\n \n

\n\t\t\t

\n General \n

An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation

\n \n $\"Clock$ 4 min read \n

\n Related Products

$\"Unit$ Unit 42 Frontier AI Defense $\"Unit$ Unit 42 Incident Response

\n\t\t\t\t \n\t\t\t\t\t
By:
\n\t\t\t $\"Published$ \n\t\t\t
Published:September 2, 2026
Categories:
\n\t\t
Tags:
- Agentic AI
- Frontier AI
\n\t\t

$\"Download$
$\"Print$

\n \n\t

\n\tShare $\"Down$ \n

Unit 42 responded to an incident where a human attacker used frontier AI to breach an enterprise network autonomously as part of a ransom attack. The agents breached the company's security layers in a methodical manner, each targeting a different layer of defense to achieve a shared goal. The impact was at the scale of a coordinated effort from multiple red teams, which would normally take human operators around two weeks.

The threat actor told us in negotiations that they leveraged frontier AI models and attack-specific agentic AI frameworks. By shifting execution to an automated loop, the attacker compressed weeks of methodical intrusion tradecraft (using more than 50 MITRE ATT&CK techniques) into less than 10 hours.

After they gained initial access, the attacker used agents to map the internal architecture, raid source repositories and seize root credentials. The agents also triggered unauthorized continuous integration/continuous delivery (CI/CD) builds and claimed master keys to the victim's cloud AI infrastructure.

What made the attack stand out was AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft. The attacker left tactical execution to AI agents that monitored, evaluated, acted and re-planned in real time, increasing speed throughout the attack chain.

The attacker also directed the agent to leave behind a “report” on the organization’s security posture: an 80-page, technical audit detailing dozens of exploited findings.

Inside the Machine-Speed Attack Chain

The adversary ran their operation using current AI-enabled software development processes. We observed multiple indicators consistent with AI usage:

LLM calls to multiple frontier AI agents in parallel
Structured Markdown files passing information between agents and sessions
Custom scripts (assessed with high confidence to be AI-generated due to UI elements) managing dynamic operations

The 10-hour operational timeline included the following:

Infiltration and mapping: The actor breached a publicly accessible web service to tunnel into the network, deploying an automated recon agent to map internal microservices.
Secrets harvesting: Sub-agents combed enterprise code repositories, extracting hard-coded tokens and service passwords.
Privilege takeover: Using exposed tokens, the actor infiltrated the secrets management system, harvesting master administrative credentials to seize control of root system access.
Pipeline exploitation: The actor hijacked an enterprise code application via custom workflows to exfiltrate cloud access keys. They attempted to plant backdoors in Terraform configurations, but hard branch-protection controls stopped this.
AI infrastructure hijacking: Using stolen cloud keys, the actor turned the victim’s AI endpoints into post-compromise infrastructure — using the company’s compute power to perpetrate future moves.

Figure 1 maps the AI-orchestrated workflow.

\"\" — Figure 1. AI-orchestrated intrusion workflow. The actor sets objectives and makes consequential decisions. Specialized agents execute, share results and adapt in real time.

Unified Threat Framework Mapping

For illustration, Table 1 below maps some of the techniques used against the MITRE ATT&CK and ATLAS frameworks:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Intrusion Stage	Threat Actor Action	MITRE ATT&CK^® Mapping	MITRE ATLAS™ (AI-Specific) Mapping
Initial Access and Recon	Publicly accessible web service breach; automated service mapping via service discovery tool	T1190: Exploit Public-Facing Application \n T1046: Network Service Discovery	AML.T0000: Initial Access \n AML.T0002: AI-Automated Reconnaissance
Credential Access	Code scraping for secrets across code repos	T1552.001: Credentials In Files	AML.T0014: Credentials Harvesting
Privilege Escalation	Infiltrating secrets manager to harvest admin system secrets	T1555: Credentials from Password Stores	AML.T0016: Privilege Escalation via Automated Pivot
Pipeline Abuse	Executing CI/CD actions; attempting cloud provisioning tool edits	T1578: Modify Cloud Compute Infrastructure	AML.T0010: ML/DevOps Pipeline Interception
AI Infrastructure Abuse	Invoking cloud AI models via stolen keys	T1078: Valid Accounts	AML.T0043: LLM Invocations via Stolen API Keys

Table 1. Major MITRE ATT&CK and MITRE ATLAS techniques used by the attacker.

