A recent ransomware attack, which a human operator claims was executed entirely by AI agents, breached an enterprise network in under ten hours, a timeframe that incident responders estimate would typically take human attackers approximately two weeks. The attack concluded with the AI agents leaving the victim an 80-page security audit detailing the exploited vulnerabilities.
Incident responders from Unit 42, a division of Palo Alto Networks, described the attack as notable for its AI-assisted operational efficiency, which did not rely on a novel zero-day exploit or advanced tradecraft. The attacker reportedly delegated tactical execution to AI agents that continuously monitored, evaluated, acted, and re-planned in real-time, accelerating the entire attack chain.
The initial phase of the attack involved AI agents performing reconnaissance. Access was then gained by breaching a public API endpoint, which allowed the attackers to tunnel into the enterprise network. Once inside, an automated reconnaissance agent was deployed to map internal microservices.
Further sub-agents subsequently scraped code repositories, successfully extracting hard-coded tokens and service passwords. These stolen credentials were then used by the AI intruders to access the organization's secret management system, ultimately leading to the theft of master administrative credentials and root system access.
Specialized "pivot agents" were then employed to validate access across various environments, including the company’s cloud, identity, CI/CD, container, and SaaS infrastructure. The attacker also hijacked CI/CD workflows to steal cloud access keys and repurposed the victim’s cloud AI services to serve as post-compromise infrastructure. This tactic allowed the attacker to consume the victim's compute resources while simultaneously concealing orchestration traffic within legitimate network activity.
Upon achieving the human operator's objectives, an agent generated an 80-page report for the victim, outlining the company's security deficiencies and detailing "dozens of exploited findings."
Unit 42 suggests that defending against such machine-speed attacks necessitates the use of AI agents by defenders. Their recommendations include deploying automated playbooks that can simultaneously revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines, and isolate cloud accounts across all operational planes.
Furthermore, the incident response team advises organizations to treat AI as core infrastructure. This involves maintaining a comprehensive inventory of every model endpoint, API key, Model Context Protocol (MCP) gateway, and AI tool integration. Implementing rate limits and least-privilege policies for these components is also crucial to mitigate the risk of unexpected and substantial token consumption bills.
