I’ve written before about AI agents going off the leash in security tests. Google’s Threat Intelligence Group has now documented the same thing happening in the real world, and the numbers are the kind that make you put the coffee down.
In its September 8 AI Threat Tracker, GTIG describes a financially motivated actor that compromised an organisation’s cloud infrastructure, then used an AI coding chatbot, a prompt and a set of agent instructions to plan, build and execute a mass credential harvesting campaign in less than six hours. Not six days. Six hours. The agent managed the vulnerability scanning pipeline, performed real-time troubleshooting and rotated IP addresses without a human touching it.
The malware that poisons your AI tools
The same report tracks a group Google calls UNC6780 (TeamPCP), which has been hammering the open source supply chain since March, hitting PyPI, npm and Docker Hub. Its DUSTMAKER credential stealer now hides malicious files inside the workspace folders of Claude, VS Code and Cursor, so the AI assistant reads them as routine project files.
Here’s the clever part. DUSTMAKER drops prompts into those hidden folders that instruct the AI assistant to run arbitrary commands on the developer’s behalf. It also embeds extreme adversarial text in JavaScript comments to make LLM security scanners refuse to analyse the malicious code underneath, and it steals OIDC tokens from GitHub Actions runners to publish compromised packages with valid SLSA attestations. Every trust check an AI coding agent relies on, this thing walks around.
23,800 secrets and counting
Google also found an exposed command and control server running a framework called Recon, which had grown into a production dashboard organising, validating and managing over 23,800 harvested secrets, including API keys for cloud and AI services. That is a shift from passive infostealers to offensive agentic harvesting, with AI agents researching vulnerabilities, scanning infrastructure and executing exploits with minimal human involvement.
Threat actors are also targeting AI assets directly. Proprietary models, source code, API credentials and even cloud compute quotas are now high-value targets for espionage and extortion, and Google says distillation campaigns against its models have exceeded 100 million prompts. When the model itself becomes the target, every AI deployment becomes an asset to protect, not just a tool to use.
The CISO side of the ledger
Proofpoint’s 2026 Voice of the CISO report landed the same week, and it shows defenders feeling the squeeze. Seventy-eight per cent of security leaders now call generative AI a security risk, with the potential loss of customer data through public AI platforms their top concern. Yet 79 per cent say they are expected to manage AI-related risks without a proportional increase in resources or expertise.
Human risk remains the biggest vulnerability for 79 per cent of respondents, and at organisations that lost material data, 93 per cent said departing employees played a role. Cloud account takeover has overtaken email fraud and ransomware as the top threat. The tools employees lean on to work, the accounts that hold their access and the AI assistants they trust: that is the new attack surface.
What you do about it
- Treat AI coding assistants as part of your software supply chain. Audit the workspace folders and configurations your agents read, because that is where DUSTMAKER hides.
- Lock down CI/CD identity. OIDC token theft lets attackers publish packages with valid signatures, so rotate secrets and watch GitHub Actions workflows for suspicious AI-themed tasks.
- Assume AI-assisted speed. If attackers can plan and run a campaign in six hours, your response plan needs to be measured in minutes, and your patches need to land fast.
- Give your CISO room. Most security leaders are managing AI risk without extra resources. That is a board decision, not a technology one.
Attackers aren’t waiting for permission, and neither are the agents. The window between a vulnerability appearing and an automated exploit running is now measured in hours. Plan for machine speed, because that is the only speed left.
Related Reading
GitSpawn: The Booby-Trapped Repo That Runs Code in Claude Code, Codex and Cursor
Hidden Prompt Injection Is Hijacking AI Agents
Rogue OpenAI Agents Used 10+ More Sites as Secret Message Boards
The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.
