Google Maps How AI Is Arming Smaller Attackers

Google's Threat Intelligence Group has spent the past year documenting a shift that cuts to the core of how security teams think about adversary capability. According to the company, attackers of all stripes — criminal and state-sponsored alike — are leaning on AI to automate and scale operations that previously demanded significant manpower.

The result, as Google describes it, is a widening of the field. Groups that once lacked the resources to mount large campaigns are now able to operate at speeds and volumes that were once the signature of well-funded nation-state teams.

From Prompt Injection to Full AI Conflict

Google's account begins with a comparatively modest origin point: adversarial prompt injection aimed at enterprise AI systems. From there, the company says, the dynamic escalated. Attackers began building and deploying their own AI systems, while defenders layered in additional AI protections — a move that itself expanded the attack surface available to adversaries.

Google characterizes this as an ongoing and expanding loop, one it does not expect to slow. The company has chronicled that evolution, tracking how the techniques have moved from isolated experiments to something closer to a sustained contest.

Google sits on both sides of that contest. It develops Gemini, and it runs detection and disruption efforts against attackers. That dual position shapes the perspective it brings to the findings, which cover developments the company says unfolded through 2026.

Six Hours From Prompt to Campaign

The clearest illustration Google offers of AI as a force multiplier comes from a group it tracks as TeamPCP, also identified as UNC6780. According to the researchers, the actor used an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours.

“The threat actor leveraged an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours,” say the Google researchers.

— Google researchers, Threat Intelligence Group (GTIG)

Google points to that example as evidence that harnessing AI lets attackers operate at a scale more typically associated with larger and better-resourced groups, including those tied to nation states.

TeamPCP also serves as Google's case study for the overlap between AI-enabled attacks and the open source supply chain. Since March 2026, according to the company, the actor has conducted compromises against targets including PyPI, npm, and Docker Hub. Google says the group has implemented more than half a dozen different methods to target or exploit AI tools and open source software development practices, some of which are embedded within its Dustmaker credential stealer.

TeamPCP is also credited with developing Shai-Hulud and Miasma, both of which are publicly available.

Google's assessment of what that publicity means is a forecast, not a certainty. GTIG believes “The publicity, apparent success, and open-source release of UNC6780’s malware will likely spur adversary emulation of these tactics.”

The Nation-State Side of the Ledger

Financially motivated criminals are not the only ones adopting AI. Google reports that nation-state actors are increasingly leaning into it as well, and the company's case list spans several regions and sponsors.

In June 2026, GTIG reported on a multi-year cyberespionage campaign by UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting academic, medical, and military research institutions in North America.

Beyond specific campaigns, Google says it has identified various nation-state actors keen on developing offensive agentic AI tools. One PRC group, it says, has experimented with AI-powered development tools to build an AI-assisted, automated exploitation and post-exploitation pipeline.

Google also names PRC-nexus Basin Castle, which it says has queried large language models to profile high-value targets during early-stage reconnaissance, draft and translate localized social engineering lures, author obfuscated custom malware, and troubleshoot post-exploitation commands.

On the Iran-backed side, Google points to Calanque Ion, also known as APT42. That group, per the company, has used generative AI — including Gemini — to identify target email addresses, conduct OSINT research, and translate content across local languages to craft localized pretext lures.

Ravine Castle, also known as APT24 and described as PRC-nexus, uses Gemini across the entire attack lifecycle, from intelligence gathering to attack capability development and influence operations, according to Google. The company says the group has also been seen using Gemini to generate politically charged propaganda and to research methods for anonymizing data leaks for downstream dissemination to journalists and social media influencers.

Google rounds out the roster with Midnight Neptune, identified as UNC1069 and described as a DPRK-nexus actor, which it says has increasingly integrated AI across its operational lifecycles to support cryptocurrency theft.

Google's Two-Track Response

Google describes its own countermeasures as running along two tracks. The first is disruption: disabling associated projects and accounts when it identifies adversarial operations.

The second is hardening its models against misuse. Google points specifically to model extraction, also called distillation, attacks as an area it has worked to address.

In response to model extraction, Google says, “In response to model extraction – or ‘distillation’ – attacks, we have deployed real-time defenses designed to degrade the performance of unauthorized ‘student’ models and detect attempts to clone proprietary logic.”

The company also references CISA's details on China's distillation attacks against US frontier AI companies as related context for that work.

The Numbers Behind the Campaigns

Several figures in Google's account are worth isolating, because they mark the boundaries of what the company says it has observed.

• TeamPCP planned, built, and executed a mass credential harvesting campaign in less than six hours.
• TeamPCP has carried out compromises against PyPI, npm, and Docker Hub since March 2026.
• TeamPCP has implemented more than half a dozen different methods to target or exploit AI tools and open source development practices.
• GTIG reported on the UNC6508 espionage campaign in June 2026.

Why the Loop Doesn't Close

Google's account does not promise a resolution. The company frames the underlying problem as AI's facility in finding vulnerabilities and developing new malware and exploits. So long as that facility persists, Google says, bad actors will use AI as a force multiplier.

There will never be a lack of vulnerabilities, in Google's telling. As fast as flaws are located and patched, they are replaced by different vulnerabilities in new software. Good actors, Google says, may find and disrupt adversarial activity, but bad actors will move, adapt, and carry on.

Google places that pattern in a long arc, describing it as consistent with cybersecurity since the internet began, with only the details changing. AI, by that account, introduces many more details and adds speed and scale, but the basic warzone is and is likely to remain unchanged.

What This Means for Defenders

The practical weight of Google's findings falls on security teams that have built assumptions around who is capable of what. If a group can stand up a credential harvesting campaign in under six hours using an AI coding chatbot and a set of agent instructions, the signals defenders traditionally read as markers of a sophisticated operator may not carry the same meaning they once did.

That is an inference drawn from Google's description of the TeamPCP operation rather than a claim the company makes outright. But it sits alongside Google's explicit statement that AI allows attackers to operate at a scale more typically associated with larger and better-resourced groups — including nation-state-affiliated ones.

For organizations that depend on open source packages, Google's account also puts the supply chain in the frame. The company ties TeamPCP to compromises against PyPI, npm, and Docker Hub since March 2026, and notes that the group's tooling includes multiple methods aimed at AI tools and open source development practices. For teams whose build pipelines pull from those registries, that combination suggests dependency and credential exposure deserve closer attention than a purely perimeter-focused view would give them.

Google's own position — running both an AI platform and a threat intelligence operation — means its disruption efforts and its model-hardening work are part of the same story. The company says it disables associated projects and accounts when it finds adversarial operations, and that it has deployed real-time defenses against attempts to clone proprietary logic.

Whether those measures change the trajectory is not something Google claims. The company's closing assessment is that good actors may find and disrupt adversarial activities, but that the bad actors will move, adapt and carry on — a description of an equilibrium rather than a victory condition.

Reporting based on original coverage from SecurityWeek.