Google Cloud warns attackers will turn from data theft to AI decision manipulation

Google Cloud's security chief Chris Betz has warned that in 2027, attackers are likely to stop stealing data directly and start manipulating the decisions that autonomous AI agents make on behalf of businesses. The warning sits at the centre of Google Cloud's Cloud CISC Perspectives forecast for 2027, published on 12 November 2026 and written by Betz, Chief Information Security Officer at Google Cloud.

"In 2027, there is a high risk that threat actors will shift from direct data theft toward decision manipulation, subtly poisoning data or compromising logic to prompt autonomous agents into making harmful business choices at scale," Betz said.

The stakes are straightforward. Companies are handing AI agents authority over contracts, inventory routing and capital allocation. If an attacker can quietly poison the data or the business logic those agents rely on, the damage happens inside the business process itself — no theft required, and possibly no alarm raised.

What does the forecast actually predict?

The report, developed with contributions from Google Cloud and Google security leaders including Karthik Narain, Ramya Chitrakar, Heather Adkins, Sandra Joyce and Charles Carmakal, maps several shifts in how attacks and defences will play out.

Google Cloud said AI agents are already being used at scale to find and fix vulnerabilities, cutting software release cycles from weeks or months down to hours or days. That speed works for defenders — and it will work for attackers too.

The forecast's core predictions include:

• Decision manipulation replaces data theft. Threat actors poison data or compromise business logic so autonomous systems make harmful choices on contracts, inventory routing or capital allocation.
• Software supply chains become a bigger target. Attackers are going after open-source software, external libraries and MCP tools that coding assistants can automatically pull into corporate codebases.
• Traditional patching dies out. Multi-stage attacks now unfold in seconds, which makes weekly vulnerability scans and month-long patch cycles too slow to matter.
• Security moves into the runtime. Automated defences will operate at machine speed, applying checks at the transaction layer across models, permissions, infrastructure and supply chains.

The through-line: the pace of attack has outrun the pace of human judgement, and security architecture has to catch up.

Why is patch management suddenly obsolete?

Timing is the mechanism here. A classic enterprise patch process runs on a weekly or monthly rhythm — scan, prioritise, test, deploy. Google Cloud said multi-stage attacks now compress into seconds, and adversaries exploit vulnerabilities before vendors even know about them.

The company cited one concrete figure: attackers are using multi-agent frameworks to carry out large-scale credential harvesting in less than six hours. That timeline erases the window in which a human analyst could notice something and intervene.

In response, Google Cloud expects security controls to shift further into software runtimes, with automated defences acting at machine speed. The forecast frames this as part of a broader move away from perimeter-based security toward systems that check transactions directly, across models, permissions, infrastructure and supply chains.

There's a silver lining for stretched security teams. Google Cloud said this approach could ease the burden on humans by moving them from alert handling to risk management. The trade-off is that organisations will need much tighter visibility into how autonomous systems act, and why.

How should companies govern AI agents?

The forecast's governance prescriptions are specific. Google Cloud argued that every AI agent should be treated as a first-class identity, with verifiable credentials and least-privilege access — the same discipline applied to human accounts, extended to software.

It also warned against betting on a single general-purpose agent for complex security work. Instead, Google Cloud recommended teams of specialised agents — hunter, decoder and responder agents — working with graduated autonomy under a central coordinator that can escalate issues to a human when needed.

The logic is plain. A narrow agent with a defined job is easier to monitor, audit and shut down than one large system doing everything.

Mandatory red-teaming before deployment is another recommendation. Google Cloud said adversarial testing of agentic systems should not be optional, because organisations without complete traceability will struggle to trust what their agents did — or to find where things went wrong.

What is agent sprawl?

The forecast names a new operational risk: agent sprawl, which it describes as a new form of shadow IT. Many enterprises, Google Cloud said, are rushing to deploy agentic systems without putting in place the controls needed to govern and defend them.

That's the organisational version of a familiar problem. Employees adopted cloud services faster than IT could track them; now business units are adopting agents faster than security teams can inventory them.

Google Cloud's answer is full observability over agent decisions. That means the ability to reconstruct:

• the inputs an agent received,
• its reasoning,
• the tool calls it made,
• and whether it complied with policy.

Without that record, the company argued, organisations cannot validate or debug autonomous systems — and cannot trust the actions those systems take.

Do defenders still have an edge?

Yes, according to the forecast, and for a structural reason. Google Cloud said defenders hold an advantage because they have access to internal context that attackers do not. The report cited identity privilege graphs, network architecture, code lineage and runtime data as sources that can help security teams spot dangerous permission combinations before anyone abuses them.

The bet is that context beats speed. Attackers may move faster than ever, but they're working blind against organisations that know their own terrain.

That advantage only pays off if defenders actually instrument it — mapping permissions, lineage and runtime behaviour before the agents go live, not after an incident forces the issue.

What happens next?

The forecast frames 2027 as the year this transition bites: machine-speed attacks, decision manipulation and ungoverned agent deployment all arriving together. For security leaders, the immediate homework is concrete — inventory every agent, give each one verifiable credentials and least-privilege access, red-team before deployment, and build the traceability to reconstruct what an agent did and why. The organisations that do this early, Google Cloud argued, will convert their internal-context advantage into a defence that operates at the same speed as the threat.