Key Lessons: Addressing Agentic Attacks

This incident exposes how an attacker who understands how to deploy frontier AI agents effectively can dramatically speed up the pace of their attack. We assess that attackers will increasingly add AI agents to their tool sets. Organizations should take note of the following to address agentic attacks:

AI agents reduce the time between steps in the attack flow: AI agents in this attack were designed to parse raw tool output and quickly take next steps, speeding up the overall attack flow.
AI agents leave recognizable indicators: Defenders can identify agentic attacks by watching for indicators such as the use of structured Markdown, Python caches and paired asset folders.
Attackers can use AI to establish redundant persistence across the environment: In this incident, the attacker used AI agents to efficiently establish overlapping persistence across SSH keys, serverless functions, container restart policies, cloud identities and CI/CD pipelines. Using AI agents can make it easier for an attacker to maintain and test this entire portfolio in parallel.
Attackers can use an organization’s AI tools as post-compromise infrastructure: Attackers can hijack enterprise AI services to assist in their attacks. This allows threat actors to hide orchestration traffic among expected traffic, and offload the financial cost onto the victim.

Defending Against Machine-Speed Attacks

Defending against automated agent loops requires matching the speed and adaptability of AI-driven attacks:

Execute synchronized containment: Deploy automated playbooks that simultaneously revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines and isolate cloud accounts across all operational planes.
Govern AI as core infrastructure: Inventory every model endpoint, API key, Model Context Protocol (MCP) gateway and AI tool integration. Apply strict rate limits, least-privilege policies and diagnostic logging.
Detect behavioral loops: Hunt for operational loops including bursty API requests, rapid 401/200 HTTP state shifts, parallel authentications and sudden model usage from unexpected identities.
Lock down DevOps pipelines: Enforce mandatory, multi-party code reviews and immutable branch protection on all infrastructure-as-code repos to block automated backdoor injection.

Learn more about how Unit 42 can help defend against AI-driven threats through Unit 42 Frontier AI Defense.

Updated Sept. 3, 2026, at 5:25 a.m. PT to clarify that the attack was an intrusion, and not a ransomware attack.

Updated Sept. 4, 2026, at 6:42 a.m. PT for minor clarifying copyedits.

\n \n

\n \n \n \n\t\t\t

\n\t\t\t\t

Related General Resources

\n $\"$ Insights August 28, 2026\n \n

Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety

\n \n

\n\t\t\t\t\tAI\n\t\t\t\t
\n\t\t\t\t\tJailbreak\n\t\t\t\t
\n\t\t\t\t\tLLM\n\t\t\t\t

\n \n Read now $\"Right$ \n \n

\n $\"$ Insights August 21, 2026\n \n

Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain

\n \n

\n\t\t\t\t\tChainDrop\n\t\t\t\t
\n\t\t\t\t\tNpm packages\n\t\t\t\t
\n\t\t\t\t\tSoftware supply-chain attack\n\t\t\t\t

\n \n Read now $\"Right$ \n \n

\n $\"$ High Profile Threats August 18, 2026\n \n

Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)

\n \n

\n\t\t\t\t\tCredential theft\n\t\t\t\t

\n \n Read now $\"Right$ \n \n

\n $\"$ Insights August 4, 2026\n \n

The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software

\n \n

\n\t\t\t\t\tAI\n\t\t\t\t
\n\t\t\t\t\tFrontier AI\n\t\t\t\t
\n\t\t\t\t\tVulnerability Exploitation\n\t\t\t\t

\n \n Read now $\"Right$ \n \n

\n $\"$ Insights July 2, 2026\n \n

How We Added WebAuthn to a Browser-Based RDP Client

\n \n

\n\t\t\t\t\tIDA Pro\n\t\t\t\t
\n\t\t\t\t\tMicrosoft\n\t\t\t\t
\n\t\t\t\t\tRDP\n\t\t\t\t

\n \n Read now $\"Right$ \n \n

\n $\"$ Insights June 12, 2026\n \n

Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered

\n \n

\n\t\t\t\t\tDigital forensics\n\t\t\t\t
\n\t\t\t\t\tMacOS\n\t\t\t\t

\n \n Read now $\"Right$ \n \n

\n $\"$ Insights June 8, 2026\n \n

When “Hi, This Is IT” Comes Through Microsoft Teams

\n \n

\n\t\t\t\t\tCloaked Ursa\n\t\t\t\t
\n\t\t\t\t\tIdentity\n\t\t\t\t
\n\t\t\t\t\tPhishing\n\t\t\t\t

\n \n Read now $\"Right$ \n \n

\n $\"$ Insights May 28, 2026\n \n

2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface

\n \n

\n\t\t\t\t\tFiddling Scorpius\n\t\t\t\t
\n\t\t\t\t\tFighting Ursa\n\t\t\t\t
\n\t\t\t\t\tMuddled Libra\n\t\t\t\t

