From Human Guessing to Agentic Guessing
Password attacks used to be limited by human time. An operator could try a few passwords, search a few repos and test a few leaked logins before moving on. That limit is gone: AI agents now intelligently guess, find and replay credentials without fatigue.
Two recent cases show both sides of the problem:
- Gemini (Google, disclosed Sep 18, 2026): in a test that lost containment, an AI agent guessed one company’s password and used credentials found in public code repositories to get into two more.
- GTG-50021 (Anthropic, Sep 10, 2026): a fake “discounted Claude” reseller installed a credential harvester that stole buyers’ Anthropic account credentials, then sold them onward.
In the first case the agent did the attacking, by accident, in a test that lost containment. In the second, the AI tool is the bait. In both, a reusable credential made the attack work.
The Same Attacks, Now Automated at Scale by Agents
Anthropic’s September report describes attacks using stolen credentials, phishing and exposed systems. Attackers already used automated tools. AI agents reduce the work needed to choose tools, interpret results and decide what to try next.
| Typical before agents | Agent-driven (2026 evidence) | |
|---|---|---|
| Who runs it | Skilled operator | One operator directing agents |
| Tempo | Days to weeks | Breaches completed in 2 to 3 hours |
| Scale | A few targets at a time | Dozens of victims handled in parallel |
| Finding credentials | Manual search | Automated mining of repos, app binaries, containers and AI agents; one pipeline scanned 1.8M Android APKs for hardcoded secrets |
| Testing credentials | Manual logins | Batch cloud key validation, purpose-built login oracles, live replay against production |
Source for the agent-driven column: Anthropic, Detecting and countering misuse of AI: September 2026.
Case 1: Gemini Guessed a Password and Used Credentials Found in Public Repositories
In May 2026, a Gemini agent in a capture-the-flag (CTF) test run by Irregular logged into three real companies: one by guessing a password, two with credentials found in a public code repository (The Hacker News).
The test was meant to be offline. A configuration error gave the agent internet access, and the fictional target’s name matched a real domain. Google says the model stopped once it realized the targets were real.
Figure 1. Reported Gemini access paths across separate runs.
No exploit and no zero-day. The agent used the two oldest credential techniques there are, and both only work where a reusable credential exists. The model stopping on its own is behavior, not a control: by then the logins had already succeeded.
Case 2: Gtg-50021 Sold Fake AI Access to Steal Real Credentials
GTG-50021, a Russian- and Ukrainian-speaking group, sold “cheap Claude” access that, in Anthropic’s words, was “neither cheap nor actually Claude.” Buyers’ traffic was silently proxied to a different model while the reseller’s tooling installed a credential harvester that stole their Anthropic account credentials and sold them onward. Anthropic describes a closely related scheme in which fake clients spoofing tools like Claude Code took every credential and session token on the victim’s device, and kept collecting new sessions after the victim reset their keys.
The video above illustrates a lookalike Claude Code client that redirects API calls to cheaper models. It is not footage of GTG-50021’s actual tooling.
Sounds scary, doesn’t it? That’s not the full story. The reseller’s tooling also installed a credential harvester that stole buyers’ Anthropic account credentials and sold them onward. Anthropic describes a closely related scheme in which fake clients spoofing tools like Claude Code took every credential and session token on the victim’s device, and kept collecting new sessions after the victim reset their keys.
The cheap model was the lure. The credential harvester was the payload.
Figure 2. LLM model substitution and credential theft in GTG-50021.
An employee adopting a reseller like this without approval creates shadow AI: an unreviewed service handling data and potentially installing a malicious client. Credential theft becomes a risk of AI adoption.
How Unixi Breaks the Chain
Unixi removes one input both attacks relied on: reusable passwords for browser-based logins. It doesn’t cover API keys, hardcoded secrets, or session tokens, which is most of what Anthropic describes attackers mining. Those need their own controls.
| Attack step | Seen in | What Unixi changes | Limit |
|---|---|---|---|
| Guess a password on a web login | Gemini, run 1 | Universal SSO with KDA gives governed browser apps no user-chosen password to guess | Only apps Unixi governs |
| Use credentials found in a public repo | Gemini, runs 2 and 3 | Employees never create or see the password, and each app gets its own derived credential, so one exposed credential can’t be reused elsewhere | Doesn’t cover API keys or service credentials, which repo scanning mostly finds |
| Harvest saved credentials from a device | GTG-50021 | Governed browser apps have nothing saved in the browser or a vault for a harvester to take | Doesn’t cover API keys, session tokens, or non-browser logins |
| Sign up for an unapproved “cheap AI” service | GTG-50021 | Shadow AI discovery at login and registration | Browser sign-ups only, not installing a fake desktop or CLI client |
