AI Agents Cut a Two-Week Breach to 10 Hours: Then Handed Over an 80-Page Audit
Palo Alto Networks' Unit 42 says a human attacker used frontier models and agentic frameworks to breach an enterprise in under 10 hours. No zero-day required.
On this page
For years, the pitch for AI in security has been defensive: faster triage, automated response, fewer analysts burned out by alert fatigue. This week, Palo Alto Networks' Unit 42 published an incident response report showing the other side of that coin. A human attacker, armed with frontier AI models and attack-specific agentic frameworks, breached an enterprise network, harvested root credentials, and pivoted through its cloud infrastructure in under 10 hours, work the unit says would normally take a human red team roughly two weeks.
Related reading: Meta's Muse AI Handed Over Its Whole Filesystem After Light Prompting · A Google Gemini Model Broke Out of Testing and Hacked Three Companies.
The report, published September 2, is one of the clearest accounts yet of what "machine-speed" offense actually looks like in the wild.
The attack, step by step
What stands out is how ordinary the underlying weaknesses were. There was no novel zero-day and no rare tradecraft. Unit 42's own summary is blunt: the speed came from AI-assisted operational efficiency, not from elite hacking.
The intrusion unfolded in a now-familiar sequence, but at a pace humans rarely sustain:
- Initial access. The attacker breached a publicly accessible web service, then used it to tunnel into the enterprise network.
- Reconnaissance. An automated agent mapped internal microservices and discovered reachable services across the environment.
- Credential harvesting. Sub-agents combed enterprise source-code repositories for hard-coded tokens, service passwords, and secrets.
- Privilege escalation. Using the harvested tokens, the agents reached the organization's secrets-management platform and extracted master administrative credentials, gaining root-level system access.
- Lateral movement. "Specialist pivot agents" validated access across cloud, identity, CI/CD, container, and SaaS environments.
- Infrastructure hijack. The attacker abused custom workflows in an enterprise code application to exfiltrate cloud access keys and tried to plant backdoors in Terraform configurations. Branch-protection controls blocked the infrastructure-as-code tampering, one of the few things that worked.
- Repurposing the victim. Using the stolen cloud keys, the attacker invoked the victim's own AI endpoints, turning the company's compute into post-compromise infrastructure.
That last step deserves a second look. By running their orchestration through the victim's legitimate AI services, the attackers could blend malicious activity into normal-looking model traffic while shifting the compute bill to the organization they had just robbed.
The tell: more than 50 ATT&CK techniques in one loop
Unit 42 counted more than 50 distinct MITRE ATT&CK techniques compressed into a single automated loop. The methods were mostly well known. The difference was that agents monitored tool output, evaluated options, acted, and re-planned in real time, without waiting on a human to read a screen.
How they knew it was AI
Attribution is always slippery, but Unit 42 flagged several indicators consistent with agentic operations:
- Parallel calls to multiple large language models.
- Structured Markdown files used to pass context between agents and sessions.
- Custom automation scripts that carried hallmarks of AI-generated code.
The human operator stayed in charge of objectives and consequential decisions. The agents did the reconnaissance, credential collection, privilege escalation, and persistence.
The part that reads like satire
After achieving its goals, the attacker had the agents compile an 80-page technical report documenting the victim's security posture and "dozens of exploited findings", an automated penetration-testing report, delivered by the intruder.
It is tempting to treat this as a flex. But it is also a signal about how cheaply offensive capability can now be productized. The same automation that produces a professional-grade audit for a customer can produce one for a victim.
What defenders should do
Unit 42's recommendations are less about exotic AI defenses and more about basic operational tempo, because the attacker's advantage is speed, and the only answer to speed is automation.
Automated containment playbooks should, in parallel:
• revoke credentials
• terminate OAuth sessions
• freeze CI/CD pipelines
• isolate cloud accounts
Treat AI as core infrastructure:
• inventory every model endpoint, API key and MCP gateway
• enforce rate limits and least-privilege policies
• make credentials short-lived
The uncomfortable conclusion
The report's authors argue that the only way to defend at machine speed is to fight at machine speed, with AI agents doing the containment. That is a significant admission: the defensive tool and the offensive tool are, increasingly, the same technology pointed in opposite directions.
The broader lesson is familiar but newly urgent. Repositories, CI/CD pipelines, infrastructure-as-code, and secrets management are all part of the attack surface now. The agents did not discover a new class of vulnerability this week. They simply walked through the old ones faster than any human team could respond.
Tags
TPW Editorial
Editorial Team
TechPastWeek's editorial team reports and edits every story we publish. We research each piece against primary and credible secondary sources, and a human editor reviews and signs off before it goes live.
