Unit 42 says AI agents compressed a two-week enterprise intrusion into under 10 hours
The attackers exploited ordinary weaknesses at machine speed, which is why credential hygiene and pipeline controls now matter more than exotic exploits.
Researchers at Palo Alto Networks' Unit 42 have described an incident in which a human attacker directed frontier AI agents to break into an enterprise network and complete, in under ten hours, work that the team estimates would normally take human operators about two weeks. The investigation was published on 2 September and reported by Dark Reading, which characterised the operation as a machine-speed ransomware attack.
According to the report, the intrusion began with a publicly exposed API endpoint. The attacker tunnelled inside and launched an automated reconnaissance agent to map internal microservices. Sub-agents then searched the organisation's code repositories for hard-coded tokens and service passwords. Those tokens opened the secrets management system, where the attacker obtained master administrative credentials and root access. The attacker went on to take control of an enterprise code application, used custom CI/CD workflows to exfiltrate cloud access keys, and attempted to plant a backdoor in Terraform configurations, an effort that branch protection blocked. With the stolen cloud keys, the victim's own AI endpoints were turned into infrastructure for further activity. Unit 42 counted more than 50 MITRE ATT&CK techniques across the operation.
Evidence of AI involvement included calls to several frontier models running in parallel, structured markdown files passed between agent sessions, and AI-generated scripts that handled dynamic tasks. The attacker also instructed the agents to leave behind an 80-page technical audit of the victim's security posture.
Rickard Carlsson, chief executive of Detectify, told Dark Reading that the notable shift was orchestration: specialised agents working in parallel and sharing findings while a human set the objectives. He observed that the weaknesses exploited were ordinary ones and that the intelligence lay in coordination rather than in any new class of vulnerability. Unit 42 advised defenders to hunt for operational loops such as bursty API requests, rapid 401/200 response shifts, parallel authentications and unexpected model usage.
Why it matters
The incident shows that the cost of a broad, multi-stage intrusion is falling even without new exploits, because coordination is now automatable. Defensive timelines built around human attackers, where a response measured in hours seemed adequate, are being reset by adversaries who plan and re-plan in minutes. It also signals that development infrastructure, including repositories, pipelines and secrets stores, has become primary attack surface rather than a supporting concern. Detection strategies will need to recognise machine-like behaviour patterns as much as known malicious tools.
The incident shows that the cost of a broad, multi-stage intrusion is falling even without new exploits, because coordination is now automatable.
Exposed API endpoint
Attacker tunnels in through a public web service and launches a reconnaissance agent to map internal microservices
Secrets in code repositories
Sub-agents search source code for hard-coded tokens and service passwords
Secrets manager to root
Stolen tokens open the secrets management system, yielding master administrative credentials
CI/CD pipeline hijack
Custom workflows exfiltrate cloud keys; a Terraform backdoor attempt is blocked by branch protection
Victim AI endpoints repurposed
Cloud keys let the attacker use the company's own model endpoints as post-compromise infrastructure
What you can learn from this
Hard-coded secrets turn source code into a credential store. Developers sometimes paste API tokens, database passwords or cloud keys directly into code or config files, and those strings persist in Git history even after they are removed from the current version. An attacker who can read a repository can therefore search years of commits for patterns that look like keys. This is why secret scanning runs on every push, and why any secret that has ever been committed must be treated as compromised and rotated.
Secrets managers are only as safe as the identities that can call them. A secrets management system centralises credentials and hands them out to authenticated callers, which is good for hygiene but creates a single high-value target. If a low-privilege service token is allowed to read a master administrative credential, the manager's own access policy has collapsed the separation it was meant to enforce. Least privilege in the policy layer, short token lifetimes and audit logging of every read are what keep a manager from becoming a one-stop shop.
CI/CD pipelines execute code with production-level trust. A pipeline runner typically holds cloud credentials so that it can deploy, which means anyone who can define a workflow can run arbitrary commands with those credentials. Modifying workflow files or infrastructure-as-code such as Terraform is an attractive way to steal keys or install persistence, because the change looks like ordinary engineering activity. Branch protection and required reviews worked in this case precisely because they force a second human into the loop before the runner executes new instructions.
Agent orchestration is a workflow, and workflows leave fingerprints. When several models run in parallel and coordinate through shared files, their combined activity produces traffic that humans rarely generate: hundreds of requests in tight bursts, rapid alternation between failed and successful authentications, and many sessions starting at once. Detection engineering can key on the shape and tempo of activity rather than on specific tools. That is the reasoning behind Unit 42's advice to hunt for loops rather than signatures.
Hosted AI endpoints are compute that can be repurposed. An organisation's inference endpoints accept prompts, run models and often have generous quotas and outbound network access. If an attacker holds the cloud keys that authorise calls to those endpoints, they can use them for their own planning and generation, and the bill and logs land on the victim. Rate limits, per-identity quotas and logging of model usage exist so that abnormal consumption by an unexpected identity stands out quickly.
We teach this
How to use this in practice
Scan your repositories' full history for secrets. Install gitleaks and run
gitleaks detect --source . --log-opts="--all"in each project you maintain, including personal ones, because the flag makes it walk every commit rather than only the current tree. Done means a report with zero unresolved findings, and any real token it surfaces has been revoked and reissued, not merely deleted from the latest commit. Run it again on a schedule so new commits are checked automatically.Inventory every AI endpoint and API key you control. List each hosted model endpoint, local model server and vendor API key in one file, with the identity that can call it, its rate limit and where usage is logged. Done is a table where no row has a blank owner, and any key without a rate limit has one set through the provider console before the week is out. Delete any key that still has no identifiable owner after a week of asking, because an unowned key is the one nobody will notice being abused.
Turn on branch protection with required reviews for infrastructure code. In your Git hosting settings, protect the main branch of any repository containing Terraform, Kubernetes manifests or CI workflow files, requiring at least one approving review and blocking force pushes. Done means a test pull request from your own account cannot merge until a second account approves it, which is exactly the control that stopped the Terraform backdoor in this case. Repeat for any repository that holds deployment secrets or workflow definitions.
Draw the credential chain of one system you run. Sketch a diagram from an exposed entry point through each token, service account and secret that could be reached from it, ending at the most privileged credential in the environment. Done is a one-page drawing where every arrow is labelled with the control that would stop it, and any arrow without a label becomes this month's fix. Redraw it once a quarter, since credential chains change every time a service is added.
Sources
- AI 'Machine Speed' Cuts 2-Week Attack Down to 10 Hours — Dark Reading
- An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation — Palo Alto Networks Unit 42
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report