A developer's working directory collects hidden folders nobody opens on purpose. Google's report puts the DUSTMAKER credential stealer's output in exactly those, directories such as .claude and .cursor, where AI tooling reads the dropped files as ordinary developer clutter [9]. Nothing autonomous is needed for that to work. It works because the assistant's own file conventions create a place where a stray file is unremarkable.
The six-hour case runs on a different mechanism. Mandiant's suspected financially motivated actor got into the cloud infrastructure first, then built the framework out of an AI coding chatbot, a prompt and a set of agent instructions, with preconfigured markdown playbooks driving the scanning and harvesting [3][4]. The autonomy sat in the middle of the chain: troubleshooting and IP rotation ran with no operator, and because traffic left from the victim's own addresses it looked legitimate on the way out [5]. Take thousands at its lowest honest reading, 2,000, and under six hours as under 360 minutes, and the floor is roughly five and a half credentials a minute, retries included [1].
Two GTIG statements sit side by side. John Hultquist's warning is that criminals will gravitate to attacks faster than defenders can respond [15]. The report also says GTIG has not observed fully autonomous attack pipelines deployed against targets in the wild [7], and the closest attempt, a suspected China-linked group designing an automated penetration testing framework with Gemini, never got past trying to build it before Google disabled the assets [8]. So initial access still runs at human pace, while everything after it no longer has to.
The delivery side has been busy in parallel. UNC6780, which Google also tracks as TeamPCP, poisoned the LiteLLM gateway in March and has since pushed trojanized forks of Model Context Protocol servers across PyPI, npm and Docker Hub while injecting malicious code into GitHub repositories that AI coding assistants clone [10][11]. That is four distribution paths terminating on a developer machine [2]. Some loaders carry prompt injections phrased as extreme biological and nuclear weapons requests, apparently so that an LLM security scanner refuses the file and never reads the malicious JavaScript underneath [12]. Credential hygiene is the same story one layer down: an exposed GitHub token was enough for an attacker to provision high-performance GPU instances in April on a victim's bill [16].
For whoever is rolling out a coding assistant, two properties decide the exposure, and neither appears on the pricing page. First, what the tool can read from the filesystem without being asked. Second, what it can execute or fetch without a human approving. Broad read with approval required is a theft problem, and DUSTMAKER is the shape of it [9]. Broad read with no approval is the shape of the six-hour campaign. Narrow read with no approval is the tolerable half of the automated pair, and it is the configuration that takes real work to arrange.
Which quadrant actually hurts depends on the gap between an assistant acting and a human looking. On an eight-hour shift, a campaign that completes in under six leaves more than two hours before the shift is even over [3]. If the queue gets triaged the following morning, the artifact the team produces is a post-mortem.
