Google GTIG: Adversaries Went Agentic, and AI Coding Tools Are the New Supply-Chain Door

When we talk about AI security, we usually mean "will the model say something wrong." Google Threat Intelligence Group took a different angle in its Q2 2026 tracker: what they saw was adversaries treating AI as an upgrade to their tooling. The report is blunt about it. In Q2 2026, GTIG observed threat actors compromise a cloud resource, then plan, build, and execute an agent-enabled mass credential harvesting campaign inside it. The same report contains a sentence that should stop anyone who writes code: AI coding tools are becoming a primary target for threat actors, because they sit in a critical place in the development pipeline and are trusted by default.

"Adversaries installed AI in their own pipeline"

1. The Line From Prompting to Autonomy

This tracker follows GTIG's May 2026 report on adversarial misuse of AI. Read together, the two describe a clean evolutionary line: early use was "help me phrase this better," and current use is "run this whole workflow for me." The difference is not the wording; it is that automation removes the human bottleneck. Reconnaissance, enumeration, collection, and packaging used to require a person watching each step. Now they run continuously. For defenders this compresses the attack window from hours into minutes, and manual review stops being a viable detection strategy. The practical consequence is a change in tempo rather than in sophistication. A human operator working through a target list is bounded by attention and by sleep; an agent-driven campaign is bounded only by rate limits. That is why the report frames the shift as autonomy rather than as a better model.

# 1) Never keep a long-lived publish token in CI. Use OIDC.
#    A stolen runner token is how Dustmaker published "trusted" packages.
name: release
on: { push: { tags: ["v*"] } }
permissions:
  id-token: write        # short-lived, scoped, no static secret
  contents: read
jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci --ignore-scripts   # no arbitrary postinstall execution
      - run: npm publish --provenance   # signed provenance attestation

2. The UNC6780 Playbook: Dustmaker and Blending Into the Noise

The report names criminal group UNC6780, also known as TeamPCP, which has run software supply-chain attacks against ecosystems including PyPI, npm, and Docker Hub since March 2026. Its malware, Dustmaker, has a technique built for the AI era: it extracts tokens from the process memory of GitHub Actions runners, which lets it publish compromised package versions that pass valid AI coding automated trust checks. The sneakier move is dropping or modifying malicious files inside hidden project workspace directories used by AI coding assistants, where caches and scratch files already pile up. The payload blends into everyday noise.

// 2) Scan the dirs AI coding assistants use as scratch space.
//    A payload hiding next to cache files still has a hash and a diff.
const AGENT_DIRS = [
  ".git", ".cursor", ".claude", ".aider", ".continue",
  "node_modules/.cache", ".next/cache", ".open-next",
];

function findSuspicious(root) {
  return AGENT_DIRS.flatMap((d) => scan(path.join(root, d)))
    .filter((f) => f.executable || f.hasShebang || f.installsNetwork());
}

const hits = findSuspicious(process.cwd());
if (hits.length) {
  console.error("unexpected executables in agent scratch space:", hits);
  process.exit(1);
}

3. Why AI Coding Tools Widen the Blast Radius

The report's conclusion is worth pinning to a wall: AI coding assistants and open source software accelerate development, and they have also expanded the opportunities for attackers to hide malicious code within projects and dependencies. Two mechanisms sit inside that sentence. First, coding agents autonomously read repositories, install dependencies, and run scripts, so every file they touch is potential input. Second, as "the code was written by AI" becomes normal, teams lean harder on automated trust checks, and a leaked token lets an attacker forge a release that passes them. Trust got automated, so forgery got automated too. There is a third mechanism worth naming, because it is easy to miss: provenance fatigue. Once automated checks are the norm, reviewers stop reading them, and a green check becomes an emotional signal rather than evidence.

# 3) "Passed the automated check" is not "trustworthy". Verify bytes.
import hashlib, json

def verify_lockfile(lock, registry):
    problems = []
    for name, meta in lock["packages"].items():
        want = meta.get("integrity")
        got = registry.digest(name, meta["version"])   # fetch authoritative hash
        if want != got:
            problems.append((name, meta["version"], want, got))
    return problems

bad = verify_lockfile(json.load(open("package-lock.json")), registry)
if bad:
    raise SystemExit(f"integrity mismatch: {bad}")

4. Turning Safety Guardrails Into a Bypass

The same tracker contains a grimly ironic detail: UNC6780 pasted biological and nuclear weapon schematics directly into its malware's code comments, not to build weapons but so that reviewing security scanners would refuse to inspect it. Model safety policies decline or downgrade analysis on that kind of content, so the payload slips through in the gap. The general lesson is that any assumption of the form "the model will refuse dangerous content" becomes a bypass switch in an attacker's hands. The answer is not to remove guardrails but to add deterministic checks beside them: signatures, hashes, reproducible builds.

// 4) Least privilege for coding agents: explicit allowlists only.
const AGENT_POLICY = {
  readRepos: ["org/checkout-service"],          // nothing else is visible
  install: { allow: ["^[a-z0-9-]+$"], deny: ["*-nightly", "*-beta.*"] },
  secrets: [],                                  // agents hold no static secrets
  egress: { allow: ["registry.npmjs.org"], deny: ["*"] },
  maxRuntimeSeconds: 900,
};

function authorize(agentCall) {
  if (!AGENT_POLICY.readRepos.includes(agentCall.repo)) return deny("repo");
  if (agentCall.host && !AGENT_POLICY.egress.allow.includes(agentCall.host))
    return deny("egress");
  return allow();
}

5. Close Four Holes First

Following the evidence trail in the report, four things come first. One, stop parking long-lived tokens in CI and switch to short-lived OIDC credentials for publish rights. Two, bring the hidden workspace directories used by AI coding assistants into your scan scope; a cache directory should not be a legal gray zone. Three, verify dependency origin and hashes so that "passed the automated check" stops being a synonym for "trustworthy." Four, minimize coding-agent permissions: which repositories it can read, which packages it can install, and which secrets it can touch should all be explicit allowlists. These four do not solve everything, but they break the complete attack chain the report describes.

# 5) Agent-driven attacks are fast. Alert on rate, not just on type.
ALERT_RULES = [
    # one actor pulling many packages in a short window
    {"name": "bulk-download", "threshold": 50, "window_sec": 60},
    # a brand-new publisher touching a high-download project
    {"name": "new-publisher-hot-project", "min_stars": 1000, "account_age_days": 2},
    # token used from an unexpected network range
    {"name": "token-egress-anomaly", "expect_regions": ["us-east-1"]},
]

def triage(events, rules):
    fired = []
    for rule in rules:
        window = [e for e in events if e["kind"] == rule["name"]]
        if len(window) >= rule.get("threshold", 1):
            fired.append((rule["name"], len(window)))
    return fired

print(triage(load_audit_log(), ALERT_RULES))

6. A Hardening Checklist

Five rules to land it. First, run all publishing through OIDC, with no long-lived write tokens in any workflow. Second, include .git, hidden cache directories, and agent workspace directories in secret scanning and file-integrity checks. Third, add hash verification to lockfiles and forbid installs without a lock on CI. Fourth, give coding agents their own credentials and egress rules, never shared with human accounts. Fifth, treat "the model refused" as a soft signal and deterministic verification as the hard gate. The real value of the GTIG report is not another list of CVEs. It is the message that adversaries have already installed AI in their pipeline, and yours has to keep up. And the cheapest rule of all: rotate anything that can publish. A credential that cannot exist for more than an hour cannot be quietly reused for a month.