A human ransomware operator used frontier AI models and attack-specific agentic frameworks to breach an enterprise network in less than 10 hours, compressing what Palo Alto Networks estimated would normally take human operators approximately two weeks1,2,7,8.
The incident, documented by Palo Alto Networks' Unit 42 threat research team, involved more than 50 techniques mapped to the MITRE ATT&CK framework3. The threat actor confirmed during ransom negotiations that frontier AI models and agentic AI frameworks had been used, and Unit 42 independently observed indicators consistent with AI use, including parallel large-language-model queries, structured Markdown files used to preserve context across agents and sessions, and custom automation scripts assessed with high confidence as AI-generated.
"This incident is one of the first few documented agentic breaches where an attacker successfully leveraged an agentic attack against an enterprise," said Andy Piazza, Senior Director of Threat Intelligence at Unit 42.
The campaign did not rely on a zero-day vulnerability or novel malware5. The attacker breached a publicly accessible API endpoint and deployed an automated reconnaissance agent to map internal microservices. Sub-agents then scraped enterprise source-code repositories for hard-coded tokens, service passwords, and API keys. Those exposed credentials enabled access to the organization's secrets-management system, where the attacker harvested master administrative credentials and obtained root-level system access.
Specialist pivot agents validated access across cloud, identity, CI/CD, container, and SaaS environments. The attacker hijacked an enterprise code application via custom workflows to exfiltrate cloud access keys and triggered unauthorized CI/CD builds. An attempt to plant backdoors in Terraform configurations was blocked by branch-protection controls.
Using stolen cloud credentials, the attacker repurposed the victim's own AI endpoints as post-compromise infrastructure, consuming compute resources while masking orchestration traffic among legitimate activity. The attacker also established overlapping persistence across SSH keys, serverless functions, container restart policies, cloud identities, and CI/CD pipelines.
After completing the intrusion, an AI agent left behind an 80-page technical assessment detailing dozens of security vulnerabilities identified during the operation.
Unit 42 advised organizations to treat AI environments as core enterprise infrastructure, inventorying every model endpoint, API key, Model Context Protocol gateway, and AI tool integration. The team recommended synchronized containment via automated playbooks that revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines, and isolate cloud accounts across all operational planes. Defenders should also hunt for operational loops, including bursty API requests, rapid shifts between failed and successful authentication, parallel logins, and unexpected model usage from unfamiliar identities.
The findings arrive as major AI vendors invest in cybersecurity-specific tooling. OpenAI committed $1 billion to extend its Daybreak cyber defense stack to critical infrastructure defenders[1], and Google released Gemini 3.8 Flash Cyber, a restricted cybersecurity model variant, on September 2[2]. Palo Alto Networks itself has worked with OpenAI through Daybreak and is collaborating with Anthropic on frontier AI security through its Frontier AI Defense initiative.
ANALYSIS The incident illustrates a practical asymmetry: the attacker's AI agents operated across multiple security layers simultaneously, while defenders relying on sequential human triage faced a compressed timeline that left little room for manual response. Unit 42's emphasis on automated, synchronized containment playbooks reflects the operational reality that human-speed incident response may be insufficient against agent-speed intrusions.