# AI Agents Breached an Enterprise Network in 10 Hours > Source: > Published: 2026-09-09 14:12:08+00:00 A human attacker spent under 10 hours dismantling an enterprise’s cloud, identity, CI/CD, and SaaS defenses using nothing but frontier AI models and off-the-shelf agentic frameworks. No zero-day exploits. No elite tradecraft. Just delegation — the attacker assigned each phase of the intrusion to specialized AI agents and let them run. The Palo Alto Networks Unit 42 team documented the incident after being called in during ransom negotiations. The attacker had already sent the victim company an 80-page technical audit of their own security failures. That detail isn’t darkly funny. It’s the clearest signal yet that AI-speed attacks have arrived, and the controls most developer teams are running were never designed for this. ## What Happened, in Plain Terms The [Unit 42 report](https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/) describes an intrusion that compressed more than 50 MITRE ATT&CK techniques into a single automated loop. A skilled human red team executing the same attack chain would need roughly two weeks. The AI-assisted version took under 10 hours. The attack moved through five stages without meaningful friction: 1. An automated reconnaissance agent breached a publicly accessible API endpoint and mapped the internal microservices, passing structured notes between agents across sessions. 2. Sub-agents systematically scraped code repositories for hardcoded tokens, AWS keys, and service passwords — no targeted knowledge required, just bulk automated scanning. 3. The harvested tokens unlocked the secrets management system, yielding master administrative credentials and root-level access across the environment. 4. Custom CI/CD workflows were hijacked to exfiltrate cloud access keys. Agents then attempted to plant backdoors in Terraform configurations — and were blocked by branch protection rules. 5. Stolen cloud credentials were used to commandeer the victim’s own AI endpoints, repurposing their compute as post-compromise infrastructure. Unit 42’s assessment is unambiguous: “AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft.” The attacker didn’t need skills. They needed a prompt and an agentic framework. ## The One Control That Worked Branch protection rules on infrastructure-as-code repositories blocked the Terraform backdoor attempt. That’s it. That was the only pre-existing control the agents couldn’t route around. Security Boulevard’s [stage-by-stage breakdown](https://securityboulevard.com/2026/09/dissecting-attacks-is-only-valuable-if-it-informs-controls-what-the-unit-42-agentic-ai-investigation-should-change-in-your-control-set-stage-by-stage/) puts it bluntly: “Exactly one control stopped the adversary: immutable branch protection with mandatory multi-party review.” That’s useful information. It means the boring, foundational practices — mandatory code review on IaC changes, immutable branch rules — are not being made obsolete by AI attackers. They’re the ones that held. The sophisticated controls mostly didn’t. ## Four Things to Fix Before This Hits Your Stack The attack chain reveals exactly where the gaps are. These are the highest-priority items for any team managing cloud infrastructure. ### 1. Replace Long-Lived Cloud Keys with OIDC Workload Federation The CI/CD pivot worked because static, long-lived cloud access keys existed in the pipeline. [OIDC workload identity federation](https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect) eliminates this class of credential entirely — your CI/CD system gets a short-lived token scoped to the specific job, revoked when the job ends. GitHub Actions, GitLab, and CircleCI all support this. If you’re still using an AWS access key or GCP service account JSON file stored in CI/CD secrets, that’s the vulnerability the Unit 42 attacker’s agents found and used. ### 2. Scan Your Entire Git History, Not Just Current Code Secret scanning on current commits misses credentials that were committed, used, and “deleted” but remain in git history. Agents don’t care that you removed it in a later commit — they scan the full history. Tools like truffleHog and GitGuardian can audit your entire commit history. Run them now, not as part of a future security sprint. ### 3. Govern Your AI Endpoints Like Production Credentials Unit 42 specifically names Model Context Protocol gateways and AI API keys as attack surface. The victim’s own AI compute was repurposed as attacker infrastructure. Every AI endpoint your team uses — OpenAI, Anthropic, Vertex AI, self-hosted models — needs the same governance as any production service: inventory, least-privilege access, rate limits, spend caps, and anomaly detection on usage patterns. “Inventory every model endpoint, API key, MCP gateway and AI tool integration” is the Unit 42 recommendation. ### 4. Build Synchronized Containment, Not Sequential Response Traditional incident response is sequential: detect, alert, escalate, investigate, respond. That process takes hours. The attack took hours. Sequential response cannot catch an automated adversary. The analysis is direct: “A ten-hour intrusion defeats sequential human response by construction.” Automated playbooks must simultaneously revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines, and isolate cloud accounts — across all operational planes at once, without a human in the approval loop. ## The 80-Page Audit Is the Real Story After achieving its objectives, the attacker’s AI compiled an 80-page technical report documenting the security weaknesses it had discovered and exploited during the breach. This was sent to the victim as ransomware leverage: proof of comprehensive access, documented in detail. [The Register’s coverage](https://www.theregister.com/security/2026/09/02/ai-agents-carried-out-every-step-of-this-ransomware-attack-then-left-the-victim-an-80-page-security-audit/5294009) notes the document detailed “dozens of exploited findings.” Here is what that tells you: the attacker’s AI produced a more thorough security assessment of that environment than most organizations’ internal security teams have. Not because attackers are smarter, but because AI agents are thorough in a way that time-constrained humans aren’t. The same capability is available to defenders. AI-generated security audits of your own infrastructure are no longer a future consideration. ## This Is the New Baseline This incident is not exceptional. Sysdig documented an earlier end-to-end AI ransomware campaign where an LLM handled the full kill chain. Aurora ransomware operators used Cursor, an AI coding assistant, to plan and execute network intrusions. The Unit 42 case is notable for its scale and documentation — not for being anomalous. Agentic attack frameworks are available to the same people who access frontier AI models, which is to say: anyone. The speed advantage attackers gain from AI delegation will only compound as models improve. Your security controls need to assume machine-speed adversaries, not the two-week timelines that most threat models were designed around. Start with branch protection and OIDC federation. Run the git-history scan. Inventory your AI endpoints. Then build the automated containment playbook — not because this specific attack will hit you next, but because the next one will be faster.