Six Hours, Thousands of Credentials, and Zero Surprise
Six hours. That's how long it took an autonomous agent setup to scan, harvest, and exfiltrate thousands of credentials, according to Google's Threat Intelligence Group. Not six weeks. Not six days. Six hours, with a human basically pressing "go" and checking back later.
Where this fits
This isn't a new attack technique wearing an AI costume. Credential harvesting, third-party token abuse, automated scanning against exposed endpoints, all of that is old-school opportunistic crime. What's changed is the labor cost of running the operation. A financially motivated actor took an AI coding chatbot, handed it preconfigured agentic instructions, and let it do the grunt work that used to require either a skilled operator babysitting scripts or a botnet-for-hire.
The other two pieces in the report matter just as much, arguably more, even though they're getting less headline space. DUSTMAKER used prompt injection against AI coding assistants specifically for defense evasion. That's a shift from "AI helps attackers write malware" to "AI assistants are now part of the attack surface being manipulated mid-operation." And nation-state groups are apparently using the same mainstream coding assistants for exploit dev, phishing content, and recon. Not bespoke offensive tooling. The same chatbots developers use to unstick a regex.
None of this is shocking if you've been paying attention to how fast agentic tooling got adopted internally at companies over the last year. The attackers are just following the same adoption curve defenders are on, except they don't have a change management process slowing them down.
The hype check
Here's what's getting overstated: the framing that this is some unprecedented AI-native threat requiring an entirely new category of defense. It's not. It's the same credential stuffing and third-party token abuse playbook, just executed faster. The six-hour number is scary because of speed, not because the technique is novel.
Here's what's getting understated: the defense evasion angle. Prompt injection against coding assistants to influence what code gets flagged, suggested, or shipped is a much weirder and harder problem than "attacker used a chatbot to write phishing emails." That's a supply chain trust issue baked into the tool developers use every day, and it deserves more scrutiny than it's getting in a story that leads with a big scary number.
Who benefits from the "AI agents are compromising thousands of credentials" framing? Everyone who wants budget for an AI security line item, honestly. Doesn't mean the underlying research is wrong, Google's threat intel team has no reason to inflate this. But the framing that travels furthest is always the one that sounds like science fiction, not the boring one about token scope and least privilege that would actually reduce the blast radius here.
What it means for the rest of us
If you're running credential-based integrations with third parties, the math just changed. Your window between "someone finds an exposed key" and "someone has drained everything reachable with that key" used to be measured in days for opportunistic actors, sometimes longer. Now assume hours. That should push teams toward tighter token scoping, shorter credential lifetimes, and actual monitoring for anomalous access patterns instead of hoping nobody finds the leak before rotation.
For anyone building on top of AI coding assistants, the DUSTMAKER angle is the one to sit with. If prompt injection can manipulate an assistant's output for defense evasion, the same class of attack can manipulate what it suggests to your own developers. That's not a hypothetical anymore, it's an observed technique. Code review processes that assume "the AI suggestion is neutral" need to stop assuming that.
Nation-states using consumer-facing chatbots for recon and phishing content isn't really an engineering problem to solve, it's a reminder that the barrier to reasonably competent offensive tradecraft dropped for everyone, including groups that previously had to invest real effort in tooling.
The open question
If the speed advantage is now firmly on the attacker's side, six hours from access to exfiltration, what does "fast enough" detection even look like anymore, and is anyone's current incident response process actually built for that timescale?
— Cor, Skyblue Soft
Sources
AI-assisted draft or imaging, human-curated, reviewed and edited.
Top comments (0)