Criminals Are Wiring Up AI 'Agents' to Steal Passwords at Scale, Google Warns
Google's threat researchers say attackers are moving past chatbot prompts and building small squads of AI programs that plan, scan and steal on their own.
Key points
- Google's Threat Intelligence Group says attackers have shifted from asking chatbots for help to running multi-agent AI systems that handle whole attacks with little human input.
- One financially motivated crew set up an autonomous AI pipeline inside a hacked cloud account and launched a mass password-stealing campaign in under six hours.
- Researchers found an exposed attacker server, called Recon, that was managing more than 23,800 stolen secrets such as API keys in real time.
- China-linked spies are testing AI-assisted hacking pipelines, and Russia-based group UNC5792 is using AI to scan Telegram channels for intelligence.
- Google says fully automatic hacking is not yet common, and its own Gemini model flagged and helped shut down several of these operations.
Google's threat researchers have a new warning: the criminals are not just chatting with AI anymore. They are building it into their attack tools.
In a report published this week, the Google Threat Intelligence Group (GTIG) describes attackers stitching together "multi-agent" AI systems. In plain terms, that means several AI programs working as a team, each doing a job (scanning, stealing, covering tracks) and talking to each other, with a human barely touching the keyboard.
That is a step up from what defenders saw last year, when the abuse was mostly hackers asking a chatbot to write a phishing email or a bit of malware.
What actually happened?
GTIG, which draws on cases handled by Google's Mandiant incident response team, describes one attack that reads like a demo reel for the new approach.
A financially motivated group broke into a company's cloud account. Inside that account they set up their own AI framework: an AI coding assistant, a written prompt telling it what to do, and a set of instructions in a plain text format called markdown.
Within six hours the system was running a mass credential-harvesting campaign, meaning it was hunting for usernames, passwords and access keys on other companies' systems.
The AI agents ran the vulnerability scans, collected thousands of stolen third-party credentials, fixed their own errors when something broke, swapped the internet addresses they were coming from, and bounced traffic through legitimate but hacked cloud accounts so defenders would not spot it.
Google's point is blunt. When the attacker does not have to sit there clicking, defenders have far less time to react.
The 'Recon' server and 23,800 stolen secrets
Separately, researchers found an exposed command-and-control server, the machine attackers use to give orders to their tools, running a framework the crew called Recon.
On it were instructions for AI agents, reference files, and a live dashboard managing more than 23,800 harvested secrets, mostly API keys that let software log into other services without a password.
First reported by BleepingComputer, the case shows how quickly a small operation can pile up access to a lot of other people's systems once AI is doing the sorting.
Who else is doing this?
GTIG says China-linked spying groups are experimenting with AI-assisted exploitation pipelines: automated chains that find a flaw, break in, and then keep digging.
Russia-based UNC5792 has plugged AI models into monitoring bots that trawl Telegram channels for information the Kremlin cares about. Other state-backed groups are still using AI in more familiar ways, for reconnaissance, phishing, malware writing and propaganda.
Google also points to supply-chain attacks by a group it tracks as UNC6780, and to a growing black market in stolen AI account logins and API keys.
| Case | What the AI did | Scale |
|---|---|---|
| Cloud credential-harvesting campaign | Ran scans, stole logins, rotated IPs | Built and launched in under 6 hours |
| Recon C2 framework | Managed stolen secrets in real time | 23,800+ API keys and secrets |
| UNC5792 (Russia) | Monitored Telegram for intelligence | Ongoing |
| Gemini distillation abuse | Extracting model behaviour via prompts | ~100 million prompts |
Should ordinary people worry?
Not directly, but indirectly yes. None of this targets your laptop at home. It targets the companies that hold your data.
The practical takeaway is old but still true: use a password manager, turn on two-factor authentication (a second login step, usually a code on your phone), and be suspicious of unexpected password-reset emails. If attackers are harvesting credentials faster, reused passwords will burn you faster too.
GTIG stresses one important caveat. It has not seen fully autonomous hacking, the kind where an AI finds a brand-new flaw and exploits real targets on its own, happening in the wild. Google also says its Gemini model caught several of these abuse attempts early, letting the company ban the accounts involved.
For now, this is script-kiddie automation with a much smarter engine bolted on. Which is quite enough to be getting on with.
