GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI

Executive Summary Since the release of our May 2026 report detailing adversarial misuse of artificial intelligence (AI), Google Threat Intelligence Group (GTIG) has observed forward leaning adversaries transition from basic prompting to agentic AI workflows and AI-enabled automation. In these operations, human-in-the-loop latency is dramatically reduced, compressing the traditional window for defenders to respond. In Q2 2026, GTIG observed threat actors compromise a cloud resource, then plan, build, and execute an agent-enabled mass credential harvesting campaign in under six hours. We also tracked UNC6780 using multiple tactics to trick AI coding assistants and large language model (LLM) security scanners into its open source software supply chain compromises. Threat actors are also increasingly targeting AI assets. GTIG observed adversaries with wide-ranging motivations target proprietary AI models and source code, exfiltrate application programming interface (API) credentials, and co-opt victim cloud environments to sustain unauthorized AI workloads. This shift underscores that enterprise AI assets—from model weights to cloud compute quotas—are high-value targets for espionage, extortion, and resource theft. Key Q2 2026 trends include: Expanding Software Supply Chain Risks: The integration of AI-assisted coding tools and open source software has accelerated software development cycles but also increased operational risks, with threat actors actively targeting developers, AI coding assistants, and LLM security scanning tools. Targeting Proprietary AI IP: GTIG observed increasing instances of adversaries targeting proprietary AI models, code, prompts, and research across sectors including healthcare, government, and media. Shift Toward Agentic AI and Automation: Adversaries are deploying multi-agent frameworks that autonomously manage scanning pipelines, resolve operational errors, and execute credential harvesting at scale. Multi-Stage Lifecycle Augmentation: State-sponsored and cyber crime groups continue to use AI capabilities as force multipliers across the attack lifecycle—from target reconnaissance and social engineering lure creation to custom malware obfuscation and post-exploitation troubleshooting. They are also experimenting with scaling information operations (IO) campaigns. Illicit Account Procurement & LLMJacking: To circumvent access costs, adversaries are stealing developer credentials, purchasing compromised AI platform accounts, and hijacking enterprise cloud infrastructure to run unauthorized high-performance compute workloads. Grounded in telemetry from frontline Mandiant incident response engagements, global threat actor tracking, and live platform defenses, this report details how state-sponsored espionage groups, financially motivated cyber criminals, and information operations (IO) threat actors are operationalizing AI tools in the wild. At Google, we are committed to developing AI boldly and responsibly. Our multifaceted defense strategy integrates proactive model-level safeguards, specialized threat intelligence, and targeted containment protocols to protect our customers and infrastructure. We continuously harden our models against misuse, mitigate malicious activity through proactive disruption of bad actor projects and accounts, and use our autonomous Google AI Threat Defense architecture to operationalize security across enterprise environments. AI-assisted coding pipelines increase open source supply chain risk As discussed in our May report, with organizations continuing to integrate various types of LLMs into production environments, the AI software ecosystem has become a primary target for exploitation. AI-assisted coding has led to increases in the overall quantity of open source software resources available, and a greater variety of open source resources specifically intended for supporting AI use cases, such as model context protocol (MCP) servers, model weights and formats, inference and serving engines, and vector databases. AI assistants have also accelerated the speed of development for both human developers and automated agents, likely resulting in reduced scrutiny of third-party packages and dependencies. Meanwhile, open source maintainers are grappling with an influx of AI-discovered vulnerability reports. These shifts in software development practices and reliance on open source software present operational risks; GTIG believes that AI-assisted coding practices contributed to the notable large scale software supply chain compromises we observed in 2025 and early 2026. During this time frame, we observed several examples of threat activity seeking to abuse the intersection between AI coding and open source software: In early 2026, Mandiant Managed Threat Defense detected attempted downloads of malicious open-source AI resources across enterprise environments in North America and Asia. In April 2026, public research confirmed an AI