Google Threat Intelligence: Autonomous Multi-Agent AI Framework Harvested Thousands of Credentials in Under 6 Hours

Google Threat Intelligence Group's report 'From Prompting to Autonomy: The Evolution of Adversarial AI' documents a financially motivated actor deploying a multi-agent framework - an AI coding chatbot, a prompt, and preconfigured markdown playbooks - that planned, built and executed a mass credential-harvesting campaign in under six hours. GTIG says the agents autonomously managed the vulnerability-scanning pipeline, rotated IPs, harvested third-party credentials, and routed traffic through compromised cloud environments, with chief analyst John Hultquist warning criminals will 'gravitate to attacks that are faster than we can respond to.'