Summary
- Google’s Mandiant team responded to multiple AI-focused data theft and extortion incidents in Q2 2026, affecting technology, healthcare, pharmaceutical, and media companies in North America and Europe.
- In one case, attackers breached a healthcare company and exfiltrated drug research and a proprietary AI model; in another, they stole source code, prompts, model scripts and secrets from an AI media company.
- Threat group UNC6780 (tracked as TeamPCP) has conducted large-scale supply chain attacks against PyPI, npm and Docker Hub since March, deploying stealers to harvest cloud and AI credentials.
- Agentic AI is being integrated across multiple stages of attack lifecycles — one autonomous credential-harvesting attack compromised cloud infrastructure in under six hours without manual intervention.
- A China-linked espionage group was observed using Google’s Gemini to build an automated, adaptive penetration-testing framework; Google disabled the associated assets.
AI assets are becoming extortion targets
Google’s threat intelligence and Mandiant incident response teams have documented a clear shift: extortion crews are no longer treating AI systems as just another part of the corporate environment. They are actively targeting proprietary AI assets — models, training data, source code, prompts — because organisations have invested heavily in them and are reluctant to see that intellectual property exposed publicly. That reluctance, according to Google chief analyst John Hultquist, makes companies more willing to pay.
Two incidents illustrate the pattern
Google’s most recent AI Threat Tracker, published this week, details two previously undisclosed intrusions. In the first, attackers breached a healthcare company and walked away with corporate data, drug research and a proprietary AI model, then threatened to publish everything unless their demand was met. In the second, a company specialising in AI media generation had source code, prompts, skills, model scripts and secrets exfiltrated before receiving a similar ultimatum. Mandiant responded to several such operations during the second quarter of 2026, with victims spanning the technology, healthcare, pharmaceutical, and media and entertainment sectors across North America and Europe.
UNC6780 is particularly active
Google tracks one group — UNC6780, also referred to as TeamPCP — as among the most capable and prolific actors in this space. Since March, the group has executed several large-scale supply chain attacks targeting open source ecosystems including PyPI, npm and Docker Hub. After compromising packages and registries, the group typically deploys credential stealers focused on cloud and AI system access. In at least one case, Google found evidence that UNC6780 created a malicious GitHub Actions workflow inside a company’s proprietary AI repository and exfiltrated a copy of that repository. The group has also deployed more than half a dozen distinct methods to target or exploit AI tools and open source software development practices.
Agentic AI is entering the attack lifecycle
Google’s February AI tracker noted attackers experimenting with agentic AI for isolated parts of their operations. The latest report marks a meaningful escalation. Mandiant observed one intrusion in which attackers used a multi-agent system to autonomously compromise cloud infrastructure in under six hours. During that window, the agents scanned for vulnerabilities, performed real-time troubleshooting and executed IP rotation logic — all without manual direction. Hultquist described it as scanning, but with a reasoning layer on top. Separately, a China-linked espionage group was observed using Gemini to design an adaptive, automated penetration-testing framework capable of reasoning through tasks and adjusting course in unpredictable environments. Google disabled the assets connected to that operation.
The threat is still maturing, but moving quickly
Hultquist was measured in his assessment of where things stand. Threat actors are inserting agentic AI into specific parts of their operations, but full autonomy — removing the human operator from the loop entirely — has not yet arrived. That said, the trajectory is clear. Organisations that have not yet considered what it means to protect AI systems as high-value assets, or to defend against AI-assisted attacks, are already behind the curve. As Hultquist put it, criminals attacking AI systems is an area that has not received the attention it probably should.
Why it matters
For CISOs, this report reframes the risk calculus in two directions simultaneously. First, proprietary AI assets — models, training data, code repositories, credentials for AI platforms — now need to be treated as crown jewels with commensurate controls, access restrictions and monitoring, not as generic intellectual property. A successful exfiltration of a core AI model or its training pipeline could carry both significant financial and competitive consequences. Second, the adversarial use of agentic AI compresses the window between initial access and significant damage. If a credential-harvesting operation can sweep cloud infrastructure autonomously in under six hours, detection and response timelines built around human-paced attacks are no longer adequate. Both risks are present now, not on the horizon.
What to do now
- Classify proprietary AI assets — models, training data, source code, prompts and AI platform credentials — as high-value intellectual property and apply appropriate access controls and monitoring.
- Audit third-party and open source dependencies, particularly those fetched from PyPI, npm and Docker Hub, given UNC6780’s demonstrated targeting of these ecosystems.
- Review GitHub Actions workflows and CI/CD pipeline permissions for AI repositories to detect unauthorised modifications or exfiltration pathways.
- Assess whether current detection and response capabilities can identify autonomous, multi-stage attacks that execute within a six-hour window.
- Ensure cloud and AI platform credentials are included in credential exposure monitoring and are rotated promptly if any supply chain compromise is suspected.
