Criminals Are Wiring Up AI 'Agents' to Steal Passwords at Scale, Google Warns

Key points

• Google's Threat Intelligence Group says attackers have shifted from asking chatbots for help to running multi-agent AI systems that handle whole attacks with little human input.
• One financially motivated crew set up an autonomous AI pipeline inside a hacked cloud account and launched a mass password-stealing campaign in under six hours.
• Researchers found an exposed attacker server called Recon that was managing more than 23,800 stolen secrets such as API keys in real time.
• China-linked spies are testing AI-assisted hacking pipelines, and Russia-based UNC5792 is using AI to scan Telegram channels for intelligence.
• Google says fully automatic hacking isn't yet common, and its own Gemini model flagged and helped shut down several of these operations.

Google's threat researchers have a new warning: the criminals aren't just chatting with AI anymore. They're building it into their attack tools.

The Google Threat Intelligence Group (GTIG) this week described attackers stitching together "multi-agent" AI systems: several AI programs working as a team, each handling a discrete job (scanning, stealing, covering tracks) and communicating with each other, with a human barely touching the keyboard. That's a step up from what defenders saw last year, when the abuse was mostly hackers asking a chatbot to write a phishing email or a bit of malware.

What actually happened?

GTIG, drawing on cases handled by Google's Mandiant incident response team, describes one attack that reads like a demo reel for the new approach. Our 3 September story on an AI-assisted ransomware crew that tore through a corporate network in under ten hours flagged this pattern as a signal, not an outlier. This new case shows it isn't slowing down.

A financially motivated group broke into a company's cloud account and set up their own AI framework inside it: a coding assistant, a written prompt, and a set of instructions in a plain-text format called markdown. Within six hours the system was running a mass credential-harvesting campaign, hunting for login details and access keys across other companies' systems.

The AI agents ran the vulnerability scans, collected thousands of stolen third-party credentials, fixed their own errors when something broke, rotated the internet addresses they were operating from, and bounced traffic through legitimate but hacked cloud accounts so defenders wouldn't spot it. When the attacker doesn't have to sit there clicking, defenders have far less time to react.

The 'Recon' server and 23,800 stolen secrets

Researchers also found an exposed command-and-control server, the machine attackers use to give orders to their tools, running a framework the crew called Recon. On it were instructions for AI agents, knowledge files, and a live dashboard managing more than 23,800 harvested secrets, mostly API keys that let software log into other services without a password.

First reported by BleepingComputer, the case shows how quickly a small operation can pile up access to a lot of other people's systems once AI is doing the sorting.

Who else is doing this?

GTIG says China-linked spying groups are experimenting with AI-assisted exploitation pipelines: automated chains that find a vulnerability, break in, and keep digging. Russia-based UNC5792 has plugged AI models into monitoring bots that trawl Telegram channels for information the Kremlin cares about. Other state-backed groups are still using AI for reconnaissance, phishing, malware development and propaganda.

Google also points to supply-chain attacks by a group it tracks as UNC6780, and to a growing black market in stolen AI account logins and API keys.

Should ordinary people worry?

Not directly, but indirectly yes. None of this targets your laptop at home. It targets the companies that hold your data.

The practical upshot is old but still true: use a password manager, turn on two-factor authentication (a second login step, usually a code sent to your phone), and treat unexpected password-reset emails with suspicion. If attackers are harvesting credentials faster, reused passwords will burn you faster too.

GTIG stresses one important caveat. It hasn't seen fully autonomous hacking, the kind where an AI finds a brand-new flaw and exploits real targets entirely on its own, happening in the wild. Google also says Gemini caught several of these abuse attempts early, letting the company ban the accounts involved and disrupt the campaigns.

For now, this is script-kiddie automation with a much smarter engine bolted on. Quite enough to be getting on with.