Executive Summary
Mandiant's AI Risk and Resilience Report 2026 describes UNC6780 (TeamPCP) stealing AI service credentials and proprietary AI data and using prompt injection against AI coding assistants and LLM-based security scanners.
What Happened
Mandiant describes incidents involving UNC6780, also known as TeamPCP, including theft of AI service credentials and proprietary AI data. The report says the group used prompt injection against AI coding assistants and LLM-based security scanners, demonstrating risks to enterprise development and AI supply chains.
Vulnerability / Attack Technique
Prompt injection against coding assistants and AI scanners; AI credential theft
Technical Mechanism
The group targeted AI tools used in development and security workflows.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Threat groups now target AI development tooling directly. RealGround analysis: protect AI service credentials like cloud keys.
Recommended Controls
- Rotate and monitor AI service credentials
- Treat AI scanner input as untrusted
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
Google Cloud / Mandiant: https://cloud.google.com/security/resources/ai-risk-and-resilience-2026
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.