Data ProtectionCloud SecuritySOCs
Sat, 19th Sep 2026 (Today)
SEAN MITCHELLPublisher
Google has outlined how it tracks cyber attackers’ use of artificial intelligence and deploys AI-based defences across its security products. Its threat intelligence work points to three broad shifts in the threat landscape.
Those shifts are AI’s effect on software development, the expanding attack surface around AI systems, and the use of AI to improve attackers’ effectiveness. Sandra Joyce, Vice President, Google Threat Intelligence, said security leaders need to focus on observed activity rather than speculation about how threats may evolve.
AI-assisted software development is creating new supply chain risks as coding tools suggest packages and components that developers may trust without close scrutiny. Google said threat actors are trying to exploit that trust by contaminating upstream packages recommended by AI assistants.
It linked that trend to a rise
It linked that trend to a rise in open-. In response, Google argued for building security checks directly into development tools rather than slowing development work
Joyce described that approach in familiar terms. “Part of this process involves in-editor guardrails for developers that create a real-time ‘spellcheck for cybersecurity,'” she said.
Google is also watching attacks aimed at AI agents and software development tools. It identified a financially motivated threat actor known as TeamPCP, or UNC6780, as using several methods to exploit AI tools and open-pt injection, and attempts to blind AI scanners with harmful prompts
Google warned against relying on a single large
Google warned against relying on a single large language model for security analysis. It said single-model deployments risk creating a monoculture that attackers can probe for weaknesses, especially if they discover prompts or inputs that evade a model’s filters.
Instead, Google uses several foundation models, including Gemini as well as commercial and open-y miss. The aim is to reduce false positives and improve detection of more complex logic flaws
Google also outlined risks around AI infrastructure itself. One method it highlighted was “LLMJacking,” in which attackers seek access to graphics processing unit resation
In one case cited by Google, a threat
In one case cited by Google, a threat actor gained access to a cloud environment through an exposed personal access token and then deployed unauthorised AI infrastructure. The intruder scaled compute re the associated hardware and platform costs
Another concern is the theft of AI-related data. Google said cybercriminals are increasingly targeting prompts, agent instructions, fine-tuned models,ed to AI services are being traded in underground forums
Threat actors are moving beyond basic prompt use towards multi-agent attack pipelines that automate a wider range of tasks, Google said. It described one intrusion investigated by Mandiant in which a financially motivated actor compromised cloud infrastructure and then used an AI coding chatbot, a prompt, and a set of instructions to build and run a mass credential-harvesting campaign in less than six hours.
Google also said it had observed a China-linked
Google also said it had observed a China-linked espionage group testing a tool called CC Switch to rotate among multiple accounts and switch between different AI models for specific tasks. The aim, it said, was to choose the most suitable model for work such as writing exploit scripts and drafting lures.
In Google’s view, that activity shows how AI can turn an otherwise fragmented manual process into a more continuous workflow. At the same time, it argued that defenders retain an advantage because they have more context about their own code, cloud settings, user identities, and internal systems than an outside attacker.
“To take advantage of your deep context, it’s imperative to shift from manual, human-scale incident response to machine-speed security operations. We can no longer rely on human analysts manually triaging endless backlogs of static alerts,” Joyce said.
Google said this thinking informs Google AI Threat
Google said this thinking informs Google AI Threat Defence, which it described as a broader framework combining Gemini and other models with context from Wiz, code remediation from CodeMender, and incident response expertise from Mandiant. It added that this context also feeds into Google Security Operations so security teams can identify and disrupt attack paths more quickly.
Beyond customer-facing tools, Google said it is disabling projects, accounts, and assets used by known malicious actors on its platforms. It also feeds threat intelligence back into model development so its systems can better recognise and reject malicious requests.
The company added that it is using AI for vulnerability hunting and patching, citing CodeMender as one example of software designed to fix critical vulnerabilities in code. It also said teams at Google DeepMind are building defences for generative AI and monitoring misuse across Google’s wider environment.
If you use Google tools to facilitate
“If you use Google tools to facilitate an attack, you lose access to those tools,” Joyce said.
ChatGPT
Key takeawaysExplain why it mattersCreate action planFuture watch
Claude
Key takeawaysExplain why it mattersCreate action planFuture watch
Perplexity
Key takeawaysExplain why it mattersCreate action planFuture watch
Grok
Key takeawaysExplain why it mattersCreate action planFuture watchShareShareAdd us as a preferred source on Google
Related stories
F5 integrates AI Guardrails into MuleSoft Agent FabricAI systems expose sensitive data in ANZ, report findsCoder launches Agent Relay for Cursor in private previewAbnormal joins OpenAI’s Daybreak cyber partner programmeCyera launches tools to secure enterprise AI agents
Top stories
CFOs focus on cash flow as AI use rises in financeGSMA warns rising handset costs could widen AI divideFibre or satellite: Which is best for live event linking?Dayforce named leader in Gartner workforce managementDelinea joins Anthropic project to test identity security
