Observed incident

AI-assisted attacker builds a credential-harvesting operation in hours

Reported

What happened

Mandiant investigated an attacker who used an AI coding chatbot inside a compromised cloud environment to build and run scanning and credential harvesting in less than six hours.

Parties and reporting

AI tools and systems: Unspecified AI coding chatbot, Agent instruction files

Outcome

Google reported thousands of compromised third-party credentials; the actor, victims and AI model were not publicly identified.

Operating lesson

Restrict cloud credentials and outbound scanning, and alert on agent-driven bulk secret discovery.

Evidence and limits

Activity occurred in the second quarter. The report supports rapid automation, not a claim of fully autonomous discovery of new vulnerabilities.

Sources