A threat actor used AI agents to compress what Palo Alto Networks estimated would normally require about two weeks of human work into an enterprise intrusion completed in less than 10 hours.
Palo Alto Networks’ Unit 42 said the incident involved more than 50 techniques mapped to the MITRE ATT&CK framework, but the methods themselves were not especially novel. The major change was how quickly AI agents could execute them, assess results and decide what to do next.
During ransom negotiations, the attacker claimed to have used frontier AI models and attack-specific agentic frameworks, Unit 42 said. Researchers also found several signs consistent with AI-assisted operations, including multiple AI agents running in parallel and structured files used to pass information between sessions.
The attack began with a breach of a publicly accessible web service, followed by automated mapping of the victim’s internal microservices. AI sub-agents then searched code repositories for hard-coded credentials and used stolen tokens to access the organization’s secrets-management system.
That access ultimately exposed administrative credentials and enabled the attacker to move deeper into the environment.
From code repositories to AI infrastructure
The attacker next abused CI/CD workflows to obtain cloud access keys. They also tried to modify Terraform configurations to establish backdoors, but branch-protection controls stopped those changes.
Stolen cloud credentials were then used to access the company’s AI services, effectively turning the victim’s own computing infrastructure into a resource for continued malicious activity.
Unit 42 described the attack as “AI-assisted operational efficiency” rather than a breakthrough in offensive hacking. “The attacker left tactical execution to AI agents that monitored, evaluated, acted and re-planned in real time, increasing speed throughout the attack chain,” the researchers said.
According to Unit 42, the attacker also directed an AI agent to produce an 80-page technical report documenting dozens of security findings exploited during the intrusion.
The bigger security problem
The incident does not prove that cyberattacks have become fully autonomous. As Sanchit Vir Gogia of Greyhound Research told CSO Online, “The evidence points to a human-directed intrusion in which AI orchestrated delegated tactical work.”
The immediate danger is not necessarily AI replacing attackers, but allowing one person to coordinate a volume of tactical work that previously required considerably more time and manpower.
“Enterprises do not necessarily need a new threat model, but they do need to operate on a new clock,” Sakshi Grover of IDC Asia Pacific Cybersecurity Services told CSO Online.
Security teams face a new race
The incident also shows why organizations cannot evaluate their defenses one system at a time. A compromised repository account, for example, can become a path to cloud privileges through trusted workflows.
“Each platform may have had controls, but the relationships between them created the exploitable path,” Grover said.
That makes rapid containment increasingly important. Security teams should use automated playbooks to revoke credentials, terminate sessions, halt CI/CD activity and isolate cloud resources across multiple environments. Organizations should also inventory their AI endpoints and API keys, enforce least-privilege access and protect infrastructure-as-code repositories against unauthorized changes.
Read more: The 2026 Verizon DBIR explains how AI, ransomware and attackers’ use of trusted infrastructure are reshaping enterprise breach risk.