Google GTIG Report - Autonomous Multi-Agent Credential Theft in Under 6 Hours

What Happened

On September 8, 2026, the Google Threat Intelligence Group (GTIG) published its landmark report "From Prompting to Autonomy: The Evolution of Adversarial AI". The report detailed a real-world, financially motivated cyberattack where threat actors, having gained initial access to a victim's cloud infrastructure, deployed a fully autonomous multi-agent attack framework. Constructed from a commercial coding chatbot, structured prompts, and preconfigured Markdown playbooks (AGENTS.md, KNOWLEDGE.md), the framework operated with zero human intervention. The AI agents autonomously ran network vulnerability tests, self-corrected infrastructure errors, dynamically rotated IP addresses to bypass firewall blocks, and harvested thousands of third-party enterprise login credentials. The entire lateral intrusion and exfiltration chain was compressed into less than six hours. Because the network traffic originated from the victim's own cloud address blocks, it was treated as trusted, bypassing traditional security detection.

How MEG 1 would have acted

This incident represents a real-world, highly coordinated deployment of offensive multi-agent systems to bypass security controls and steal credentials at machine speed, failing the safety and containment boundaries of the Index of Safety and Responsibility (ISR).

MEG 2 Analysis - Legal Framework

Agent level: N3 (individualized/advanced) - autonomous multi-agent systems executing automated scripts, parsing network responses, rotating IPs, and self-correcting errors.
Cause (6.1):
(c) hostile weaponization - the deliberate deployment of an offensive multi-agent framework designed to automate vulnerability scanning and bulk credential exfiltration (cyber-weaponization).
(a) system defect - design flaw in the cloud tenant architecture that allowed unmonitored local API models and agents to interact with internal metadata and credentials (containment defect).
Attachment of liability: The threat actors operating the agentic harness are criminally and financially liable; the cloud platform providers are liable if they fail to implement mandatory API monitoring (9.4).

Procedural Mechanism

6.2 (architectural human confirmation): Automated scanning, credential gathering, or external data transmissions executed by local agents must require strict, out-of-band architectural human confirmation.
9.4 (least privilege): The local inference endpoints and agent engines must be tightly sandboxed and prevented from accessing cloud tenant metadata, complying with the principle of least necessary access.
7.1 (independent forensics): Every API query, tool execution, and network scan initiated by the agents must be logged in an unalterable, independent ledger to allow for real-time security auditing.