One attacker used AI agents to cross an enterprise network and seize root credentials in less than 10 hours. A Palo Alto Networks Unit 42 incident response report says the same work would normally take coordinated human red teams about two weeks.
The operation moved through more than 50 MITRE ATT&CK techniques. It reached source repositories, a secrets manager, CI/CD workflows and cloud AI infrastructure. Unit 42 described a real ransom intrusion involving one anonymized company, rather than a lab exercise or evidence of a widespread campaign.
Ten Hours Crossed Six Layers
Initial access came through a public-facing web service. An automated reconnaissance agent then mapped internal microservices while other agents searched code repositories for hard-coded tokens and service passwords.
Those credentials opened the next layer. The attacker entered the organization’s secrets manager, extracted master administrative credentials and gained root-level system access. Custom CI/CD workflows exfiltrated cloud access keys. Stolen keys also let the actor invoke the victim’s AI endpoints, hiding orchestration among expected traffic while shifting compute costs to the victim.
The actor attempted to place backdoors in Terraform configurations. Hard branch-protection controls stopped that step. The counterexample matters because this was not an unstoppable autonomous system: a conventional preventive control interrupted one consequential action even after the wider intrusion had advanced.
Long description
The diagram begins with a public-facing web service and splits into reconnaissance and repository-secret harvesting. Both paths feed access to the secrets manager, where master administrative credentials lead to root access. A parallel branch shows CI/CD workflow abuse exfiltrating cloud keys, followed by use of the victim's cloud AI infrastructure. A blocked branch at the CI/CD stage records the attempted Terraform backdoor stopped by branch protection.Agents Accelerated Familiar Tradecraft
Unit 42’s conclusion is direct: “What made the attack stand out was AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft.” The actor remained responsible for objectives and consequential decisions. Agents handled tactical execution, shared results and changed course as new information arrived.
Unit 42 attributed the use of frontier models and attack-specific agentic frameworks to what the attacker said during ransom negotiations. Investigators also found independent signs consistent with that account: parallel calls to multiple models, structured handoff material between sessions and custom scripts whose interface elements were assessed with high confidence as AI-generated.
The most vivid artifact was prepared after the compromise. The attacker directed an agent to leave an 80-page technical audit cataloging dozens of weaknesses in the victim’s environment. That document turned automated reconnaissance into leverage for the ransom demand.
The report does not name the victim, the exploited public service, the models or the agent framework. It also does not establish how often attackers are using this pattern. Palo Alto Networks is evaluating an incident handled by its own Unit 42 team and promotes a related commercial defense service, which readers should account for when weighing its forward-looking assessment.
Recognition Lives in Operational Tempo
The useful hunting signal is coordination speed across systems. On disk, Unit 42 points to structured Markdown files, Python caches and paired asset folders as traces that agents may use to preserve state and pass work between sessions. These artifacts need local context because development tools and legitimate automation can create similar material.
In identity, web and model telemetry, hunt for bursty API requests, rapid 401/200 HTTP state shifts, parallel authentications and unexpected model usage. Correlation gives the observations weight. A failed request followed almost immediately by successful access, repository reads, secrets-manager activity and a new CI/CD workflow is more useful than any one event in isolation.
Preserve the timing and identity relationships. The incident’s distinguishing feature was a loop that could evaluate output and act again immediately, so a slow sequence assembled from separate daily alerts can hide its shape.
Containment Spans Every Compromised Surface
Containment must move in parallel.
Unit 42 recommends synchronized containment across credentials, OAuth sessions, CI/CD and cloud accounts. Inventory model endpoints, API keys, Model Context Protocol gateways and AI tool integrations, then connect that inventory to the identities and repositories allowed to reach them. Enforce least privilege, rate limits, diagnostic logging and multi-party review for infrastructure-as-code changes. Immutable branch protection already blocked one backdoor attempt in this incident.
Response teams should revoke exposed credentials and active sessions together, freeze affected pipelines, isolate cloud accounts and inspect every persistence surface the actor reached. The source names SSH keys, serverless functions, container restart policies, cloud identities and CI/CD pipelines. A rotation limited to the first stolen token leaves the actor’s parallel footholds intact.
Unit 42 does not publish a complete recovery test or expected clean-state result for this anonymized incident. Teams will need to define that result from their own identity, repository, build and cloud logs, with the observed 10-hour window as the minimum correlation span. Machine-speed execution raises the cost of fragmented response: containment has to move across the same systems the agents crossed.