From Prompting to Autonomy: How Threat Actors’ Use of AI Is Evolving

Google Threat Intelligence Group has released a new report on how threat actors are using artificial intelligence. Compared with the May report, the key change is that AI-assisted attacks are requiring progressively less human intervention.

AI is increasingly being used not just as an assistant, but as an orchestrator. In one case, after compromising an organization’s cloud infrastructure, a financially motivated threat actor used an AI coding assistant to plan, build, and execute a mass credential-harvesting campaign. Less than six hours passed from planning to launch, while the system autonomously managed vulnerability scanning, resolved errors, and rotated IP addresses — substantially reducing the need for manual oversight.

Agentic frameworks for offensive cybersecurity are becoming more mature. One example is Recon, a framework for automated reconnaissance and credential harvesting. Autonomous agents were used to identify vulnerabilities, scan server-side infrastructure, and carry out targeted exploitation. Researchers discovered more than 23,800 harvested secrets in the infrastructure associated with Recon, including API keys for cloud and AI services.

AI is also accelerating N-day exploit development. LLMs are being used to analyze recently disclosed vulnerabilities, prototype exploits, and build increasingly complex, multi-stage exploit chains. In one case, GTIG discovered a set of AI-generated artifacts targeting a recently patched Firefox vulnerability approximately one month after the patch was released.

At the same time, GTIG has not yet observed threat actors deploying fully autonomous chains against real-world targets along the lines of “AI finds a zero-day → develops an exploit → carries out the intrusion.” Recent research shows that frontier models can already identify zero-days and execute network intrusions autonomously, but for threat actors this remains largely an experimental capability.

Threat actors are increasingly using AI to link multiple stages of the attack lifecycle into a single workflow. This is not a new capability, but GTIG is now seeing longer and more autonomous workflows spanning reconnaissance → vulnerability discovery → exploitation → post-exploitation → credential harvesting.

AI tools themselves are becoming a new attack surface. Researchers are observing malicious instructions targeting AI coding assistants and LLM security scanners, attacks involving AI and software supply chains, and the theft of API keys, models, and source code. Some distillation campaigns — attempts to reproduce proprietary model capabilities from their outputs — have already exceeded 100 million prompts.

Compromised accounts for AI services and cloud resources are also becoming more valuable. Threat actors use them to gain access to commercial models, automate their own operations, and run costly workloads at the victim’s expense. In 2026, the average price of such accounts on underground marketplaces tracked by GTIG more than doubled.

What has changed since the May report?

GTIG had already documented several advanced use cases in May: a zero-day exploit that it assessed was developed with AI, experiments with AI-assisted malware obfuscation, AI components in the PROMPTSPY Android backdoor, agentic tools for reconnaissance and penetration testing, and attacks targeting the AI ecosystem itself.

In other words, the past few months have not brought a fundamentally new class of capability. The bigger change is in maturity and autonomy. In May, most observed AI use still centered on discrete tasks within the attack lifecycle, even though GTIG had already begun to see agentic workflows. Now, researchers are increasingly observing systems that connect more stages, handle operational problems with less human input, and require progressively less manual intervention. _ The shift looks more evolutionary than revolutionary. The main risk today is not a fully autonomous “AI hacker,” but the declining need for human involvement in existing attack workflows and the resulting increase in operational speed. One particularly important trend is the shrinking time between vulnerability disclosure and the availability of functional exploit code._