A human operator used agents to raid code repos, seize cloud keys and hijack the victim's own AI infrastructure, Unit 42 reported.
By [RuntimeWire Staff](https://runtimewire.com/author/runtimewire-staff)
· Published
Primary source: [Semafor](https://www.semafor.com/article/09/16/2026/anatomy-of-an-ai-powered-hack)
Why it matters #
AI agents can compress routine intrusion work from days into hours, leaving defenders less time to react. The attack also shows that familiar controls - protected branches, strict credential handling and rapid revocation - can still stop machine-speed operations.
Palo Alto Networks, the cybersecurity vendor Nir Zuk founded in 2005, says a human attacker used AI agents to breach an unnamed European IT and software company in less than 10 hours during summer 2026. Palo Alto's Unit 42 incident responders estimated that the same operation would ordinarily require human hackers about two weeks.
The attacker reached the victim's software delivery systems, seized cloud credentials and turned the victim's own AI infrastructure into part of the operation. Unit 42 removed the intruder before the extortion attempt was fully successful, according to details reported by Semafor on September 16th.
The incident was disclosed more than a year after Zuk retired as Palo Alto's chief technology officer. Zuk spent two decades building Palo Alto around a platform approach to security, arguing that fragmented defenses left gaps between products. The summer attack followed those gaps across an exposed web service, internal repositories, a secrets manager, a CI/CD pipeline, cloud accounts and AI endpoints. Each successful step gave the agents material for the next one.
The breach ran through the software factory
The operation began with automated reconnaissance across the public internet. An agent located and exploited a publicly accessible web service, giving the attacker an initial route into the victim's network. Semafor described the entry point as a public API endpoint.
Once inside, another agent mapped internal services and identified the victim's code repositories and software deployment pipeline. Sub-agents searched the repositories for credentials that developers had embedded in source code, including passwords and access tokens.
Those credentials led into the victim's secrets-management system. The attacker then obtained administrative credentials, entered systems used to build and deploy software, and extracted cloud access keys. According to Unit 42's September 2nd technical account, the operation involved over 50 techniques mapped to the MITRE ATT&CK framework.
The agents triggered unauthorized CI/CD builds and attempted to insert backdoors into Terraform configurations. Branch-protection controls stopped those edits, one of the clearest pieces of evidence that established security practices still constrained the attack. Other controls failed because valid credentials let the attacker appear trusted after entering the network.
The stolen cloud keys also gave the attacker access to the victim's AI endpoints. That allowed the operation to use the victim's models and compute capacity while blending malicious activity into infrastructure the organization already expected to see. Security teams call the broader practice "living off the land": attackers use a victim's legitimate systems rather than bringing an easily recognized toolkit into the network.
The agents left behind an 80-page technical assessment of the victim's vulnerabilities. Unit 42 said it observed structured Markdown files moving information between agents and sessions, calls to multiple frontier models in parallel, and custom scripts that appeared to be AI-generated.
A human still directed the agents
Andy Piazza, Unit 42's senior director of threat intelligence, described the operation as a human-controlled sequence. The attacker assigned tasks, reviewed results and decided what the agents should do next. Piazza previously led about 50 threat researchers at IBM X-Force and has over 20 years of experience spanning security operations, threat intelligence and incident response.
The specific models remain unidentified. So do the attacker, victim, ransom amount and full scope of any data access. Palo Alto's comparison between a 10-hour AI-assisted operation and two weeks of human work is also Palo Alto's estimate; its published account does not provide a methodology for that calculation.
Those limits narrow the conclusion that can be drawn from one incident. The documented attack path still provides a concrete example of where agents change the economics of intrusion. Reconnaissance, credential searches and repeated attempts across several systems can run in parallel, with less idle time between each step.
The techniques themselves were familiar. The attacker exploited a public-facing service, found exposed secrets, abused valid accounts and moved into cloud infrastructure. AI compressed the intervals separating those actions. Piazza told Semafor that "the sky is not falling," while warning that defenders relying on slow investigations could lose the time they once had to contain an intruder.
Palo Alto also sells the answer
Palo Alto has a direct commercial interest in presenting AI-speed attacks as an urgent enterprise problem. On April 17th, it launched Unit 42 Frontier AI Defense, a consulting and security package designed to find attack paths, harden infrastructure and automate response before adversaries can chain weaknesses together.
That incentive does not erase the operational detail in Unit 42's account. It does make the controls that succeeded especially important. Mandatory branch protections blocked changes to infrastructure code. Unit 42 detected and removed the attacker before the extortion attempt achieved its full objective. Fast containment worked even after credentials had been stolen and several internal systems had been reached.
The defensive lesson is less exotic than the agent architecture. Developers left credentials inside code repositories. Access tokens opened paths into higher-value systems. Cloud AI endpoints became useful attacker infrastructure because stolen keys carried sufficient privileges. Fixing those weaknesses requires disciplined identity management, repository scanning, protected deployment pipelines and coordinated credential revocation.
Zuk's original platform thesis was that defenders needed security products to operate together rather than leave separate teams reconciling alerts after an intrusion. AI agents give attackers their own version of that coordination. The summer breach shows what happens when one operator can send several agents through an organization's existing seams at machine speed. It also shows that strong controls at any one of those seams can still break the chain.