Sep 16, 2026 · 18 min · 8 segments
A financially motivated crew compromised thousands of credentials in under six hours...using an autonomous, multi-agent AI framework instead of a human keyboard. In this episode, Darnley breaks down…
So let's start with the headline case, because it's the cleanest example of what energetic actually means once someone points it at your infrastructure instead of your calendar.
A financially motivated actor.
Google's tracking a group called Team PCP, also known in some circles as Altered Spider or UNC6780.
It has been running large-scale software supply chain compromises against PyPy, NPM, and Docker Hub.
If you're a developer, those three names should already have your attention because that's your dependency tree that they are sitting in.
The initial compromise gets followed by one or two of the credential stealers.
First, Sandclock.
It's a Python-based, built to live on Linux, comfortable inside Kubernetes with container escape capability baked in.
It went after cloud credentials, developer credentials, and crypto wallets.
And it's part of a broader toolkit publicly nicknamed Canister Worm.
Then there is the successor, Dustmaker.
It dropped the container escape functionality, it didn't need it, and sharpened its focus on credential theft to feed extortion operations.
So Dustmaker is the first of two to poison AI assistant workspaces and use prompt ejection for defense evasion.
That's not incremental.
That's a toolkit that assumes your developers are pairing with an AI assistant, which builds completely around that assumption.
Now, the six-hour case itself.
Google describes an unnamed organization whose cloud infrastructure got compromised so the attacker could deploy an autonomous multi-agent attack framework.
One AI coding chatbot, one prompt, one set of pre-configured markdown instructions functioning as operational playbook.
So from there, the system ran automated scanning, troubleshot itself in real time and rotated IPs to stay ahead of detection without a human walking it through each step.
So thousands of third party credentials under six hours.
That's the number that matters here.
Not because the technique is somewhat exotic, but because the timeline used to be days, sometimes weeks.
Compressing that into an afternoon changes the defensive math for every sock that still treats detection and response as a same-day problem instead of a same-hour one.
So let's start with the headline case, because it's the cleanest example of what energetic actually means once someone points it at your infrastructure instead of your calendar.
A financially motivated actor.
Google's tracking a group called Team PCP, also known in some circles as Altered Spider or UNC6780.
It has been running large-scale software supply chain compromises against PyPy, NPM, and Docker Hub.
If you're a developer, those three names should already have your attention because that's your dependency tree that they are sitting in.
The initial compromise gets followed by one or two of the credential stealers.
First, Sandclock.
It's a Python-based, built to live on Linux, comfortable inside Kubernetes with container escape capability baked in.
It went after cloud credentials, developer credentials, and crypto wallets.
And it's part of a broader toolkit publicly nicknamed Canister Worm.
Then there is the successor, Dustmaker.
It dropped the container escape functionality, it didn't need it, and sharpened its focus on credential theft to feed extortion operations.
So Dustmaker is the first of two to poison AI assistant workspaces and use prompt ejection for defense evasion.
That's not incremental.
That's a toolkit that assumes your developers are pairing with an AI assistant, which builds completely around that assumption.
Now, the six-hour case itself.
Google describes an unnamed organization whose cloud infrastructure got compromised so the attacker could deploy an autonomous multi-agent attack framework.
One AI coding chatbot, one prompt, one set of pre-configured markdown instructions functioning as operational playbook.
So from there, the system ran automated scanning, troubleshot itself in real time and rotated IPs to stay ahead of detection without a human walking it through each step.
So thousands of third party credentials under six hours.
That's the number that matters here.
Not because the technique is somewhat exotic, but because the timeline used to be days, sometimes weeks.
Compressing that into an afternoon changes the defensive math for every sock that still treats detection and response as a same-day problem instead of a same-hour one.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
