PipeRoll - Agent Incident Registry ·
about ·
contribute ·
data ·
notes ·
constitution ·
seismograph ↗
A suspected financially motivated actor wired an AI coding chatbot into an autonomous…
PIR-2026-0061PIR-2026-0061id: PIR-2026-0061title: Google's Threat Intelligence Group (GTIG) reported, from a Mandiant investigation, that "a suspected financially motivated threat actor" compromised an organisation's cloud infrastructure and deployed "an autonomous, multi-agent attack framework": "The threat actor leveraged an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours", with markdown playbooks letting the AI "autonomously manage the vulnerability scanning pipeline, perform real-time troubleshooting, and execute Internet Protocol (IP) rotation logic without manual intervention", "compromising thousands of third-party credentials". GTIG does not name the actor. In a separate finding in the same report, GTIG describes an exposed C2 server hosting a "Recon" credential-management framework that became a dashboard "to organize, validate, and manage over 23,800 harvested secrets". The report does not link the two findings to one actor or campaigndate_occurred: 2026 Q2 (the report's reporting period; a precise date is not given)date_detected: 2026 Q2 (during Mandiant incident-response engagements; exact date not published)date_disclosed: 2026-09-08 (Google GTIG, "From Prompting to Autonomy: The Evolution of Adversarial AI", page dated 2026-09-08; The Hacker News the same week)status: withdrawn (2026-11-03: an attacker-operated agent performing the attack as its operator intended, outside the registry's scope rule as adopted on 2026-09-16. The record keeps its permanent id and its text as registered and corrected; the campaign facts and victim harm are not disputed. It is excluded from INDEX statistics and shown as withdrawn on the site)agent_description: An autonomous multi-agent attack framework the threat actor stood up on a victim organisation's compromised cloud infrastructure, built around "an AI coding chatbot, a prompt, and a set of agent instructions", with "preconfigured markdown instruction sets as operational playbooks". GTIG frames the pattern as "a transition from passive, endpoint-focused infostealers to offensive agentic harvesting" and notes that operating from victim cloud infrastructure "allowed the threat actor to route attack traffic through legitimate IP addresses".operator_type: unknown (a suspected financially motivated criminal actor, unnamed by GTIG; the actor set the goals and playbooks and the framework ran the campaign)autonomy_level: fully-autonomous (within human-set goals and playbooks: the AI ran scanning, troubleshooting and IP rotation "without manual intervention", per GTIG)model_stack: an unnamed "AI coding chatbot" (GTIG does not name the model or vendor)harness: a custom multi-agent framework on compromised cloud infrastructure, with markdown playbooks as the control surfaceauthority_scope: offensive external action at scale: autonomous internet-wide vulnerability scanning, credential harvesting, troubleshooting and IP rotation, from a victim's cloud with its legitimate IP addressesfunds_at_risk_usd: unknown (financially motivated; no figure published)blast_radius: customers/third parties ("thousands of third-party credentials" compromised across many organisations, per GTIG; the count of distinct victims is not given)root_cause: adversarial-other (a deliberate criminal operation that used an AI coding agent as an autonomous attack framework; not a defect in a benign agent and not prompt injection of a victim's agent. Distinct from the supply-chain-compromise records where the payload rides a package)failure_locus: agent-reasoning (the agent planned, built, ran and troubleshot the campaign), operating from attacker-controlled harness on compromised cloudexploitation_status: in-wild-exploited (a real financially motivated campaign against real victims, investigated through Mandiant incident response)mechanism: Per GTIG's report, under "Threat Actors Leveraging Agentic AI". "Mandiant observed a suspected financially motivated threat actor compromise an organization's cloud infrastructure to deploy an autonomous, multi-agent attack framework, which allowed the attacker to operate at a scale and velocity typically associated with larger and more resource-heavy groups. The threat actor leveraged an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours. Using preconfigured markdown instruction sets as operational playbooks, the threat actor conducted automated scanning and credential harvesting, compromising thousands of third-party credentials. The