Google Threat Intelligence Group said on Q2 2026 activity that adversaries have moved from basic prompting to agentic AI workflows, including one cloud compromise that led to a mass credential-harvesting run in under six hours. GTIG also tracked UNC6780 using AI coding assistants and large language model (LLM) security scanners to support open-source supply-chain compromises.
The shift is in the execution loop: multiple AI agents can scan, correct their own mistakes, and keep moving without the pause a human team would normally need. That compresses a campaign from plan to impact before ordinary review, detection, or approval cycles can interrupt it.
For teams using AI assistants against code, tickets, or cloud data, the exposure is no longer just policy drift around unapproved tools. A single stolen identity or foothold can now be turned quickly into credential theft or package tampering, which leaves defenders with less time to notice and contain the blast radius.
Why 2026 is the Year to Upgrade to an Agentic AI SOC
Agentic AI SOCs differ from copilot-only models by autonomously prioritizing attacks over alerts, executing closed-loop containment, and providing traceable reasoning for every decision, allowing anal...
Proofpoint’s SOC Analyst Agent uses OpenAI Daybreak models to help security teams investigate threats, connect signals, and automate recurring analysis.