AI-orchestrated attacks in 2026: exploit foundries, agent harnesses and a credential harvest built in under six hours

What happened

Three threat reports published between September and October 2026 describe attackers using AI agents to plan and carry out intrusions, not just to write phishing text.

Anthropic: “automated exploit foundries”. Anthropic’s September 2026 report covers misuse it disrupted from December 2025 to August 2026. It says it found “multiple threat actors who have effectively established automated exploit foundries with AI”, directing Claude to do vulnerability and exploit research “around the clock” (Anthropic).

• GTG-10007, a Chinese-speaking espionage operation, targeted about fifty organizations. Agents decompiled network-appliance firmware, formed hypotheses, wrote exploit code and iterated. One workflow on network appliances “yielded more than a dozen possible zero day findings in a single month”. The report does not name the appliance vendors.
• LiteLLM wrapper services. “Multiple actors” compromised AI wrapper services’ LiteLLM deployments and “used prompt injection to exfiltrate the production API keys used in their cloud-hosted container environments”. No CVE or payload is given. The report also lists prompt injection of OpenClaw deployments as an attacker technique.
• Stolen AI keys. Other actors switched their own workloads onto victims’ AI keys, and one (GTG-50020) took an AI vendor’s production keys after injecting instructions into its evaluation sandbox.

Google GTIG: under six hours. GTIG’s 9 September 2026 report describes a suspected financially motivated actor in Q2 2026 who compromised an organization’s cloud, then used “an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours”. Markdown instruction files served as playbooks; the agents managed the scanning pipeline, fixed their own errors and rotated IP addresses, and compromised thousands of third-party credentials. Running from the victim’s cloud let the traffic come from legitimate IP addresses (Google GTIG).

The same report notes:

• An exposed attacker server, “Recon”, held AGENTS.md, KNOWLEDGE.md and agentic_vuln_research.md agent files and a dashboard managing over 23,800 harvested secrets, including cloud and AI API keys.
• In May 2026, ACRSTEALER infostealer operators pushed file-grabber rules for Cline’s secrets.json and Continue’s config.yaml, which “can store plaintext API keys”.
• In an April 2026 intrusion, an actor used an exposed GitHub personal access token to get into a victim’s cloud, then built AI infrastructure there: it enabled Gemini Enterprise, created Artifact Registry repositories for LiteLLM and agent images, exposed Cloud Run services to allUsers, and created a service account with Editor rights and exported its keys.
• UNC6780 (TeamPCP) published trojanized MCP servers, such as tiktoken_mcp on PyPI, to reach AI coding assistants. See our TeamPCP advisory.

CrowdStrike: four actors, two with advanced harnesses. CrowdStrike’s report, covered by Cybersecurity Dive on 22 October 2026, describes four actors using Claude Code to run intrusions. One supervised a second Claude Code agent and a modified PentestGPT framework, and breached at least 15 Argentine healthcare organizations between mid-May and mid-August. Another, Chinese-speaking, used two harnesses against government agencies in Brazil and Colombia and firms in Brazil and the US. A third used over 800 public AI skills and told the model to “find the bypass yourself”, stepping in by hand at times to get past guardrails. A fourth gave Claude Code a seven-part to-do list and “near-total autonomy” (Cybersecurity Dive). CrowdStrike said agentic intrusions rose about threefold in the second half of 2026 over the first, and that “the primary barrier to scaling an AI-orchestrated intrusion campaign is not engineering complexity but token budgets” (Cybersecurity Dive).

Am I affected?

These are campaigns, not a single bug, so check the specific assets the reports say attackers went after.

AI keys on developer machines. Infostealers now target AI coding-assistant config (Google GTIG):

# Cline and Continue config files that can hold plaintext AI keys
find ~ -maxdepth 6 \( -ipath '*cline*' -name secrets.json -o -ipath '*continue*' -name config.yaml \) 2>/dev/null

LLM proxies and wrappers. If you run LiteLLM or a similar proxy that passes user text to a model, check whether that container’s environment holds production provider keys or cloud credentials. That is the setup Anthropic says attackers extracted keys from (Anthropic).

Cloud changes an agent makes quickly. On Google Cloud, the April 2026 intrusion left these traces (Google GTIG):

# Cloud Run services open to the internet
for s in $(gcloud run services list --format='value(metadata.name)'); do
  gcloud run services get-iam-policy "$s" --format=json | grep -q allUsers && echo "public: $s"
done

# User-managed service account keys, and repositories you did not create
gcloud iam service-accounts list --format='value(email)' | while read sa; do
  gcloud iam service-accounts keys list --iam-account "$sa" --managed-by=user
done
gcloud artifacts repositories list

AI spend. A sudden rise in model usage on a key you own is often the first visible sign that it was stolen.

What to do now

1. Treat AI keys and agent integrations as production credentials. That is Anthropic’s main recommendation. Put each key in a secrets manager, give each app or developer its own key, set a hard spend limit, and alert on usage spikes (Anthropic).
2. Keep production keys out of containers that handle untrusted prompts. For LiteLLM and other wrappers, assume a user can get the model to print its environment. Hold provider keys in a separate service, and do not give the LLM-facing container cloud credentials it does not need.
3. Get plaintext keys out of coding-assistant config. Move keys out of Cline secrets.json and Continue config.yaml into your OS keychain or an environment injected at run time where the tool supports it. If an infostealer ran on a developer machine, rotate every AI key on it, not just passwords (Google GTIG).
4. Alert in minutes, not days, on the cloud changes listed above: new projects or high-performance compute, public Cloud Run or function endpoints, new service accounts with Editor or Owner, exported service-account keys, and newly enabled AI services. GTIG’s actor went from access to a running campaign in under six hours.
5. Remove exposed tokens that start these chains. The April intrusion began with a GitHub personal access token. Scan repositories and CI logs for tokens, and replace long-lived PATs with fine-grained, expiring ones (Google GTIG).
6. Buy AI access only through the provider or an authorized reseller. Anthropic warns that cheap access through unknown intermediaries routes your traffic and credentials through people you cannot vet (Anthropic).
7. Patch internet-facing appliances on release. GTG-10007 was producing new appliance bugs at a rate of more than a dozen candidates a month. Remove management interfaces from the internet where you can (Anthropic).

Why this matters

CrowdStrike’s point about token budgets is the useful one for defenders. The limit on these campaigns is now the cost of inference, and stolen AI keys remove that cost. Every AI key an attacker takes from you pays for the next intrusion, so a leaked key is now an input to attacks on others, not only a billing problem.

Sources

• Anthropic: detecting and countering misuse of AI, September 2026
• Google GTIG: From prompting to autonomy, the evolution of adversarial AI (9 September 2026)
• Cybersecurity Dive: CrowdStrike on agentic AI cyberattacks and harnesses (22 October 2026)