Google Threat Intelligence Group
CompanySecurity timeline
- Named in breach reports by The Register (all)Criminals hijacking corporate LLM access run up charges exceeding $100,000 a day
Recent news
Criminals hijacking corporate LLM access run up charges exceeding $100,000 a day
Attackers are hijacking corporate LLM API access in a practice called LLMJacking, consuming expensive model resources at the victim's expense. Mandiant reported daily charges above $100,000 and cumulative losses reaching $1 million before victims revoked access. Google Threat Intelligence Group says intruders use stolen keys, misconfigured service accounts and session hijacking, and that a division of labour has emerged between access brokers and LLM Mixers.
Hackers weaponise ARTEX AI agents to automate network intrusions and data theft
Threat actors are abusing ARTEX, an autonomous penetration-testing framework, to speed up network intrusions, escalate privileges and exfiltrate sensitive data. Google Threat Intelligence Group and Mandiant investigations describe attackers delegating much of their post-compromise activity to coordinated AI agents, compressing execution into seconds. The activity has been observed since late August 2026.
Attackers use open-source ARTEX AI agent to automate Active Directory attacks
ARTEX, an open-source multi-agent penetration testing and command-and-control platform written in Go, is being abused to automate Active Directory attacks, including Kerberoasting, DCSync and lateral movement. Google's Threat Intelligence Group and Mandiant have seen it used since late August 2026 against organisations in several sectors, and Microsoft has linked it to a China-linked group targeting Microsoft 365 tenants. Google says it trades stealth for speed, so defenders can still detect it through its noisy logs and artefacts.