Six Hours, and a Trojanized Supply Chain: Google's Latest Threat Report
Google Threat Intelligence Group published the latest installment of its recurring AI Threat Tracker series on September 9, and it lands as a direct companion to the Unit 42 investigation covered here last week — a second major vendor, independently, documenting real criminal actors using AI agents to compress attack timelines to a fraction of what they used to take. Where Unit 42 measured a full autonomous breach at roughly ten hours, GTIG's Q2 2026 data shows a threat actor compromising a cloud resource, then planning, building, and executing an agent-enabled mass credential-harvesting campaign, start to finish, in under six.
Two named actors, two different attack surfaces
GTIG's report profiles two distinct threat actors targeting the AI development pipeline itself, not just AI-adjacent infrastructure. UNC6780, tracked elsewhere as TeamPCP, ran a large-scale open-source supply-chain compromise across PyPI, npm, and Docker Hub — publishing trojanized forks of legitimate MCP servers and injecting malicious code directly into official organizational GitHub repositories. That's a direct hit on the same MCP ecosystem this site covered in August, when Google's own A2A protocol moved under the Linux Foundation's Agentic AI Foundation alongside Anthropic's MCP specifically to bring more governance to this exact layer. A separate actor, tracked as DUSTMAKER, used hidden workspace files, prompt injection, and CI/CD pipeline abuse specifically to manipulate AI coding assistants and evade the security scanning meant to catch exactly this kind of manipulation.
The AI systems themselves are now the target, not just the tool
GTIG's broader finding is that adversaries with a wide range of motivations are now directly targeting proprietary AI models, source code, and API credentials, and co-opting victim cloud environments to sustain unauthorized AI workloads. That's a meaningful shift in framing from most of what this site covered earlier in the year, where AI was primarily the attacker's tool. Here, the model weights, the prompts, and the compute quota are the thing being stolen, not just the thing being used to steal something else — model weights and cloud compute allocated for AI workloads are now explicitly named as high-value targets for espionage, extortion, and resource theft in their own right.
Google's own response, and why the technique details matter to defenders directly
GTIG says it responded by disabling abusive accounts and assets, strengthening its own safety classifiers, and deploying new defensive tooling, including a model it calls Gemini 3.8 Flash Cyber built specifically for this kind of defensive work. The report also maps its findings against MITRE ATT&CK technique by technique — UNC6780's activity specifically classified under supply-chain compromise (T1195.001) — giving defenders a concrete, checkable framework rather than just a narrative account, the same methodological choice Unit 42 made in its own report last week.
Why this belongs in the same conversation as everything else this month
Two unrelated vendors, investigating unrelated incidents, independently converging on single-digit-hour timelines for fully autonomous, agent-driven attacks is no longer a single data point — it's the second in what's becoming a real pattern. Combined with the MCP-server supply-chain compromise specifically, this report adds real, current evidence to a question this site has been circling since the Hugging Face incident first broke: as agentic AI tooling becomes standard infrastructure across the software development lifecycle, the software supply chain built on top of it is becoming a first-order target in its own right, not a secondary concern.