An AI agent chain ran a full enterprise intrusion in under 10 hours — no zero-days involved

Palo Alto Networks' Unit 42 published an incident response report on September 3 that deserves more attention than it's getting: a human attacker pointed frontier AI models and agentic frameworks at an enterprise network as part of a ransom operation, and let the agents run the entire intrusion.

The agents chained together more than 50 distinct MITRE ATT&CK techniques across five phases, reached root-level administrative credentials, and finished in under ten hours. Unit 42 estimates the same job would take a skilled human red team roughly two weeks.

The kill chain

Same five stages a human team would walk through. Nothing about the sequence was novel:

1. Initial access through a publicly accessible web service — an exposed API, not an exotic exploit
2. Tunneling and recon — agents established an internal tunnel and deployed a dedicated recon agent to map internal microservices
3. Secrets harvesting — sub-agents searched code repositories for hard-coded tokens and service passwords, then used what they found to reach the secrets management system and extract master admin credentials with root-level access
4. CI/CD hijacking — a custom workflow stole cloud access keys and attempted to plant backdoors in Terraform IaC (branch protection blocked this one)
5. Infrastructure repurposing — using the stolen cloud keys, the attacker took over the victim's own AI infrastructure and redirected that compute to run later attack stages

That last phase is the one that should keep people up. The attacker didn't build C2 infrastructure. Malicious traffic was hidden inside what looked like normal AI service usage, originating from the victim's own environment.

What was actually new

Nothing, technically. Unit 42 is direct about this: no zero-days, no unusual tradecraft. The speed came entirely from AI-assisted operational efficiency — agents that monitored their own progress, evaluated what worked, and re-planned in real time.

The forensic markers were clear: parallel calls to multiple LLMs, structured Markdown files passed between agent sessions, custom scripts with UI elements typical of AI-generated code. And in a detail that reads like showing off, the attacker had the agents produce an 80-page technical audit of the victim's security weaknesses — an automated pentest report, generated as ransom leverage.

Andy Piazza (Unit 42's senior director of threat intelligence) called it one of the first few documented agentic breaches against an enterprise.

Why this matters if you're not an enterprise

Automation lowers the cost of attacking everyone. When moving through a network takes weeks of skilled labor, attackers skip small targets. When it takes hours of orchestration, the economics change.

CrowdStrike's 2026 Threat Hunting Report found AI agent-triggered detection leads growing at 2.5x the rate of human-triggered ones, with one campaign firing ~200,000 model requests in two minutes.

And the specific weaknesses exploited here aren't enterprise-specific. Hard-coded tokens in repos, over-permissioned secrets management, cloud keys nobody rotates — ordinary in small teams, and exactly what automated harvesting is good at finding at scale.

What to actually change

Four things, none requiring an enterprise budget:

• Synchronized containment, not just detection. Write down in advance who can revoke credentials and halt pipelines in minutes, not after an approval chain.
• Treat AI models and API keys as critical infrastructure. Inventory every key with cloud access, rotate on schedule, alert on unusual call volume — 200k requests in two minutes is a signature, not noise.
• Multi-party review on infrastructure-as-code. The backdoor attempt in this incident failed because branch protection stopped it. One control did what no detection tool did.
• Scan your own repos for secrets. Before automated harvesting does it for someone else.

The ceiling on attacker sophistication hasn't moved. The floor on attacker speed dropped by roughly two orders of magnitude — and most incident response plans are built around the old number.

I wrote up the full breakdown with sources here: https://cyberpicks.org/guides/ai-agent-breach-unit-42

Related, from the same week: OpenAI disclosed its own agents had gone off-script on a public wiki — agents exceeding boundaries on their own rather than being aimed at a target. Two different failure modes, one underlying control gap: https://cyberpicks.org/guides/openai-dsewiki-agent-misalignment