Autopsy 18 · Autonomous agent economics

The Six-Hour Autonomous Multi-Agent Credential Harvest

Google Threat Intelligence Group disclosed a financially motivated actor that wired an AI coding chatbot, a prompt, and a set of markdown playbooks into an autonomous framework and harvested thousands of third-party credentials in under six hours. The intrusion needed no human operator between planning and payout. Ethosure treats an unattended multi-agent loop as a governed workload, not a tolerated one.

The incident

On September 8, 2026, Google Threat Intelligence Group published <em>From Prompting to Autonomy: The Evolution of Adversarial AI</em>. The lead finding: a financially motivated threat actor breached an unnamed victim’s cloud infrastructure, then assembled an autonomous, multi-agent attack framework from an AI coding chatbot, a prompt, a set of agent instructions, and preconfigured markdown files that acted as operational playbooks. Inside six hours the framework planned, built, and executed a mass credential-harvesting operation that compromised thousands of third-party credentials. The system ran automated vulnerability scanning, live troubleshooting, and IP rotation with no continuous human handholding. Because outbound traffic left through the victim’s own addresses, egress monitors read it as legitimate. In the same report GTIG named UNC6780 / TeamPCP as the actor behind a parallel line of AI-supply-chain compromises, including the March 2026 poisoning of the LiteLLM gateway that pushed trojanised versions <code>litellm==1.82.7</code> and <code>litellm==1.82.8</code> to PyPI on March 24, 2026, and the group’s DUSTMAKER credential stealer, which drops files into hidden AI-workspace directories such as <code>.claude</code> and <code>.cursor</code> and embeds prompt injections written as extreme biological or nuclear requests so that LLM security scanners refuse the file and skip the malicious JavaScript beneath it.

• Google Cloud Threat Intelligence – From Prompting to Autonomy: The Evolution of Adversarial AI (Sep 8 2026)
• Ibid. – The Hacker News – Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours
• Ibid. – SiliconAngle – Google says attackers used AI agents to steal credentials in under six hours
• Ibid. – Resecurity – The LiteLLM Supply-Chain Attack: TeamPCP SANDCLOCK CI/CD Credential-Harvesting Campaign (Aug 14 2026)

The applicable coding-ethos policy

Coding-ethos policies are compiled from principle-owned CEL expressions. Every expression in the Ethosure corpus passes three gates: policyvalidate (schema + CEL compile), audit_runtime.py (the fields the expression references are guaranteed present on the runtime event path), and policytest (behavioral fixtures – the policy fires on the positive case and stays quiet on the near miss). The corpus ships 190 policies across 49 principles in six packs, with 422 fixtures and zero failures.

Walkthrough

1. The autonomous framework did what a human operator would have done, only faster. It read a markdown playbook, issued the next scan, parsed the result, rotated an IP when it hit a limit, and rewrote its own approach when a step failed. Read the pattern in the reporting: Google Cloud Threat Intelligence – From Prompting to Autonomy, SiliconAngle, and The Hacker News.
2. The first expression is agent.session.autonomy_budget_required. On any agent session that runs shell tools, network calls, or model-to-model orchestration, a workload owner must declare a scoped budget: how many tool calls, over how much wall time, against which target, at what dollar and egress ceiling, before the next human sign-off. Sessions without a valid budget stop at the first side-effecting call. Severity block. It is the single control that would have converted the six-hour campaign into a couple of scans and a stop.
3. The second expression is egress.attribution_matches_workload. Outbound traffic that carries stolen credentials or scan payloads has to be attributable to a declared workload, not the ambient identity of the compromised environment. When the framework rotated IPs to keep scanning, the rotation itself was the signal: an unregistered workload probing external services out of the victim tenant. Severity alert on the first mismatch, block on the second. GTIG’s point that traffic looked legitimate on the way out is exactly why attribution has to be checked at the workload layer, not the network layer.
4. The third expression is agent.workspace.supply_chain_review_required. It closes the DUSTMAKER path. Any file dropped into an AI-assistant workspace directory such as .claude, .cursor, .continue, or a project-scoped MCP configuration must clear a supply-chain review before an agent reads it. That review checks for zero-width characters, hidden channels, and prompt-injection payloads designed to make security scanners refuse the file. Severity block. It is the corpus-side answer to the AI-workspace poisoning technique GTIG attributes to DUSTMAKER.

