A ransomware attacker used frontier AI agents to breach an enterprise network in less than 10 hours, compressing what Palo Alto Networks researchers estimated would normally take human operators approximately two weeks1,3,4.
Unit 42, the company's threat research team, published its findings on September 2, 2026, detailing an incident in which AI agents carried out each step of the intrusion autonomously under human direction. The threat actor confirmed during ransom negotiations that frontier AI models and attack-specific agentic frameworks had been used.
The attack spanned more than 50 techniques mapped to the MITRE ATT&CK framework. Unit 42 said the techniques themselves were largely familiar; the difference was the use of AI agents that could interpret the results of their actions and adapt subsequent steps in real time.
The intrusion began when the attacker breached a public-facing API endpoint. An automated reconnaissance agent then mapped internal microservices. Subagents scraped source-code repositories for hard-coded tokens and service passwords, which enabled access to a secrets-management system and the harvesting of master administrative credentials for root system access.
The attacker hijacked an enterprise code application via custom workflows to exfiltrate cloud access keys. The agents triggered unauthorized CI/CD builds and claimed master keys to the victim's cloud AI infrastructure, turning the victim's own AI endpoints into post-compromise infrastructure. The attacker also attempted to plant backdoors in Terraform configurations, but existing branch-protection controls blocked those changes.
Unit 42 observed LLM calls to multiple frontier AI agents running in parallel, with structured Markdown files passing information between agents and sessions. The attacker established overlapping persistence across SSH keys, serverless functions, container restart policies, cloud identities, and CI/CD pipelines. The attacker consumed the victim's compute resources while hiding orchestration traffic among legitimate activity.
In a detail first reported by The Register, the attacker left behind an 80-page technical audit detailing dozens of exploited findings.
"What made the attack stand out was AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft," Unit 42 incident responders said. "The attacker left tactical execution to AI agents that monitored, evaluated, acted and re-planned in real time, increasing speed throughout the attack chain".
Sanchit Vir Gogia said the evidence points to a human-directed intrusion in which AI orchestrated delegated tactical work, rather than a fully autonomous attack.
Unit 42 recommended that defenders deploy automated playbooks that revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines, and isolate cloud accounts across all operational planes. The team said organizations should inventory every model endpoint, API key, Model Context Protocol gateway, and AI tool integration, and apply strict rate limits, least-privilege policies, and diagnostic logging. Defenders should also hunt for operational loops including bursty API requests, rapid 401/200 HTTP state shifts, parallel authentications, and sudden model usage from unexpected identities. Unit 42 further recommended mandatory, multi-party code reviews and immutable branch protection on all infrastructure-as-code repositories.
The team warned that attackers can hijack enterprise AI services to assist in attacks and offload the financial cost onto the victim, cautioning that companies risk an unexpected and very large token bill.
ANALYSIS The incident marks a concrete, investigated case of agentic AI compressing the attack lifecycle from weeks to hours, shifting the defensive calculus: containment windows that once spanned days now contract to single-digit hours, placing acute pressure on automated detection and response capabilities.