_medium=organic&utm_campaign=news_article_google-mandiant-ai-agents-credential-harvest-six-hours)

For SEO teams: don't leak strategy in prompts

If you're using AI for SEO content, you're pasting:

• Keyword research (competitive advantage).
• Client URLs (confidential projects).
• Traffic data (business secrets).

[ChatSEO](https://seo.trustai.center?utm_source=news&utm_medium=organic&utm_campaign=news_article_google-mandiant-ai-agents-credential-harvest-six-hours) optimizes for search engines and protects your strategy.

• Keyword research + competitor gap analysis.
• Schema markup and semantic structure.
• Multi-language support (EN, FR, DE).

[Try ChatSEO free →](https://seo.trustai.center?utm_source=news&utm_medium=organic&utm_campaign=news_article_google-mandiant-ai-agents-credential-harvest-six-hours)

Bottom line: Google's Threat Intelligence Group just documented the first production-grade autonomous AI attack — financially motivated threat actors used multi-agent frameworks to harvest thousands of credentials in six hours.

What's new:

• Agents handled vulnerability scanning, exploitation, and IP rotation without human oversight.
• A single exposed C2 dashboard managed 23,800+ secrets (cloud, AI, and database credentials).
• The attack collapsed traditional dwell time from days to hours.

What you need to do:

• Real-time secret monitoring — detect and rotate compromised credentials immediately.
• AI API key hygiene — scope, rate-limit, and audit all AI keys.
• Assume breach posture — segment networks, enforce zero-trust, and log everything.

If you're using AI agents in production, your secrets are a target. Protect them.

[Start with TrustAI Vault (4-day trial) →](https://www.trustai.center/login?next=%2Fapp%2Fsettings%2Fbilling%3Fplan%3Dpro%26auto%3D1&utm_source=news&utm_medium=organic&utm_campaign=news_article_google-mandiant-ai-agents-credential-harvest-six-hours)