coding agent incorporated a malicious cryptocurrency-themed dependency into an active codebase associated with a legitimate cryptocurrency trading project. In May 2026, GTIG identified malicious open source packages that surreptitiously install LLM proxy services that allow threat actors to bypass regional LLM access restrictions by routing traffic through the proxies. Cyber Crime Threat Actor Illustrates Growing Open Source Supply Chain Risk Operations attributed to the financially motivated threat actor UNC6780 (TeamPCP) highlight the growing severity of threat actor exploitation of AI and the open source supply chain. Since March 2026, UNC6780 has conducted a series of large scale open source software supply chain compromises targeting ecosystems including PyPI, npm, and Docker Hub. Following initial compromise, UNC6780 typically deploys credential stealers to obtain proprietary data and credentials, which are subsequently monetized either through the direct sale of the stolen data or through partnerships with ransomware and data theft extortion groups. The publicity, apparent success, and open-source release of UNC6780's malware will likely spur adversary emulation of these tactics. In addition to targeting AI environments and software dependencies as an initial access vector, UNC6780 collects credentials to AI tools alongside other credentials, and targeted AI assets. In one case, Mandiant responded to a compromise in which UNC6780 established initial access then handed the access off to a separate threat actor who subsequently issued a ransom demand using LAPSUS branding. Evidence indicates that UNC6780 created a malicious GitHub Actions workflow for the company’s proprietary AI repository, and that the extortion actor exfiltrated a copy of this AI repository. Beyond these demonstrated tactics, UNC6780 has also implemented more than half a dozen different methods to target or exploit AI tools and open source software development practices. Several of these functionalities were embedded within their DUSTMAKER credential stealer malware. UNC6780 Supply Chain Compromise Vectors Targeting AI Coding Assistants Target: AI Coding Assistants and Human Developers UNC6780 compromised legitimate developer accounts to publish trojanized forks of legitimate MCP servers to the PyPI registry, such as tiktoken_mcp, and inject malicious code directly into official organizational GitHub repositories, such as azure-functions-mcp-extension. By backdooring these MCP tools and integrations, the attackers ensured their payloads and malicious workspace hooks were automatically ingested into developer environments whenever the assets were downloaded or cloned. Target: AI Coding Assistants DUSTMAKER samples contain functionality to detect when it is running in a continuous integration and continuous delivery (CI/CD) environment. If confirmed, it extracts OIDC tokens from the process memory of GitHub Actions runners. Using these tokens, DUSTMAKER authorizes itself as a trusted publisher and publishes compromised versions of packages with valid, cryptographically signed SLSA Build 3 attestations. Packages published with valid tokens will pass AI coding agent automated trust checks. Table 1: TeamPCP initial infection vectors targeting AI developers and tools DUSTMAKER Functionalities that Interact with AI Defense Evasion via Hidden Directories DUSTMAKER drops or modifies malicious files into hidden project workspace directories for AI coding assistants and integrated development environments (IDEs) (.claude/, .vscode/, .cursor/, etc.). By hiding files inside project folders that AI tools manage and parse, the malware blends into routine developer noise and avoids interacting with systems that endpoint detection and response (EDR) monitors more closely, like Windows Registry Keys or /etc/cron.*. Config Hijacking for Persistence DUSTMAKER uses the dropped files to create automated build or startup commands so that the malware executes automatically whenever the IDE or AI extension opens the workspace. Behavioral Manipulation through Prompt Injection DUSTMAKER uses malicious configuration files inside hidden project directories to instruct the AI assistant to run arbitrary commands or scripts (such as setup.mjs) during routine developer interactions. This effectively forces the AI model to execute commands on the attacker's behalf without the developer's knowledge. Masquerading CI/CD Pipeline Tasks as Legitimate AI Utilities Within compromised CI/CD environments, such as GitHub Actions, DUSTMAKER creates malicious pipeline tasks disguised under AI-themed names such as “Copilot Setup” to identify additional access tokens and keys, as well as to propagate itself. DUSTMAKER issues automated API calls to delete the workflow execution logs to prevent security teams from noticing the execution in the GitHub UI. Prompt Injection to Defeat LLM Security Scanners In addition to prompts embedded in configuration files targeting AI coding agents, DUSTMAKER samples included