Google: AI agents ran a full credential heist in under 6 hours
Google's threat team logged the first autonomous agent breach — plus malware hiding in .cursor and .claude and trojanized MCP servers on PyPI.
Copy markdown
The heist: thousands of secrets, under 6 hours
A financially-motivated crew ran an autonomous multi-agent framework that scanned targets, rotated IPs, and self-debugged with minimal human input — lifting thousands of third-party credentials in under six hours and routing traffic through the victim's own cloud IPs. Its "Recon" command panel was already holding 23,800+ harvested API keys for cloud and AI services.
Malware that hides in .claude and .cursor
A new stealer, DUSTMAKER, drops files into .claude/, .cursor/, and .vscode/ to blend into dev setups, plants workspace hooks that auto-run when your IDE opens, and uses config-file prompt injection to make your own AI assistant execute its commands. Treat editor project configs as untrusted code, not settings.
Trojanized MCP servers landed on PyPI
Attackers shipped malicious MCP servers to PyPI — including tiktoken_mcp and azure-functions-mcp-extension — and poisoned GitHub Actions to publish packages carrying valid SLSA Build 3 attestations, the exact trust signal agents lean on. Pin and audit every MCP dependency; a green attestation is no longer proof it's clean.
Stealers are hunting your plaintext API keys
Infostealer families (LUMMAC.V2, STEALC.V2, ACRSTEALER) now specifically scrape AI-tool configs — ACRSTEALER pulls plaintext keys from Cline's secrets.json and Continue's config.yaml. Get keys out of config files and into a secret manager, and rotate anything that has been sitting in the clear.
Cursor and Devin logins now sell for double
Google says average underground prices for Cursor Pro and Devin accounts doubled year-over-year, with Claude and Gemini credentials in heavy demand — a direct bounty on builder logins. Turn on MFA and watch for bulk or odd-IP API registrations tied to your accounts.