GTIG AI Threat Tracker: How Adversaries Moved From Prompting to Agentic, Automated Attacks

Adversaries are combining multiple AI capabilities rather than using models only as one-off tools. The observable shifts include:

• Agentic AI and automation: Multi-agent frameworks autonomously manage scanning, resolve operational errors, and execute large-scale credential theft. Human-in-the-loop latency drops sharply as agents carry out iterative workflows.
• Supply chain targeting: The proliferation of AI-assisted coding, open source AI resources (model context servers, model weights, inference engines, vector DBs), and faster development cycles created new attack surfaces. GTIG links AI-assisted coding practices to notable software supply chain compromises in 2025–early 2026.
• Targeting AI assets: Adversaries seek proprietary models, source code, prompts, and API credentials. Motivations range across espionage, extortion, and theft of cloud compute to run unauthorized AI workloads.

GTIG's public findings describe several concrete patterns observed in 2026 telemetry and research:

• A rapid mass credential-harvesting campaign that an agentic framework designed and executed within a six-hour window after initial cloud compromise.
• UNC6780 leveraging multiple tactics to trick AI coding assistants and LLM security scanners so malicious code could enter open source software supply chains.
• Attempts to download malicious open-source AI resources across enterprise environments in North America and Asia, and a reported case where an AI coding agent introduced a malicious dependency into a live cryptocurrency-related codebase.

Defender implications and recommended focus areas GTIG's analysis points to where defenders must prioritize effort:

• Treat AI assets as high-value: Model weights, proprietary prompts, API keys, and high-performance cloud quotas require access controls, inventorying, and monitoring equivalent to other critical IP.
• Harden development supply chains: Increase scrutiny of third-party packages and dependencies, especially in AI-focused repositories and components such as MCP servers and inference tooling.
• Monitor for account misuse and illicit compute: Watch for credential theft, purchased compromised AI platform accounts, and unexpected cloud workloads that could indicate LLMJacking or compute theft.

Adversaries are moving beyond one-off prompting to coordinated, agentic, and automated operations that exploit the AI software ecosystem and directly target AI assets. Defenders need inventory, controls, and detection tuned for AI-specific risks and must consider operational changes in development pipelines and cloud environments to reduce exposure.