Google threat report says attackers prompt-inject AI coding assistants and run agent campaigns

What Google reported

Google Threat Intelligence Group (GTIG) published its AI Threat Tracker on 8 September 2026. The report covers the second quarter of 2026 and draws on Mandiant incident response work, threat actor tracking and Google's own platform defences. Its headline is that leading attackers have moved from simple prompting to agentic workflows and automation, which shortens the time defenders have to respond.

The clearest prompt injection case involves UNC6780, a financially motivated group also known as TeamPCP. Since March 2026 it has compromised open source packages on PyPI, npm and Docker Hub. Google says its DUSTMAKER credential stealer drops configuration files into hidden workspace folders that AI coding tools read, such as .claude, .vscode and .cursor. Those files instruct the AI assistant to run attacker scripts during routine developer work. The group also published trojanized forks of MCP servers to PyPI.

Injection aimed at AI security scanners

A second trick targets defenders. DUSTMAKER loader scripts start with comments full of extreme adversarial text referring to biological and nuclear weapons. Google assesses the aim is to make LLM-based security scanners refuse or skip the file on safety grounds, so the malicious code below is never analysed. Inside compromised CI pipelines the malware also creates tasks with AI-themed names such as Copilot Setup and deletes workflow logs.

Google says these activities triggered Gemini's safety responses, that it disabled assets linked to the actors, and that Google DeepMind used the findings to strengthen classifiers and the model itself. In one Mandiant case, UNC6780 handed access to a separate extortion actor that stole a company's proprietary AI repository.

Agents, distillation and stolen AI accounts

Mandiant observed a suspected financially motivated actor use an AI coding chatbot, a prompt and a set of markdown agent instructions to plan, build and run a mass credential harvesting campaign from a victim's cloud in under six hours, compromising thousands of third-party credentials. GTIG also found an exposed command server whose dashboard managed over 23,800 harvested secrets. A PRC-nexus group tried to use Gemini to design an automated penetration testing framework, an effort Google says it disrupted.

On model theft, Google says distillation campaigns against its models now arrive regularly, some exceeding 100 million prompts, and that it can identify Gemini-distilled models. Underground prices for AI accounts more than doubled in 2026, with demand concentrated on Claude and Gemini credentials. GTIG adds that it has not yet seen fully autonomous exploitation pipelines used against targets in the wild.

What to watch next

The report gives defenders two concrete checks: treat hidden AI tool folders in repositories as executable configuration, and do not rely on an LLM scanner alone when a file contains text built to trigger refusals. Victim counts and losses for most cases are not stated. More reporting on injection attacks is collected under Cybersecurity.

Questions people ask

How did UNC6780 use prompt injection?

Google says its DUSTMAKER malware placed configuration files in hidden AI tool folders such as .claude and .cursor that tell the coding assistant to run attacker scripts, and added adversarial text to make LLM security scanners skip the code.

Did Google see fully autonomous AI attacks?

No. GTIG says it has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild, although agent-assisted campaigns are cutting attack times sharply.

What is a distillation attack?

An attempt to copy a model's capabilities by querying it at scale and training another model on the answers. Google says some campaigns against its models exceeded 100 million prompts.

Sources

1. GTIG AI Threat Tracker: From Prompting to Autonomy, The Evolution of Adversarial AI (Google Threat Intelligence Group, 8 Sep 2026)