Google: Cybercriminals Are Moving From AI Prompts to Agentic Attack Workflows

Google Threat Intelligence Group’s Q3 2026 AI Threat Tracker describes an important change in adversary behavior: AI is no longer limited to isolated productivity tasks. GTIG says some actors are connecting AI-enabled tasks into agentic workflows that reduce human-in-the-loop delays across an intrusion. The result is not confirmed “hands-off” cyberattacks, but it is a shorter window for defenders to spot, investigate, and stop malicious activity. 25

The core finding: from assistance to coordinated workflows

Earlier AI misuse often looked like assistance with a discrete task—researching a target, drafting a phishing message, writing or debugging code, or translating text. GTIG’s September update says more capable adversaries are progressing toward workflows in which AI systems handle several linked tasks and support AI-enabled automation. 25

That distinction matters. A connected workflow can move more quickly between stages such as reconnaissance, vulnerability scanning, credential collection, operational troubleshooting, and follow-on activity. GTIG’s concern is that less human intervention can compress the traditional response window available to security teams. 25

Financially motivated criminals: credential theft at machine speed

One of the tracker’s clearest examples involved a financially motivated actor that used a multi-agent framework to build and launch a large-scale credential-harvesting operation in less than six hours. Reporting on the tracker says the agents helped automate activities including scanning, credential harvesting, and troubleshooting. 212

The significance is not merely that criminals used AI to write a script. It is that agents can help keep an operation moving when it encounters routine technical problems, reducing the manual work required to coordinate an attack.

State-linked groups are using AI across the intrusion lifecycle

GTIG reported AI use by state-linked actors for tasks spanning early-stage research and target intelligence through operational troubleshooting. A China-linked espionage group identified as BASINCASTLE was reported to use large language models for research and for resolving issues during intrusions. 1

The report also described another China-linked group attempting to use Gemini to build an automated penetration-testing framework, with agentic AI intended to perform early stages of an intrusion autonomously. 1

These examples show that AI can be useful well before an attacker attempts a disruptive action: it can accelerate research, make technical experimentation easier, and help operators adapt during an operation.

Why phishing and impersonation remain a major concern

The most widespread impact of generative AI may be on established, human-targeted attacks rather than on entirely new attack categories. AI can make phishing and social-engineering materials faster to produce, more tailored to a recipient, and more convincing across languages and regions. GTIG has previously described adversaries using AI for information gathering, realistic phishing scams, and malware development. 11

This matters for impersonation and influence operations as well. AI-assisted content can support more polished pretexts, fabricated online identities, and scalable deceptive messaging. Reporting on the Q3 findings said Iranian state-backed groups used Gemini for activities including phishing and creating fake identities, illustrating how AI can reinforce both cyber operations and influence efforts. 4

For organizations, the practical implication is straightforward: a well-written message, document, or voice-based pretext is no longer a reliable sign of legitimacy.

The caveat: autonomous attacks are not yet confirmed in the wild

GTIG’s assessment should not be read as evidence that attackers have already deployed fully autonomous, end-to-end attack systems against real-world targets. The group explicitly said it had not yet observed threat actors deploying fully autonomous pipelines against targets in the wild. 2

Instead, the report documents a progression toward autonomy. Agents can already assist with substantial sub-tasks and connect parts of an attack workflow, while people still appear to direct objectives and consequential decisions. That makes the near-term security challenge less about a single “AI superhacker” and more about ordinary attacks becoming faster, cheaper to operate, and harder to triage in time. 25

What defenders should take from the report

The tracker points to a need to defend against speed as much as sophistication:

• Treat identity attacks as a primary risk. Strengthen phishing-resistant authentication and watch for unusual credential use.
• Reduce detection and containment time. Agent-supported operations may move rapidly between discovery, access, and collection.
• Validate high-risk requests out of band. Payment changes, credential requests, and sensitive file-sharing instructions should not rely on the apparent quality of an email or document.
• Protect AI assets and development workflows. GTIG says attackers are increasingly targeting AI-related intellectual property, AI users, systems, and supply-chain weaknesses. 15

The central message from Google’s Q3 2026 tracker is measured but urgent: AI has not made fully autonomous cyberattacks an observed reality, yet it is already helping criminals and state-linked groups turn familiar tactics into more coordinated, scalable operations. 25