Attackers use autonomous AI agents to steal thousands of credentials in hours

Google's threat-intelligence team reported that a financially motivated attacker used an autonomous, multi-agent AI framework to compromise thousands of third-party credentials in under six hours, a pace that would take a human far longer. It is part of a broader shift in which criminals fold autonomous and coding-focused AI agents into operations, using them to get past defenses, reverse-engineer software, and sift stolen data. Google also found infostealer malware now specifically targeting AI developer configurations and credentials, and actors running open-weight models on compromised machines to sidestep restrictions on commercial services. The takeaway is that AI is collapsing attack timelines from days to hours, and AI access itself is now worth stealing.

Check

Assume attackers can now move at machine speed, and shorten detection and response for credential abuse: enforce phishing-resistant authentication, monitor authentication closely, and protect AI developer keys and configurations as sensitive credentials.

Affected

Organizations exposed to large-scale automated credential attacks; autonomous AI agents can test and abuse stolen credentials across many services in hours, and AI keys and developer configurations are now specific theft targets.

Fix

Adopt phishing-resistant, device-bound authentication, monitor for rapid credential-testing and anomalous automation, secure and rotate AI provider keys and developer configs, and assume the window between a leak and its abuse is shrinking.