Six hours, 23,800 secrets, and a threat report that stops asking whether attackers use AI

Google Threat Intelligence Group published its Q3 2026 AI Threat Tracker today, built on Mandiant incident response work and Google's own platform defenses. The incident to read is from Q2. A financially motivated actor compromised an organization's cloud infrastructure, deployed an autonomous multi-agent framework inside it, and ran a credential harvesting operation at scale in under six hours(opens in a new tab). An exposed command-and-control server held more than 23,800 harvested secrets in real time, including API keys. GTIG chief analyst John Hultquist states the operating assumption plainly: assume all threat actors are using AI in some capacity, and their operations have benefited.

Two things in the report matter more than the speed. The first is targeting. GTIG ties AI-assisted coding tools to large scale software supply chain compromises across 2025 and early 2026(opens in a new tab), naming PyPI, npm and Docker Hub as the ecosystems under attack. The second is the prize. A China-aligned actor is described going after proprietary AI research at North American academic and military institutions, and standing up local model infrastructure on compromised cloud environments. Read together, an enterprise AI program now occupies three positions at once: it supplies the attacker's labor, it is the newest and least governed supply chain in the building, and the data inside it is worth stealing on its own terms.

Check Point's ChatGPT finding, disclosed today, shows the third-party version of the same problem. A planted instruction ran a second stream of work in the same conversation turn and moved Gmail data to a different ChatGPT account. The channel was a shared internal package service where containers belonging to separate accounts could exchange data through metadata properties. OpenAI took that service offline. There is no update for a customer to install, because there was never a customer-side setting involved. No vendor questionnaire in circulation asks the question that would have surfaced it.

One useful counterweight. Forescout's Vedere Labs used Claude to port a pre-authentication remote code execution exploit between two WAGO controller models and executed shellcode on live hardware, at a cost of $535.74 in API usage over eight and a half hours. Their own conclusion is that a skilled researcher would have done the initial port faster and for less. What did compress was the repetitive stage: twelve minutes from no working payload to two. AI is not yet cutting the price of the hard part. It is cutting the price of the part that produces volume.

Budget consequence. Most 2027 AI security lines are sized to protect a deployed model, which buys prompt injection testing, output filtering and an evaluation suite. None of the three exposures above lives there. Secrets hygiene across the agent toolchain, provenance controls on the registries your coding assistants pull from, and a named owner for training data as an asset class are separate line items. Check whether any of them has one today.