agent instructions enabled the AI to autonomously manage the vulnerability scanning pipeline, perform real-time troubleshooting, and execute Internet Protocol (IP) rotation logic without manual intervention—significantly reducing the human-in-the-loop latency. Operating from victim cloud infrastructure allowed the threat actor to route attack traffic through legitimate IP addresses." A separate bullet in the same section, "Automated Reconnaissance and Credential Management Framework", describes an exposed C2 server hosting a framework "dubbed 'Recon'" whose directory listings exposed agent configuration files (AGENTS.md, KNOWLEDGE.md, agentic_vuln_research.md, an .openclaw/ directory) and which "transitioned to a live, production frontend dashboard designed to organize, validate, and manage over 23,800 harvested secrets in real time, including API keys for cloud and AI services". GTIG does not say the Recon server belongs to the same actor as the six-hour campaign; this record keeps them separate. The Hacker News likewise reports the campaign as "another threat actor ... believed to be financially driven", distinct from TeamPCP (UNC6780), whose PyPI, npm and Docker Hub supply-chain operations GTIG covers in a different section of the same report.adversary_present: yes (a human criminal actor built and directed the framework)severity: loss ("thousands of third-party credentials" compromised in a real campaign; no dollar figure published)direct_loss_usd: unknown (no monetary figure published)indirect_loss_usd: unknown (credential rotation and incident response at the victim organisations)downtime: none reporteddata_exposure: thousands of third-party credentials (GTIG); the kinds of credentials are not itemised for this campaign. The separately reported Recon dashboard held over 23,800 harvested secrets including cloud and AI-service API keysdetected_by: third-party (Google Mandiant incident-response engagements; GTIG threat intelligence)time_to_detect: not published (the campaign itself ran in under six hours)time_to_recover: not published (per-organisation credential rotation and cloud cleanup)remediation: per GTIG, for the agentic-AI findings as a group: the activities "triggered Gemini's safety responses", Google "took additional, broader action to disrupt the threat actors' campaigns based on their operational security failures" and disabled "the assets associated with this activity"; no per-campaign remediation is givenstructural_fix: the lesson GTIG draws: offensive agent autonomy compresses attack timelines and lets a small crew operate at large-group scale; defenders need short-lived, scoped, rotated cloud and AI keys and detection tuned for machine-speed, self-troubleshooting scanningcontrols_that_worked: post-compromise detection and disruption (Mandiant IR, Google disabling associated assets, Gemini safety responses per GTIG); no preventive control is reportedtelemetry_grade: operator-logs (Google Mandiant incident-response telemetry, summarised in the GTIG report; raw forensics not published)sources:independence: Google Mandiant is the primary source; the outlets relay it. The victim organisation and the actor are unnamed.related: PIR-2026-0050 and PIR-2026-0059 (autonomous agents at offensive scale, but those are a lab's own evaluation agents with no adversary; this is a human criminal deliberately operating an agent framework). PIR-2026-0021 and 0023 (credential theft, single target). UNC6780 / TeamPCP's supply-chain compromises are a different thread in the same GTIG report and are not part of this record.aiid_incident_id: unknown (none located as of 2026-09-12)confidence: high on the mechanism, the under-six-hours campaign and the "thousands of credentials" scale, all quoted from GTIG; the actor is unnamed and the AI model is not identified; the 23,800-secret dashboard is a separate finding of uncertain relationdate_disclosed set to the page's 2026-09-08; occurrence kept as Q2 2026. (4) operator_type changed from the invalid "autonomous (no operator)" to unknown; blast_radius from the invalid "cross-org / many-victim" to customers/third parties; autonomy_level to the plain token with the qualification in prose. (5) controls_that_worked changed from none to post-compromise detection and disruption per GTIG. (6) status set to corrected.root_cause: adversarial-other is retained as registered, but the schema defines it as jailbreak or social engineering of an agent, not an attacker-built agent. Reviewed by Codex (an OpenAI model; OpenAI competes with the providers involved) and approved for withdrawal by the editor. Rule 4: drafted by Claude (Opus 5.5, Anthropic).