AI agents weaponizing stolen
source code to find zero-days

• Accenture Cyber Intelligence (CI) has identified an active, AI-enabled hacking campaign using semi-autonomous AI agents to conduct reconnaissance, discover vulnerabilities, and gain initial access to organizations, primarily observed across the Asia-Pacific region.
• The threat actor is stealing private source code via compromised GitHub Personal Access Tokens, then turning AI agents loose on that code to find and chain together novel vulnerabilities.
• We are releasing indicators of compromise now so that security teams and incident responders can begin hunting for this activity immediately.

Accenture Cyber Intelligence (CI) has identified threat actor infrastructure tied to a campaign that uses a network of AI agents to attack a number of organizations, mostly located in the Asia-Pacific region. The activity has been ongoing since at least September 2026, and possibly earlier. While the threat actor's specific identity remains unknown, CI observed linguistic and operational indicators consistent with a Chinese-speaking operator.

The novel aspect of this campaign is how the threat actor is using AI agents to do the typically manual work of reviewing stolen code for exploitable flaws that can then be used to facilitate initial access. And leveraging AI may allow the threat actor to do that work at scale, materially compressing the time between a source code breach and a working exploit chain.

The attacker's workflow likely centers on OpenCode, an open-source AI coding agent, which the threat actor has repurposed to orchestrate autonomous reconnaissance, enumeration, and exploit development, judging from observable evidence.

In most observed cases, the actor first obtains a victim's compromised GitHub Personal Access Token to pull down private source code repositories. From there, AI agents are directed to analyze that code, identify vulnerabilities, including previously unknown ones, and chain them together into functional exploit paths. Those chains have then been used to gain initial access to systems spanning both development and production environments.

This campaign highlights a meaningful shift in tradecraft. Source code theft has traditionally been valuable for espionage, IP theft, or slow, manual vulnerability hunting. Here, it's being used as raw material for an automated pipeline that can move from stolen repository to working intrusion with limited human involvement at each step. That has direct implications for how quickly organizations need to respond once they learn their source code has been exposed. The window between "our code was stolen" and "our code was used against us" may now be measured in a fraction of the time defenders are used to.

39 IP addresses: 4 command and control (C2) servers, 1 relay, 1 pivot or operational box and 33 AI agent workers. Indicators are defanged: replace [.] with . before loading them into security tools.

96.44.169[.]139
23.95.119[.]178
107.173.229[.]93
192.227.235[.]130
23.95.10[.]50
23.95.238[.]186
107.150.27[.]113
198.44.63[.]154
192.255.162[.]252
192.255.149[.]200
192.255.230[.]154
198.44.123[.]197
192.255.230[.]150
192.255.249[.]195
192.236.172[.]20
104.168.63[.]68
192.210.226[.]215
172.245.19[.]10
143.246.202[.]86
104.223.55[.]22
192.3.63[.]188
192.3.89[.]104
198.44.49[.]227
107.174.137[.]238
107.175.182[.]105
155.94.144[.]182
155.94.154[.]173
192.161.57[.]144
192.255.130[.]116
192.255.136[.]29
198.44.55[.]239
198.44.56[.]190
192.227.235[.]121
198.44.63[.]100
23.94.203[.]169
107.174.228[.]78
198.46.142[.]90
192.129.149[.]151
45.61.182[.]49

Accenture Cyber Intelligence notes this campaign reinforces a trend we have been tracking closely, namely how attackers are moving past simple techniques, like writing phishing lures or automating low-skill tasks, to perform genuine vulnerability research against an organization's own code. Any organization whose source code could be exposed through a compromised developer credential should now consider whether that exposure is a precursor to a fast-moving, automated exploitation attempt.

Defenders also should consider the possibility that AI-assisted attackers may identify and weaponize vulnerabilities not previously detected through manual or automated review.

Accenture Cyber Intelligence suggests:

• Hunting for the indicators in your network and security logs now. Early detection is critical to disrupting this AI-assisted intrusion activity before it reaches production systems.
• Rotating Personal Access Tokens and other sensitive credentials frequently. In the cases we observed, compromised GitHub PATs (including Classic tokens) are the recurring access vector in this campaign, so frequent rotation limits how long a stolen token remains useful.
• Monitoring for authentication from VPS and commercial VPN infrastructure. Watch for logins or token usage originating from Virtual Private Server IP ranges, commercial VPN providers, or other shared hosting infrastructure associated with this activity.
• Treating source code exposure as an active intrusion risk, not just a confidentiality issue. If you suspect a repository or developer credential has been compromised, assume vulnerability discovery and exploitation may already be underway.