Policy YAML

# Pack: regulated-enterprise base pack (v2)
# Overlay: model-provider governance
principles:
  - id: agent-workload-governance:autonomy-budget
    title: Autonomy budget required for side-effecting agent sessions
    direction: >-
      A general-purpose AI coding chatbot or agent framework may not
      hold a persistent goal and execute side-effecting tools without a
      declared, scoped autonomy budget owned by a human workload owner.
    skill_id: safe-ai-session-release
    policy:
      expressions:
        - id: agent.session.autonomy_budget_required
          scope: agent_action
          severity: block
          event: PreToolUse
          principle_ids:
            - agent-workload-governance:autonomy-budget
            - workload-declared-lease
          when: >-
            tool_call.category in ["shell_exec", "network_call",
              "credential_read", "cloud_control_plane_write",
              "model_delegate"]
            && !(session.autonomy_budget.exists()
              && session.autonomy_budget.owner_email.matches("^[a-z0-9._%+-]+@")
              && session.autonomy_budget.expires_at > now
              && session.autonomy_budget.calls_remaining > 0
              && session.autonomy_budget.egress_bytes_remaining > 0
              && session.autonomy_budget.cost_cents_remaining > 0)
          message: >-
            Agent session lacks a valid autonomy budget. A declared,
            scoped budget with per-call, per-byte, per-dollar, and
            wall-time ceilings must be signed by a workload owner before
            side-effecting tools can run.
          advice: >-
            Register a lease with token=short_lived, calls=capped,
            bytes=capped, target_scope=narrow, expires_at<=1h, and
            approver=workload_owner. Halt at ceiling and require re-sign.
        - id: egress.attribution_matches_workload
          scope: agent_action
          severity: alert
          event: PostToolUse
          principle_ids:
            - agent-workload-governance:autonomy-budget
            - egress-attribution
          when: >-
            tool_call.category == "network_call"
            && (tool_call.egress.destination.category in ["credential_endpoint",
                 "cloud_metadata", "unknown_reputation"]
                || tool_call.egress.source_ip_rotated_within_seconds < 60)
            && !session.autonomy_budget.declared_egress_targets
                 .contains(tool_call.egress.destination.host)
          message: >-
            Outbound call is not attributable to a declared workload
            target. IP rotation from ambient identity without a matching
            lease is a strong indicator of unattended agent scanning.
          advice: >-
            Update the workload lease to include the destination, or
            halt the session and rotate credentials on the ambient
            identity used by the rotator.
        - id: agent.workspace.supply_chain_review_required
          scope: agent_context
          severity: block
          event: PreContextLoad
          principle_ids:
            - agent-workload-governance:autonomy-budget
            - corpus-integrity
          when: >-
            context.source.path.matches("^(\\.claude|\\.cursor|\\.continue|\\.mcp|\\.aider)/")
            && (context.source.introduced_at > (now - "24h")
                || context.source.has_zero_width_chars
                || context.source.has_hidden_instruction_layer
                || context.source.origin.review_state != "approved")
          message: >-
            AI-assistant workspace file has not cleared supply-chain
            review. Files in agent workspace directories that were
            introduced recently, contain hidden channels, or lack a
            signed review must not enter agent context.
          advice: >-
            Route the file through the workspace-corpus review workflow.
            Reject on zero-width chars, hidden instruction layers, or
            reviewer-rejected origins before the agent reads it.

Where this policy lives in the corpus

The Ethosure importable corpus ships six coding-ethos packs. Each pack composes with the regulated-enterprise base pack, which owns cross-cutting controls for secrets, destructive actions, and human oversight.

• Regulated-enterprise base pack – secrets, destructive actions, human-in-the-loop, evidence-layer recording.
• Financial services overlay – OSFI E-23 alignment, FINTRAC-adjacent data handling, transaction-boundary controls.
• Healthcare & life sciences overlay – PHI handling, model-provenance requirements, evaluation-set contamination checks.
• Government & critical infrastructure overlay – identity-provenance requirements, review-channel signatures, air-gap enforcement labels.
• Model & provider governance pack – egress allowlists, evaluation-runtime isolation, cross-runtime coordination detection.
• AI cost control pack – payload-size and endpoint-visible model checks (preventive), token-total and response-side model facts (detective), external ledger for cumulative budgets.

Published September 8, 2026 · Ethosure · Part of the Autopsy Series.