AI security: more autonomous attacks call for an inventory before the crisis
In a post from September 8, the group said it had observed adversaries moving from isolated commands to flows with agents and automation. The data doesn't represent every incident or estimate a small company's risk: it was produced from the group's telemetry, Mandiant responses and platform defenses. Its relevance lies in the speed described and the type of asset targeted.
The target isn't just the model
The report cites attempts to obtain proprietary models, source code, prompts, API credentials and cloud resources. It also reports risks in the development chain, with agents targeting developers, coding assistants and security tools.
For a company, this widens the perimeter to protect. You need to know which accounts call the API, which repositories contain keys, what data reaches the assistants and what permissions each agent gets. An exposed key can generate cost, improper access or unauthorized use of the infrastructure.
Speed requires controls in advance, not just reaction
The first move doesn't have to be buying a new platform. It can be organizing basic controls:
- keep an inventory of models, accounts, APIs, agents and integrations;
- apply strong authentication, least privilege and separate keys per environment;
- log calls, access, changes and unusual consumption;
- define allowed data, review coding assistants and test credential revocation.
The goal is to reduce the time between detection and containment. If the team doesn't know which agents exist, which systems they access or who can turn them off, the response starts with an inventory made during the crisis.
Security isn't a roadblock to adoption
Vague controls produce either release without follow-up or a ban that pushes use into invisible channels. A useful policy defines allowed data, approvals, review and owners. An agent that consults internal documents should have minimal access, log calls and route irreversible actions to a person.
GTIG also mentions the reduction of human response time in automated attacks. Applying this to management is a recommendation, not a universal statistic: the more speed the company adds to its own flows, the more it needs brakes and logs.
The starting point is knowing what needs protecting
A practical assessment starts with three questions: what information can't leave, what processes can't stop and what credentials would widen an incident. Leadership should connect each answer to a control, an owner and a test.
When it operates with access to systems and data, AI is also part of the risk surface. Governing this layer means reducing the surprise when a flow fails or a credential behaves unusually.
The inventory needs to include the AI layer
List models, keys, accounts, integrations, data, permissions and usage limits. For each item, define an owner, monitoring, credential rotation, event logging and a response path when there is anomalous behavior.
Sources
Google Threat Intelligence Group, 8 Sep 2026. https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai