Threat actors are increasingly using autonomous AI agents to speed up cyberattacks, automate vulnerability research, and steal cloud credentials at scale.
Google Threat Intelligence Group (GTIG) has uncovered an exposed command-and-control server running an automated reconnaissance and credential-management platform called Recon, which was used to organize and validate more than 23,800 stolen secrets in real time.
The stolen data included API keys for cloud platforms and AI services, creating a major risk for organizations that depend on cloud infrastructure, developer tools, and generative AI applications.
The campaign shows how attackers are moving beyond traditional scripts and manually operated infostealers toward AI-assisted systems capable of making operational decisions with little human input.
AI Agents Harvest
According to GTIG, the Recon framework included agentic configuration and knowledge files such as AGENTS.md, KNOWLEDGE.md, and agenticvulnresearch.md.
It also contained directories named .openclaw and memory, suggesting a modular environment built to store instructions, retain context, and support repeated automated tasks.
Initially, researchers found an exposed directory on the attacker-controlled server. Soon after, the directory was replaced with a live dashboard that could sort, validate, and manage the harvested secrets.
The platform reportedly handled more than 23,800 credentials, including API keys that could provide access to cloud resources and AI services.
The framework represents a shift from endpoint-focused malware to server-side, agentic credential harvesting.
Rather than waiting for a victim to run an infostealer, attackers can use AI agents to identify vulnerable internet-facing infrastructure, scan targets, exploit weaknesses, collect secrets, and organize the results.
GTIG said the agents could research vulnerabilities, scan server infrastructure, and carry out targeted exploitation with minimal operator involvement.
This allows threat actors to run larger campaigns more quickly while reducing the time needed for manual troubleshooting and decision-making.
In a separate financially motivated campaign, Mandiant observed attackers compromise cloud infrastructure and use an AI coding chatbot, a prompt, and preconfigured agent instructions to plan and execute mass credential harvesting in under six hours.
The autonomous workflow managed vulnerability scanning, real-time error handling, and IP-rotation logic without manual intervention.
Cloud secrets are highly valuable because a single exposed API key, access token, or service-account credential can open a path to sensitive data, computing resources, source code, and downstream services.
Stolen AI-service keys can also be abused to consume paid model quotas, access proprietary applications, or run unauthorized workloads.
Attackers may also operate from compromised cloud environments to make malicious traffic appear to originate from legitimate infrastructure.
In the observed campaign, this enabled traffic to be routed through trusted cloud IP addresses, potentially making detection more difficult for security teams, Google said.
Organizations should treat cloud and AI credentials as high-risk assets. Security teams should rotate exposed keys, enforce least-privilege permissions, use short-lived credentials where possible, and continuously monitor for unusual API activity, token creation, privilege changes, and unexpected cloud resource deployments.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
