← Back to feed

On September 2, Palo Alto Networks’ incident response team Unit 42 published details of a live breach it investigated where a human ransomware operator delegated the entire attack chain to AI agents running frontier models. The intrusion compressed what Unit 42 says would normally take two weeks of manual red-team tradecraft into less than 10 hours.

The attacker confirmed the methodology during ransom negotiations: “frontier AI models and attack-specific agentic AI frameworks.” Unit 42 declined to name which models or frameworks were used.

The Kill Chain

The 10-hour timeline broke down across five phases, each handled by a dedicated agent or subagent swarm:

1. Initial access — A human-directed agent breached a publicly exposed API endpoint and tunnelled into the network.

2. Internal recon — An automated reconnaissance agent mapped the target’s internal microservices, building a live topology the subsequent agents used for targeting.

3. Credential harvest — A fleet of subagents combed enterprise code repositories for hard-coded tokens and service passwords. Extracted credentials were escalated to the secrets management system to obtain admin-level access and root credentials.

4. Infrastructure takeover — Using the stolen cloud access keys, the attacker hijacked the victim’s CI/CD pipeline and triggered unauthorized builds. Separately, the agents converted the victim’s own AI infrastructure — its LLM endpoints — into post-compromise attacker infrastructure. Unit 42 labels this LLM hijacking.

5. Persistence attempt — Agents attempted to plant a backdoor in the organization’s Terraform configurations. This was the one step that failed: branch protection controls blocked the commit.

6. Report delivery — After completing its objectives, the agent left behind an 80-page technical audit documenting dozens of exploited vulnerabilities in detail.

What Made This Different

Unit 42’s core finding is about speed and scale, not novelty. “The techniques weren’t novel in themselves,” the report states. The attacker applied well-known MITRE ATT&CK techniques — more than 50 across the chain — at machine speed. Every step was monitored, evaluated, and re-planned in real time by agents that operated without human approval between decisions.

The comparison Unit 42 draws is explicit: the impact matched what a coordinated effort from multiple red teams would achieve, normally taking around two weeks. A single human operator with AI agents compressed that to one operational session.

The LLM hijacking step is worth noting separately. Gaining access to the victim’s own AI compute and using it as attack infrastructure is a new abuse vector that doesn’t require acquiring external resources. The victim’s own model endpoints become the attacker’s tool.

Branch protection on Terraform configurations stopped the persistence attempt. That one control held. Everything else in the chain succeeded.

Implications for Defenders

Unit 42 recommends automated containment playbooks capable of revoking credentials, terminating sessions, freezing CI/CD pipelines, and isolating cloud accounts across systems simultaneously — because agent-speed attacks cannot be contained by human-speed response.

The conventional security assumption is that intrusions give defenders time: reconnaissance takes days, lateral movement takes more. This incident erases that assumption. If an attacker can move from API breach to cloud infrastructure takeover in under 10 hours using off-the-shelf frontier models and no novel zero-days, the detection and response window is now measured in hours, not days.