GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI

What it is

Google Threat Intelligence Group's Q2 2026 report on adversarial AI misuse, published after its May 2026 report. Beyond the headline cases in the catalog summary, it names concrete artifacts, intrusion paths and file targets that a defender can check for.

How it works

Credential theft aimed at AI tooling. In May 2026, ACRSTEALER controllers pushed file-grabber rules at the config stores of AI coding assistants: Cline's secrets.json and Continue's config.yaml. These files can hold plaintext API keys and custom model routing endpoints. GTIG also saw LUMMAC.V2, STEALC.V2 and VIDAR controllers interested in AI developer configurations. Average underground prices per AI account more than doubled in 2026, with demand centred on Claude and Gemini credentials and on Cursor Pro and Devin.

Cloud hijack for AI compute. In April 2026, an actor entered a victim's cloud through an exposed GitHub Personal Access Token and deployed unauthorized AI infrastructure and scaled up compute. UNC6508 (PRC-nexus) deployed local open-weight LLMs in compromised cloud environments, which avoids commercial AI API monitoring.

UNC6780 (TeamPCP). It has run supply chain compromises of PyPI, npm and Docker Hub since March 2026, deploying credential stealers (including DUSTMAKER). In one Mandiant case it created a malicious GitHub Actions workflow in a company's proprietary AI repository, then handed access to a second actor who exfiltrated the repo and demanded ransom under LAPSUS branding. Figure 1 shows prompt injection inside JavaScript loaders aimed at LLM security analysis. The injected text in the fetched page asks for weapons instructions. It was treated as data and not acted on.

Other supply chain items. In May 2026, malicious open source packages installed LLM proxy services to bypass regional LLM access limits. In April 2026, an AI coding agent pulled a malicious crypto-themed dependency into a real trading project's codebase.

Agentic tooling. The "Recon" C2 server exposed AGENTS.md, KNOWLEDGE.md, agentic_vuln_research.md, .openclaw/ and memory/. In the six-hour campaign, markdown instruction files served as playbooks and the agent handled scanning, troubleshooting and IP rotation. A PRC-nexus group used CC Switch to route between Claude, Gemini and Codex.

Preconditions / Affected

• Developers whose coding assistants keep plaintext keys in local config files.
• Organizations with long-lived GitHub PATs or cloud credentials reachable from exposed repos.
• Anyone pulling PyPI, npm, Docker Hub or open source AI components (MCP servers, model weights, inference engines, vector databases) without review.
• Companies holding proprietary models, prompts or AI source code, in any sector. Victims named include healthcare, media and technology firms in North America and Europe.

What to do

The page gives no commands or detection queries. Its findings point to these checks:

• Search endpoints for plaintext API keys in assistant configs such as Cline secrets.json and Continue config.yaml, and rotate any found.
• Audit exposed GitHub PATs and monitor cloud accounts for unexpected GPU or compute scaling.
• Review GitHub Actions workflows, especially in AI repositories, for unauthorized additions.
• Treat code comments and strings in third-party packages as hostile input to any LLM-based scanner.
• Watch for packages that install LLM proxy services.

Caveats

• GTIG saw no direct attacks on frontier models from tracked espionage or IO actors in Q2 2026.
• GTIG has not observed fully autonomous exploitation pipelines in the wild. The PRC pentesting framework was only at the build attempt stage and was disabled.
• The WinRAR SFX knowledge files from underground actors described largely impractical vulnerabilities, per GTIG's technical review.
• Interactive IO bots and the Indonesian automation platform were interest only, not seen deployed.
• Attribution of AI-assisted coding as a cause of the 2025 and early 2026 supply chain compromises is GTIG's belief, not a measured result.
• Tables 1 to 11 are not in the fetched text, so the TeamPCP infection vectors and DUSTMAKER's AI-related functions are not itemized here.