Google warns AI agents are automating credential theft at unprecedented scale

Agentic AI is enabling cybercriminals to coordinate complex infrastructure systems to steal credentials. These tools can manage multiple stages of an operation and reduce the time attackers spend moving between discovery, exploitation, and collection.

Google’s findings illustrate how AI is changing not only the scale of cybercrime but also the identity challenges organizations face. As autonomous software agents increasingly authenticate to cloud services using API keys and tokens rather than passwords, organizations are placing greater emphasis on governing machine identities alongside human ones.

The Google Threat Intelligence Group (GTIG) says it observed a suspected financially motivated attacker using an AI coding chatbot and a multi-agent framework to plan, build and execute a mass credential harvesting campaign in less than six hours.

Google says the operation compromised thousands of third-party credentials.

Mandiant observed the attacker deploy the multi-agent framework after gaining access to an organization’s cloud infrastructure. By operating from the victim’s environment, the attacker could send requests from legitimate IP addresses.

The cybercriminal used an AI coding chatbot, a prompt, and a collection of agent instructions to create the framework. They used preconfigured Markdown files as operational playbooks that instructed agents on how to carry out different parts of the campaign.

According to GTIG, the resulting system managed the vulnerability scanning pipeline, collected credentials, resolved technical problems as they arose, and rotated IP addresses without requiring manual intervention at any stage.

GTIG separately discovered an exposed command-and-control server hosting an automated reconnaissance and credential management system.

After GTIG detected the exposed directory, it developed a functioning dashboard to organize, check, and manage harvested secrets in real time.

The system contained more than 23,800 secrets, including API keys associated with cloud platforms and AI services.

Google describes Recon as a move beyond conventional infostealers that passively search infected endpoints for passwords and browser data. Instead, autonomous agents can identify vulnerabilities, scan infrastructure, conduct targeted exploitation and feed harvested credentials into centralized management systems.

But GTIG says their operators are now expanding that search to the configuration files used by AI development tools.

The incentive is growing because AI credentials have become valuable assets in their own right. Access to frontier AI models and the computing resources needed to run them carries direct financial value.

Stolen account credentials and API keys can allow attackers to use paid services while shifting the cost and attribution of that activity to the legitimate account holder.

GTIG says the underground market for this access expanded during 2026. The group observed more buyers seeking AI-related accounts and more sellers advertising them.

The average advertised price per account more than doubled during the year, according to Google.

The potential damage extends beyond unauthorized chatbot use. An API key may give access to a paid model’s quota, while a repository or cloud credential may grant access to source code, stored data, and computing infrastructure.

AI research organization METR provides another example of the costs involved.

An attacker discovered an exposed agent dashboard, prompted the agent to reveal its model provider API key, and used the credential for approximately 3 weeks.

The organization estimated that the consumed model credits would have been worth about $600,000,

Strong authentication remains essential for human users, but Google’s findings suggest the larger challenge is shifting toward machine identity. Organizations increasingly need to authenticate and govern the API keys, tokens and credentials used by applications, cloud workloads and autonomous AI agents after a user logs in.

NIST has warned that static API keys and long-lived bearer tokens do not prove the identity of the person or service presenting them. The agency says credentials used by AI agents should be dynamically issued and restricted to the intended recipient, and valid only for the required period.

Article Topics

AI agents  |  AI fraud  |  authentication  |  cybersecurity  |  digital identity  |  identity security  |  non-human identities