Google Cloud’s September 2026 Cloud CISO Perspectives opens with Sandra Joyce, VP of Google Threat Intelligence, presenting the latest AI Threat Tracker findings and arguing that AI security strategy must be anchored in ground truth rather than speculation. Drawing on Google’s dual position as both a frontier AI lab and a security company, the post identifies three structural shifts CISOs need to address: AI is reshaping how software is built, expanding the attack surface, and enhancing threat capabilities.

On the development side, threat actors are contaminating upstream packages because AI assistants are trained to suggest and trust them; GTIG links this activity to the significant growth in large-scale open-source software supply chain compromises observed in 2025 and early 2026. Google’s answer is to build security natively into the AI pipeline, including in-editor guardrails that act as a real-time “spellcheck for cybersecurity,” flagging poisoned packages, toxic prompts, and misconfigured toolkits without slowing developers. The post cites TeamPCP (UNC6780), a financially motivated actor that has implemented more than half a dozen techniques to exploit AI tools and open-source development practices, including prompt injection and blinding AI scanners. It also argues that security must extend beyond the editor to the cloud, citing Wiz Code as an integrated code-to-cloud approach. Google deliberately orchestrates multiple foundation models—Gemini, commercial, and open-source—because single-model security creates a dangerous monoculture that no one model can fully avoid; cross-validation strips out false positives and identifies complex logic flaws.

On AI workloads, the post highlights LLMJacking, where attackers target GPU access to run unauthorized AI models. Mandiant investigated an April intrusion in which an exposed personal access token let an adversary deploy unauthorized AI infrastructure and scale high-performance compute, leaving the victim with the costs. In Q2 2026, Mandiant also investigated multiple data theft extortion operations where proprietary AI data—including models, prompts, source code, and research—was stolen, and underground forums are selling AI account credentials at discounts up to 99%. The post argues against managing AI-related risks in silos and instead calls for a unified dynamic graph connecting code, models, data lineage, and runtime identities. This design is embodied by the Wiz Security Graph and serves as the contextual engine for Google AI Threat Defense (AITD), which combines Gemini reasoning, Wiz contextual risk prioritization, CodeMender code remediation, and Mandiant frontline expertise, feeding directly into Google Security Operations.

For defense, adversaries are moving toward fully automated, multi-agent attack pipelines. In one Mandiant intrusion, a financially motivated actor compromised cloud infrastructure and used an AI coding chatbot, a prompt, and agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours. GTIG also observed a PRC-nexus espionage group using a tool called CC Switch to cycle through accounts and swap AI models such as Claude, Codex, and Gemini for writing exploit scripts and lures. The post frames defenders as holding an asymmetric advantage: attackers operate from outside with limited context, while defenders know their code, cloud configurations, identities, and internal architecture. Feeding that deep observability into AI models makes defense faster and more accurate than offense. Google is shifting from manual, human-scale incident response to machine-speed security operations by codifying frontline threat intelligence into AI agents that monitor, investigate, prioritize, and remediate attacks.

The post closes with Google’s ecosystem defense levers: proactively disabling projects and accounts of known bad actors, running a continuous feedback loop to harden AI models and classifiers against malicious requests, automating vulnerability hunting with tools like CodeMender, and having Google DeepMind build specialized defenses for generative AI with active monitoring across the ecosystem. The rest of the newsletter includes a manufacturing blueprint for secure agentic AI, the Fairwind Program for governments and trusted partners, the open-source Mantis harness, a patched GFile vulnerability, new session management controls, VPC Service Controls policy intelligence, Wiz Continuous Vulnerability Assessment, and Wiz GovRAMP High authorization. Threat intelligence items cover the AI Threat Tracker report, the financially motivated threat actor BREEZE COMET targeting Brazil, and Wiz Research findings on exploited JFrog Artifactory vulnerabilities. Podcast summaries cover Chrome Security using AI agents to identify and patch browser vulnerabilities, Wiz‘s Project Atlas multi-agent AI vulnerability research, and a secure-by-design discussion with Google principal security engineer Christoph Kern.