Google warns AI is reshaping cyber attacks & defences

Google has outlined how it tracks cyber attackers' use of artificial intelligence and deploys AI-based defences across its security products. Its threat intelligence work points to three broad shifts in the threat landscape.

Those shifts are AI's effect on software development, the expanding attack surface around AI systems, and the use of AI to improve attackers' effectiveness. Sandra Joyce, Vice President, Google Threat Intelligence, said security leaders need to focus on observed activity rather than speculation about how threats may evolve.

AI-assisted software development is creating new supply chain risks as coding tools suggest packages and components that developers may trust without close scrutiny. Google said threat actors are trying to exploit that trust by contaminating upstream packages recommended by AI assistants.

It linked that trend to a rise in open-source software supply chain compromises across 2025 and early 2026. In response, Google argued for building security checks directly into development tools rather than slowing development work.

Joyce described that approach in familiar terms. "Part of this process involves in-editor guardrails for developers that create a real-time 'spellcheck for cybersecurity,'" she said.

Google is also watching attacks aimed at AI agents and software development tools. It identified a financially motivated threat actor known as TeamPCP, or UNC6780, as using several methods to exploit AI tools and open-source development practices, including hijacking AI toolkits, prompt injection, and attempts to blind AI scanners with harmful prompts.

Model risks

Google warned against relying on a single large language model for security analysis. It said single-model deployments risk creating a monoculture that attackers can probe for weaknesses, especially if they discover prompts or inputs that evade a model's filters.

Instead, Google uses several foundation models, including Gemini as well as commercial and open-source models, to compare findings and identify issues one model may miss. The aim is to reduce false positives and improve detection of more complex logic flaws.

Google also outlined risks around AI infrastructure itself. One method it highlighted was "LLMJacking," in which attackers seek access to graphics processing unit resources to run AI models and agent-based workflows without authorisation.

In one case cited by Google, a threat actor gained access to a cloud environment through an exposed personal access token and then deployed unauthorised AI infrastructure. The intruder scaled compute resources in the victim's environment, leaving the organisation with the associated hardware and platform costs.

Another concern is the theft of AI-related data. Google said cybercriminals are increasingly targeting prompts, agent instructions, fine-tuned models, source code, and research data. It also said account credentials tied to AI services are being traded in underground forums.

Attack automation

Threat actors are moving beyond basic prompt use towards multi-agent attack pipelines that automate a wider range of tasks, Google said. It described one intrusion investigated by Mandiant in which a financially motivated actor compromised cloud infrastructure and then used an AI coding chatbot, a prompt, and a set of instructions to build and run a mass credential-harvesting campaign in less than six hours.

Google also said it had observed a China-linked espionage group testing a tool called CC Switch to rotate among multiple accounts and switch between different AI models for specific tasks. The aim, it said, was to choose the most suitable model for work such as writing exploit scripts and drafting lures.

In Google's view, that activity shows how AI can turn an otherwise fragmented manual process into a more continuous workflow. At the same time, it argued that defenders retain an advantage because they have more context about their own code, cloud settings, user identities, and internal systems than an outside attacker.

"To take advantage of your deep context, it's imperative to shift from manual, human-scale incident response to machine-speed security operations. We can no longer rely on human analysts manually triaging endless backlogs of static alerts," Joyce said.

Google said this thinking informs Google AI Threat Defence, which it described as a broader framework combining Gemini and other models with context from Wiz, code remediation from CodeMender, and incident response expertise from Mandiant. It added that this context also feeds into Google Security Operations so security teams can identify and disrupt attack paths more quickly.

Broader response

Beyond customer-facing tools, Google said it is disabling projects, accounts, and assets used by known malicious actors on its platforms. It also feeds threat intelligence back into model development so its systems can better recognise and reject malicious requests.

The company added that it is using AI for vulnerability hunting and patching, citing CodeMender as one example of software designed to fix critical vulnerabilities in code. It also said teams at Google DeepMind are building defences for generative AI and monitoring misuse across Google's wider environment.

"If you use Google tools to facilitate an attack, you lose access to those tools," Joyce said.