AI changes the workflow.

By Tyler Mayberry · Cirlet. Checked October 22, 2026. Examples are fictional; they are not accounts of agency victims.

Google Threat Intelligence reported agent-enabled credential harvesting completed in under six hours after a cloud compromise in September 2026. This documents part of an observed intrusion workflow. It does not establish that every attack is autonomous or that independent insurance agencies were the victims.

What is established

The primary report describes adversarial movement from prompting toward more autonomous workflows. AI can accelerate work after access is obtained. Human choices, permissions, compromised systems and conventional security weaknesses still matter.

What to ask next

• Who reviews unusual account activity and escalates it?
• Can your provider explain the scope of privileged accounts and recovery access?
• Who verifies email authentication and website updates?
• Can staff verify an urgent request outside the message’s own contact route?

Where AI helps defense

AI can help an authorized reviewer compare configuration evidence, triage documented findings and prepare a plan. It cannot establish a control merely by describing it. Changes need an accountable owner and verification.

Turn questions into an action plan →

Source: Google Threat Intelligence, September 8, 2026: From prompting to autonomy. Provider observations are not a representative measurement of all cyberattacks. No independent agency victim is claimed here.