\n \n Read now $\"Right$ \n \n

\n $\"$ Insights May 27, 2026\n \n

Out of the Crypt: The Evolving Cyber Extortion Economy

\n \n

\n\t\t\t\t\tBling Libra\n\t\t\t\t
\n\t\t\t\t\tExtortion\n\t\t\t\t
\n\t\t\t\t\tFrontier AI\n\t\t\t\t

\n \n Read now $\"Right$ \n \n

\n \n

\n \n \n\n

Industry News 3 September 2026 2 min read Resultsense via The Register

AI agents ran a whole ransomware attack in under 10 hours

Unit 42 says agents handled reconnaissance, credential theft and lateral movement in a breach that would normally take two weeks — then wrote the victim an audit.

cyber security agentic AI ransomwarethreat intelligence risk management

TL;DR

Palo Alto’s Unit 42 has documented an intrusion where a human criminal delegated the entire operation to AI agents, compromising an enterprise network in under ten hours — work its responders put at roughly a fortnight by hand. On the way out, an agent left an 80-page assessment of the victim’s security failings.

What the agents actually did

The chain reads like a competent penetration test executed at machine pace. Agents ran reconnaissance, then the intruder tunnelled in through an exposed API endpoint. Inside, an automated agent mapped the internal microservices while others combed source repositories for credentials that developers had left in the code. Those keys opened the organisation’s secrets store, which yielded master administrative access and root over the estate.

From there, what the report calls “specialist pivot agents” confirmed reach into cloud, identity, container, SaaS and build-pipeline environments. The attacker then subverted the CI/CD workflows to lift cloud keys and repurpose the victim’s own AI services as attack infrastructure — burning the target’s compute while orchestration traffic hid among legitimate activity.

Unit 42’s framing is the part worth quoting: what stood out was “AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft”. The attacker left tactical decisions to agents that “monitored, evaluated, acted and re-planned in real time”. No exotic vulnerability was required. Speed was the weapon.

What defenders are told to do

Palo Alto’s prescription is unsurprising from a vendor but not therefore wrong: match machine speed with automated response — playbooks that isolate cloud accounts, freeze the build pipelines, kill OAuth sessions and revoke credentials all at once, rather than one after another.

The second recommendation is the one UK firms can act on this week without buying anything. Treat AI as infrastructure: inventory the tool integrations first, then the MCP gateways, the keys issued against each API, and every endpoint a model can be reached on — then apply least privilege and rate limits. Organisations that cannot list these assets cannot defend them — and the shortfall is widespread, with 88% of UK executives believing unapproved AI is already running inside their business.

Looking forward

This is the incident the market has been pricing for. Insurers began rewriting cyber cover for agents that exceed instructions last week, and OpenAI has said its next model can find zero-days unaided. The uncomfortable detail here is that none of that capability was needed. Ordinary tradecraft, automated, was sufficient.

Share this article

Back to News

Industry News 28 Aug 2026

Scottish helideck body among victims of AI-assisted hacks

A ransomware crew talked Cursor's coding agent into hundreds of intrusion tasks by insisting the work was a simulation, with victims including a Scottish certification agency.

cyber security ransomware \n+1

Read article

Industry News 3 Sept 2026

OpenAI is building a shutdown switch before anyone mandates one

In a letter to Congress, OpenAI says engineers are building automated shutdown for its systems, weeks after an agent escaped a test and hit Hugging Face.

agentic AI cyber security

Read article

Industry News 27 Aug 2026

OpenAI staff spotted the agents and let the run continue

Internal teams saw the improvised message board twice before July's Hugging Face breach. Alabama has now subpoenaed OpenAI over its oversight of the incident.

agentic AI cyber security

Read article

View all News & Insights

An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation

Inside the Machine-Speed Attack Chain

Unified Threat Framework Mapping

Key Lessons: Addressing Agentic Attacks

Defending Against Machine-Speed Attacks

Tags

Table of Contents

Related Articles

Related General Resources

Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety

Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain

Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)

The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software

How We Added WebAuthn to a Browser-Based RDP Client

Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered

When “Hi, This Is IT” Comes Through Microsoft Teams

2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface

Out of the Crypt: The Evolving Cyber Extortion Economy

Peace of mind comes from staying ahead of threats. Subscribe today.

Default Heading

\nSearch\n

TL;DR

What the agents actually did

What defenders are told to do

Looking forward

Share this article

The Resultsense weekly briefing

\nRelated Articles\n

Scottish helideck body among victims of AI-assisted hacks

OpenAI is building a shutdown switch before anyone mandates one

OpenAI staff spotted the agents and let the run continue