On September 8, 2026, the Google Threat Intelligence Group (GTIG) published its latest AI Threat Tracker, titled From Prompting to Autonomy, covering adversary activity in the second quarter of 2026. Its central case study is a campaign in which threat actors compromised a cloud resource and then planned, built and executed an agent-enabled mass credential harvesting operation in under six hours, using a multi-agent attack framework that ran from the victim's own cloud infrastructure with IP rotation logic and compromised thousands of third-party credentials. A related reconnaissance and credential management framework the report calls Recon stored more than 23,800 harvested secrets, including API keys for cloud and AI services, and was organised around files such as AGENTS.md and KNOWLEDGE.md - the same conventions legitimate coding agents use.
The report names a long list of actors. UNC6780, also tracked as TeamPCP, has run large open source supply chain compromises across PyPI, npm and Docker Hub since March 2026, using trojanized MCP servers, prompt injection aimed at LLM-based security scanners, and malware hidden in agent directories such as .claude/, .vscode/ and .cursor/. UNC6508, a PRC-nexus espionage actor, targets proprietary AI research at academic, medical and military institutions in North America and stands up local models in compromised cloud environments to stay out of commercial API monitoring. GTIG also describes distillation campaigns exceeding 100 million prompts aimed at its own leading models, and says average underground prices for stolen AI accounts more than doubled in 2026, with Claude, Gemini, Cursor Pro and Devin credentials in demand.
The significance is the direction of travel the title names. Earlier tracker reports described attackers using chatbots as assistants for lures and code snippets; this one documents AI agents doing the operational work end to end, and attackers treating AI infrastructure itself - MCP servers, agent config folders, model API keys - as the target. It lines up with Anthropic's September threat report and with SentinelLABS's earlier reading of agentic intrusions.
A sober caveat: this is one vendor's view of activity it could see, largely on its own platforms and customers, and it does not quantify how common the fully agentic operations are compared with ordinary intrusions. The six-hour figure is a single case, not a measured average.