A human attacker armed with frontier artificial intelligence models breached an enterprise network and seized root credentials in under 10 hours, a timeline that would normally take human red teams roughly two weeks to complete, according to a new incident response report from Palo Alto Networks’ Unit 42.
The threat actor told Unit 42 investigators during ransom negotiations that they relied on frontier AI models paired with attack-specific agentic AI frameworks to automate the intrusion.
Rather than manually executing each stage of the attack, the operator directed AI agents to monitor, evaluate, act, and re-plan in real time, compressing more than 50 distinct MITRE ATT&CK techniques into a single automated loop.
Unit 42 noted that the attack did not rely on a zero-day exploit or unusually sophisticated tradecraft, but instead achieved its speed and scale purely through AI-assisted operational efficiency.
AI Agents Breach Company Network
Once the agents gained initial access by breaching a publicly accessible web service, they tunneled into the network and deployed an automated reconnaissance agent to map internal microservices.
From there, sub-agents combed through enterprise code repositories, harvesting hard-coded tokens and service passwords. The attacker then used those exposed tokens to infiltrate the organization’s secrets management system, extracting master administrative credentials that granted root-level access across the environment.
Source: Cybersecurity News