Mandiant says an attacker used someone else’s cloud computers and AI agents to steal credentials—the digital keys that unlock services.
Source: Google Threat Intelligence Group / MandiantThe attacker first took over another organization’s cloud computers, Mandiant reports.
Google Threat Intelligence Group / MandiantAI managed scans and troubleshooting. The operator supplied the task and instructions.
Google Threat Intelligence Group / MandiantThe reported result was credential theft. A credential is a digital key; collecting it does not prove every door was opened.
Google Threat Intelligence Group / MandiantThink of an intruder using someone else's workshop to collect digital keys. This is an illustration, not an additional account of what happened.
An analogy for the mechanism; not an additional claim about the incident.Thousands of third-party credentials were compromised. Planning, building and executing the harvesting campaign took under six hours, the investigators report. Google Threat Intelligence Group / Mandiant
Credentials are not a count of breached organizations. Subsequent account use and financial losses are unspecified.
The six-hour figure concerns this workflow, not time to compromise any organization.
People still gave the AI its task and instructions; this is not evidence of an entirely human-free attack.
No public actor or victim identity links this case to an existing entry. Its grouping may change if later evidence establishes overlap.
An organization needs to notice when its computing resources are being used against others, as well as protect the permissions attached to its own credentials.
Google reports disruption across these agent-related activities; this case's complete outcome remains unspecified. Google Threat Intelligence Group / Mandiant
Editorial defense mapping: control what runs in your cloud and what an exposed credential can reach.
Connect workload, sign-in and network events; investigate unfamiliar running programs and unexpected outbound activity. Revoke compromised identities and isolate affected systems.
Traffic volume alone is not proof of an attack. Useful detection depends on coverage and the context of legitimate work.
Inventory internet-facing applications, investigate suspected flaws, and verify deployed repairs. Review which applications can read sensitive credentials.
This is general defensive relevance; the publication does not establish the initial cloud-compromise method or a specific missing patch.
Rehearse how responders connect suspicious events, preserve evidence, and stop unauthorized activity under a clear approval policy.
The victim cannot set policies for an attacker's AI. Fast triage still requires validated evidence and authority to act.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Sep 11, 2026 · Editorial methodology · Structured data