Google confirms the first mass credential theft carried out by AI agents in 6 hours: cyberdefence can no longer keep up

By Zendoric · September 9, 2026.

Google has documented, in more granular detail than ever before, a real operational leap in the offensive use of artificial intelligence: autonomous agents capable of planning, writing and executing a complete cyberattack without direct human intervention. According to the 'AI Threat Tracker' report, published this Tuesday by Google's Threat Intelligence Group (GTIG, the unit that tracks state and criminal threat actors), mass credential-theft campaigns orchestrated through multi-agent architectures —several AI models coordinated with one another, each with a different task— and deployed on stolen infrastructure have compromised thousands of accesses in barely six hours.

The figure matters for what it measures, not just for what it says: six hours is a window far below the typical reaction time of a corporate security team, usually counted in days. GTIG sums it up as a 'force multiplier': AI does not invent new attacks, it accelerates and scales the ones that already existed, concentrated for now in the technology, healthcare, media and entertainment sectors, in Europe and North America.

The report attributes specific activity to several groups —an attribution we credit to the source, GTIG, not as a fact independently verified by Zendoric. According to Google, a China-linked actor identified as Basin Castle uses language models to research targets in real time and fix code errors during the intrusion itself; a group called TeamPCP focuses its activity on the software supply chain, with malware designed to manipulate AI coding assistants and suggest malicious links to developers; and North Korea-linked collectives hijack legitimate accounts to connect their systems en masse to AI platforms and thereby optimize the generation of malicious code and industrial espionage. Google also points to activity linked to Russia and Iran, without further detail in what has been published.

Beyond the individual attack, GTIG describes a longer-range objective: cybercriminals themselves steal intellectual property tied to AI development and hijack cloud computing capacity to run their own models. In parallel, it documents the stockpiling of encrypted data under the 'harvest now, decrypt later' logic: storing today what cannot be broken, waiting for a future capability to make it possible.

The immediate context helps place the moment: a month earlier, OpenAI had paused the rollout of a model (Astra) after rating its own cybersecurity risk as 'critical', having demonstrated the ability to identify vulnerabilities and map out attacks autonomously. Two different labs, the same alarm: the frontier of offensive capability is no longer merely theoretical or confined to the lab, it is showing up in real traffic.

Here it is worth separating the headline from the hard data. At Zendoric we have been insisting that the most-cited cybersecurity benchmarks are saturated and no longer discriminate well between which model is genuinely dangerous; what really informs are the 'unguided' tasks (without human help), of the AISI or CVE-Bench type. Google's report is not a benchmark, it is telemetry from real attacks, and that is why it carries more weight: it confirms in production what the benchmarks only hinted at in the lab.

The quote from John Hultquist, GTIG's chief analyst, sums up the structural problem: the challenge grows harder as AI acts autonomously, creating —in his words— 'a faster adversary at greater scale', because criminals will lean toward attacks that execute faster than the defense can respond. It is an uncomfortable admission coming from someone who sells, precisely, AI-based cyberdefense.

Our reading: this is exactly the kind of short-term cost that should not be played down. The same agentic architecture that multiplies the productivity of a developer or a security analyst also multiplies that of an attacker, and it does so asymmetrically: defending an entire infrastructure takes longer than finding the weak link. As long as defense depends on detection and patching cycles measured in days while the attack executes in hours, the imbalance will grow before it corrects. It is not solved by banning the technology —the same labs that sell it as defense, Google included, are the ones documenting its offensive use—, but by leveling the race: more investment in defensive agents deployed at the same pace as the offensive ones, and governance based on evidence from real attacks, not on panic.

In the medium term, the pattern GTIG describes —theft of AI intellectual property, hijacking of cloud compute, stockpiling of data for future decryption— points to something broader than classic cybercrime: computing capacity and the models themselves have become the asset being stolen, not merely the means to steal something else. It is the same logic already visible in chip export controls: when the most valuable good is access to frontier AI, controlling it, stealing it or sabotaging it becomes the objective in itself.

None of this changes Zendoric's underlying thesis: the same technology documented here as a weapon is the one that, across the rest of the industry, accelerates medical diagnoses or multiplies the production of clean energy. But the transition toward abundance is neither automatic nor free, and cybersecurity is one of the fronts where the short-term cost is already being paid, in real time, not in some hypothetical future.