ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0527

ACVE-2026-0527

A threat actor used an AI coding chatbot and agent instructions to plan and execute a mass credential-harvesting campaign in less than six hours, compromising thousands of third-party credentials.

Exposure

Evidence
Real use · vendor report
Harness
An AI coding chatbot with preconfigured agent instructions — confirmed, cloud.google.com
Model
any — confirmed, cloud.google.com
Goal
Mass credential harvesting — confirmed, cloud.google.com
Tools and settings
Compromised cloud resource, automated scanning and credential-harvesting workflows — confirmed, cloud.google.com
Approval
The campaign ran through preconfigured instructions without reported human review of each action — detected, cloud.google.com
Input controlled by
operator
What the agent does
The agent-enabled workflow scans for and harvests third-party credentials.
Harm
credential-theft
Reach
Third-party credentials and a compromised cloud resource — confirmed, cloud.google.com (cloud credentials, API keys, the network)
Condition
When preconfigured agent instructions were used as the campaign's operational playbook — confirmed, cloud.google.com
Scale
Thousands of third-party credentials were compromised — not stated accounts, cloud.google.com

Reproducibility: partial (vulnerable components are not confirmed obtainable; trigger not published)

Severity
CRITICAL · harm and reach
Status
Unverified
Kind
Behavioural
Modified
2026-09-25
Aliases
No CVE assigned — No code defect: the harm arose from an attacker directing an agent-enabled campaign.
Affected
  • AgentHarness: ai-coding-chatbot — all versions
Harness/product
ai-coding-chatbot
Classes
credential-theft; over-privileged-combination; CWE-522; CWE-693
First reported
2026-09-08 — Google Threat Intelligence Group
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

Description

Threat

user · unsafe-default · exfiltration

What

GTIG says a threat actor used an AI coding chatbot, a prompt and preconfigured agent instructions to plan, build and execute a mass credential-harvesting campaign in under six hours. The campaign compromised thousands of third-party credentials.

Detection

GTIG reported the activity in its Q2 2026 threat tracker. Recorded from Google Threat Intelligence Group's report. Not recreated in a lab.

Fix

Keep credential-harvesting workflows out of agent reach, require review for high-impact actions, and monitor automated use of exposed cloud resources.

Fix

The operator was the attacker, so victims depend on the model provider and the cloud provider detecting and cutting off the campaign.

  • Reconfigure chatbot-provider.misuseDetection to detects and cuts off accounts building credential-harvesting campaigns. Recommended: an AI coding chatbot helped plan, build and run the campaign in under six hours. Owner: model-provider
  • Reconfigure cloud-provider.abuseDetection to detects mass scanning from a compromised resource. Recommended: the campaign used a compromised cloud resource. Owner: infra-provider

References

REPORT

Report a problemJSON