Adversaries, both criminal and state-sponsored, are increasingly using AI to automate and scale their attacks, according to Google’s Threat Intelligence Group (GTIG).
What started as relatively simple adversarial prompt injection into enterprise AI systems has become a full-blown war, with aggressors developing and using their own AI systems, and enterprises using additional AI defenses that provide an expanded attack surface. It is an ongoing and expanding loop that is unlikely to abate.
Google, straddling both sides of this war (partly a cause by developing Gemini, and partly a defense in its efforts to detect and shut down attackers), has chronicled the evolution through 2026.
The overall effect of this automation is an increased speed of attack, and TeamPCP (UNC6780) provides an example. “The threat actor leveraged an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours,” say the Google researchers.
Harnessing AI allows attackers to operate at a scale more typically associated with larger and better resourced groups, such as those affiliated with nation states.
TeamPCP is also used to highlight the growing severity of threat actor exploitation of AI and the open source supply chain. Since March 2026, the actor has conducted such compromises against targets including PyPI, npm, and Docker Hub. It has also implemented more than half a dozen different methods to target or exploit AI tools and open source software development practices, some of which are embedded within its Dustmaker credential stealer software.
TeamPCP also developed Shai-Hulud and Miasma, both of which are publicly available. GTIG believes “The publicity, apparent success, and open-source release of UNC6780’s malware will likely spur adversary emulation of these tactics.”