Google warns agentic AI credential theft scales to thousands of accounts

The shift toward autonomous exploitation means streaming platforms must move beyond human-centric security to manage machine identities. As these services rely heavily on cloud-based encoding and delivery, stolen API keys allow attackers to hijack expensive computing resources while shifting costs to the legitimate account holder. This trend forces a transition from static bearer tokens to dynamically issued credentials that expire quickly. The ecosystem impact is significant, as a single compromised repository can expose proprietary source code and sensitive viewer data. Watch for organizations to adopt NIST-recommended identity foundations that restrict AI agent permissions to specific, time-bound tasks.

Google's broader security posture around agentic AI extends well beyond the credential-theft report. At DTW Ignite 2026 in Copenhagen, Nokia teamed up with Google Cloud to build six specialized Gemini-powered agents for telecom network troubleshooting, targeting alarm triage, KPI analysis, anomaly detection, and remediation. The deployment illustrates the same agentic architecture that threat actors are now weaponizing: autonomous agents that reason over operational data and execute multi-step actions without human intervention. Google Cloud's Autonomous Network Operations Framework, which underpins the Nokia collaboration, launched at DTW 2025 and represents the defensive counterpart to the offensive capabilities Google Threat Intelligence Group documented.

The competitive landscape for agentic AI in network operations is intensifying, raising the attack surface proportionally. In June 2026, Ericsson launched its AI in RAN commercial software subscription claiming up to 20% higher downlink throughput across more than 15 live deployments, while Verizon disclosed that its 60,000-site vRAN network is now applying agentic AI to configuration changes and service assurance. Verizon publicly called for industry-wide interoperability standards for agentic systems, highlighting that no standardized protocol yet exists for agentic command and control across multi-vendor environments. That governance gap is precisely the kind of ambiguity that credential-theft campaigns exploit when autonomous agents hold broad API permissions.

Nokia's parallel infrastructure moves underscore how deeply agentic AI is being embedded into operational stacks, creating both efficiency gains and new threat vectors. Nokia announced partnerships with AWS and Databricks to build a unified data and control layer for autonomous networks, claiming operators are already achieving automation rates above 90% and service interruption periods of one minute per year or fewer. The company's Autonomous Network Fabric runs agents across radio, core, transport, and service domains, meaning a single compromised credential could cascade through an entire operational stack. Meanwhile, Light Reading reported that Nokia's RAN strategy is now built on its Nvidia partnership, cemented by a $1 billion investment, while Ericsson pursues a fundamentally different approach using existing baseband silicon. This architectural divergence means security teams must defend against agentic threats across heterogeneous platforms with different permission models, complicating the machine-identity governance that Google's report identifies as critical. To address these vulnerabilities, that arise when autonomous API workflows lack robust oversight.