Attacker Hijacks Google Cloud for AI Compute
Google Threat Intelligence Group traced an April 2026 cloud intrusion that began with an exposed GitHub access token and was used to provision AI compute resources.
Updated on Nov. 2, 2026 in Artificial Intelligence
Google Threat Intelligence Group identified a cloud intrusion in April 2026 that started with an exposed GitHub personal access token. The attacker used it to enable Gemini Enterprise, provision compute, and deploy AI agent-framework containers on publicly accessible Cloud Run services.
Why it matters
The case shows how a single leaked credential can be used to run unauthorized AI workloads at scale on rented cloud infrastructure. It also reflects a broader rise in demand for AI-related accounts on underground markets.
The attacker launched additional 48-vCPU instances after requesting quota increases for NVIDIA RTX 6000 hardware. Average underground-market prices per account more than doubled in 2026, according to the investigation.
The players
Google Threat Intelligence Group
Google's threat intelligence unit, which investigates cyber intrusions and tracks threat actors targeting cloud and AI platforms.
Google Cloud
Google's cloud computing platform, which hosts Cloud Run services, Gemini Enterprise, and the compute instances involved in the intrusion.
The details
The intrusion began with an exposed GitHub personal access token that gave the attacker a foothold. The attacker then enabled Gemini Enterprise, placed LiteLLM and Manus agent-framework containers on publicly accessible Cloud Run services, and created an Editor-level service account.
Timeline
April 2026: The cloud intrusion began through the exposed GitHub token.
2026: Average underground-market prices per account more than doubled.
The Tech Race
The intrusion reflects a broader shift in which attackers target AI compute and accounts, a trend Google Threat Intelligence Group has documented through rising underground-market demand and seller counts. Average prices per account more than doubling in 2026 shows that stolen AI access has become a more valuable commodity.
Anyone who stores tokens or credentials in code repositories faces the risk that a single exposed key can grant access to cloud compute and AI services. Developers and administrators should audit public repositories and restrict publicly accessible services to reduce exposure.
The takeaway
Treat personal access tokens as sensitive secrets and rotate or revoke any that may have been exposed in public code. Limiting permissions and reviewing publicly reachable cloud services can prevent unauthorized AI compute use.
Further reading
Explore more reporting on Artificial Intelligence to see how these cloud security risks connect to the wider AI industry.
