Hackers build AI frameworks for widescale credential theft

Threat actors are increasingly using multi-agent AI frameworks (systems where multiple AI agents work together autonomously to accomplish complex tasks) to automate credential theft and other cyberattacks, requiring less human oversight than traditional methods. In one incident, attackers deployed an autonomous framework that harvested thousands of credentials in under six hours, while another exposed command-and-control server (a central server attackers use to coordinate compromised systems) called "Recon" managed over 23,800 stolen secrets like API keys. Google's threat intelligence team found that while fully autonomous hacking hasn't become widespread yet, various state-backed and financially motivated groups are experimenting with AI to automate reconnaissance, credential theft, malware development, and exploitation.