← Back to feed

The debate over whether AI-driven cyberattacks are theoretical or operational is over. Palo Alto Networks Unit 42 published empirical results on April 23, 2026, showing a purpose-built multi-agent system autonomously executing a full cloud intrusion chain — reconnaissance to data exfiltration — against a misconfigured Google Cloud Platform environment, with no novel exploits and minimal human oversight.

The system is called Zealot.

Architecture

Zealot runs a hierarchical supervisor-agent model built on LangGraph. A central supervisor receives a natural-language objective and dynamically routes to three specialist sub-agents:

• Infrastructure Agent — network reconnaissance, port scanning, cloud VPC enumeration
• Application Security Agent — web application exploitation and credential extraction
• Cloud Security Agent — IAM enumeration, service account abuse, cloud-native data access

Agents share attack state throughout the operation. The supervisor continuously assesses what has been compromised and what objectives remain — an awareness structure similar to how human red teams separate strategic planning from tactical execution.

What Zealot Did

Unit 42 deployed Zealot in an isolated GCP sandbox preconfigured with intentional misconfigurations. The only input was a broad natural-language objective. From there:

1. Infrastructure Agent scanned the network, discovered a peered VPC, identified a connected VM instance via Nmap
2. Application Security Agent probed the web service, identified a server-side request forgery (SSRF) vulnerability, and exploited it to access GCP’s Instance Metadata Service — extracting a service account access token
3. Cloud Security Agent used the stolen token to enumerate IAM permissions and identify a BigQuery dataset labelled “production”
4. When an Access Denied error blocked direct read, the agent created a new storage bucket, exported the BigQuery table into it, then granted itself the storage.objectAdmin role to complete exfiltration

The entire chain — from initial access to sensitive data in hand — ran at machine speed, with the agent making independent decisions at each blocked step without human instruction.

The Actual Threat Model

Zealot does not use zero-days. Every technique it applied — SSRF exploitation, metadata service credential theft, IAM privilege escalation, data exfiltration — is well-documented in cloud security literature. What AI provides is not novelty but compression: attack chains that previously required a skilled human operator working over hours or days now execute in minutes.

Unit 42 frames the key risk correctly: misconfigurations that seemed low-priority under human-paced attacks become critical when an AI agent can discover and chain them in seconds. The window between initial access and data loss is now shorter than most detection and response workflows.

The finding connects directly to Anthropic’s November 2025 disclosure that documented a state-sponsored espionage campaign in which AI performed 80-90% of operations autonomously. Zealot confirms those capabilities are not confined to nation-state tooling.

Limitations

Zealot is not fully autonomous. Unit 42’s own researchers noted that manual oversight was required at points to prevent the system from rabbit-holing on irrelevant paths. The more complex the environment, the more likely an agent is to pursue unproductive leads without guardrails.

The system also required a preconfigured set of misconfigurations. Against a hardened environment with minimal attack surface, the chain breaks. Complexity as a defence layer is eroding, but it has not collapsed entirely.

Implications

Security detection models trained on human attack patterns are structurally mismatched against agent-based operations. Zealot sequences API calls across GCP services in seconds — patterns that look nothing like a human operator working through an environment. SOC tooling built around human-paced lateral movement needs updating.

The relevant mitigations are not exotic. Audit cloud IAM for overly permissive service accounts, enforce least-privilege, restrict metadata service access at the network layer, and enable anomaly detection on sequential API enumeration. The attacks Zealot executes work because these basic controls are missing.

Unit 42 researchers Yahav Festinger and Chen Doytshman built Zealot to close the gap between conceptual AI threat models and empirical evidence. That gap is now closed.