Google just proved AI agents can hack your cloud in 6 hours. Your SOC was built for humans.

Google Threat Intelligence Group just dropped its Q3 2026 report.

Mandiant investigated a financially motivated attacker who breached an enterprise cloud environment.

Deployed an autonomous multi-agent framework.

Planned, built, and executed a mass credential-harvesting campaign.

Total time: under 6 hours.

Thousands of third-party credentials compromised.

The AI autonomously managed its own vulnerability scanning pipeline, resolved runtime bugs, and rotated IP addresses.

No human in the loop. No manual oversight.

Attack traffic passed through legitimate IP addresses because the agent operated from the victim's own infrastructure.

On one exposed command-and-control server, GTIG found 23,800 harvested secrets including API keys for cloud and AI services.

John Hultquist, GTIG chief analyst: "We can assume that all threat actors are using AI in some capacity. Criminals will gravitate to attacks that are faster than we can respond to."

This is not a future threat. This is a Q2 2026 incident.

Your SOC escalation path was designed for human-speed attackers.

When reconnaissance, exploitation, and credential harvesting compress into a sub-six-hour sprint, traditional triage queues collapse.

GTIG also found DUSTMAKER malware hiding in .cursor, .vscode, and .claude directories — weaponizing the very AI coding tools your developers use.

Audit your cloud identity controls today.

If your incident response playbook assumes a human attacker's pace, it is already obsolete.
SOURCE: https://www.channelinsider.com/security/news-google-ai-agents-cloud-credential-attacks
VERIFIED: Google Threat Intelligence Group Q3 2026 AI Threat Tracker, Help Net Security, Channel Insider
SIGNAL: AI-powered attacks are compressing weeks of intrusion work into hours. Enterprise SOCs built for human-speed adversaries are structurally mismatched against autonomous agent-driven campaigns.