{"slug": "palo-alto-says-ai-agents-breached-a-software-company-in-under-10-hours", "title": "Palo Alto says AI agents breached a software company in under 10 hours", "summary": "Palo Alto Networks' Unit 42 reported that a human attacker used AI agents to breach an unnamed European IT and software company in under 10 hours during summer 2026, an operation Unit 42 estimated would ordinarily take human hackers about two weeks. The attacker exploited a public API endpoint, harvested credentials embedded in source code, seized cloud access keys and used the victim's own AI endpoints and compute, employing over 50 techniques mapped to the MITRE ATT&CK framework before Unit 42 removed the intruder prior to a fully successful extortion attempt. Branch-protection controls blocked unauthorized CI/CD builds and attempted backdoors in Terraform configurations, while valid credentials let the attacker appear trusted inside the network.", "body_md": "# Palo Alto says AI agents breached a software company in under 10 hours\n\n**A human operator used agents to raid code repos, seize cloud keys and hijack the victim's own AI infrastructure, Unit 42 reported.**\n\n        By [RuntimeWire Staff](https://runtimewire.com/author/runtimewire-staff)\n        · Published \n\nPrimary source: [Semafor](https://www.semafor.com/article/09/16/2026/anatomy-of-an-ai-powered-hack)\n\n## Why it matters\n\nAI agents can compress routine intrusion work from days into hours, leaving defenders less time to react. The attack also shows that familiar controls - protected branches, strict credential handling and rapid revocation - can still stop machine-speed operations.\n\n[Palo Alto Networks](https://www.paloaltonetworks.com/?ref=runtimewire), the cybersecurity vendor [Nir Zuk founded in 2005](https://www.paloaltonetworks.com/company/press/2025/palo-alto-networks-announces-retirement-of-nir-zuk--founder-and-cto?ref=runtimewire), says a human attacker used AI agents to breach an unnamed European IT and software company in less than 10 hours during summer 2026. Palo Alto's Unit 42 incident responders estimated that the same operation would ordinarily require human hackers about two weeks.\n\nThe attacker reached the victim's software delivery systems, seized cloud credentials and turned the victim's own AI infrastructure into part of the operation. Unit 42 removed the intruder before the extortion attempt was fully successful, according to [details reported by Semafor on September 16th](https://www.semafor.com/article/09/16/2026/anatomy-of-an-ai-powered-hack?ref=runtimewire).\n\nThe incident was disclosed more than a year after Zuk retired as Palo Alto's chief technology officer. Zuk spent two decades building Palo Alto around a platform approach to security, arguing that fragmented defenses left gaps between products. The summer attack followed those gaps across an exposed web service, internal repositories, a secrets manager, a CI/CD pipeline, cloud accounts and AI endpoints. Each successful step gave the agents material for the next one.\n\n### The breach ran through the software factory\n\nThe operation began with automated reconnaissance across the public internet. An agent located and exploited a publicly accessible web service, giving the attacker an initial route into the victim's network. Semafor described the entry point as a public API endpoint.\n\nOnce inside, another agent mapped internal services and identified the victim's code repositories and software deployment pipeline. Sub-agents searched the repositories for credentials that developers had embedded in source code, including passwords and access tokens.\n\nThose credentials led into the victim's secrets-management system. The attacker then obtained administrative credentials, entered systems used to build and deploy software, and extracted cloud access keys. According to [Unit 42's September 2nd technical account](https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/?ref=runtimewire), the operation involved over 50 techniques mapped to the MITRE ATT&CK framework.\n\nThe agents triggered unauthorized CI/CD builds and attempted to insert backdoors into Terraform configurations. Branch-protection controls stopped those edits, one of the clearest pieces of evidence that established security practices still constrained the attack. Other controls failed because valid credentials let the attacker appear trusted after entering the network.\n\nThe stolen cloud keys also gave the attacker access to the victim's AI endpoints. That allowed the operation to use the victim's models and compute capacity while blending malicious activity into infrastructure the organization already expected to see. Security teams call the broader practice \"living off the land\": attackers use a victim's legitimate systems rather than bringing an easily recognized toolkit into the network.\n\nThe agents left behind an 80-page technical assessment of the victim's vulnerabilities. Unit 42 said it observed structured Markdown files moving information between agents and sessions, calls to multiple frontier models in parallel, and custom scripts that appeared to be AI-generated.\n\n### A human still directed the agents\n\n[Andy Piazza](https://unit42.paloaltonetworks.com/ko/author/andy-piazza/?ref=runtimewire), Unit 42's senior director of threat intelligence, described the operation as a human-controlled sequence. The attacker assigned tasks, reviewed results and decided what the agents should do next. Piazza previously led about 50 threat researchers at IBM X-Force and has over 20 years of experience spanning security operations, threat intelligence and incident response.\n\nThe specific models remain unidentified. So do the attacker, victim, ransom amount and full scope of any data access. Palo Alto's comparison between a 10-hour AI-assisted operation and two weeks of human work is also Palo Alto's estimate; its published account does not provide a methodology for that calculation.\n\nThose limits narrow the conclusion that can be drawn from one incident. The documented attack path still provides a concrete example of where agents change the economics of intrusion. Reconnaissance, credential searches and repeated attempts across several systems can run in parallel, with less idle time between each step.\n\nThe techniques themselves were familiar. The attacker exploited a public-facing service, found exposed secrets, abused valid accounts and moved into cloud infrastructure. AI compressed the intervals separating those actions. Piazza told Semafor that \"the sky is not falling,\" while warning that defenders relying on slow investigations could lose the time they once had to contain an intruder.\n\n### Palo Alto also sells the answer\n\nPalo Alto has a direct commercial interest in presenting AI-speed attacks as an urgent enterprise problem. On April 17th, it [launched Unit 42 Frontier AI Defense](https://www.paloaltonetworks.com/blog/2026/04/introducing-unit-42-frontier-ai-defense/?ref=runtimewire), a consulting and security package designed to find attack paths, harden infrastructure and automate response before adversaries can chain weaknesses together.\n\nThat incentive does not erase the operational detail in Unit 42's account. It does make the controls that succeeded especially important. Mandatory branch protections blocked changes to infrastructure code. Unit 42 detected and removed the attacker before the extortion attempt achieved its full objective. Fast containment worked even after credentials had been stolen and several internal systems had been reached.\n\nThe defensive lesson is less exotic than the agent architecture. Developers left credentials inside code repositories. Access tokens opened paths into higher-value systems. Cloud AI endpoints became useful attacker infrastructure because stolen keys carried sufficient privileges. Fixing those weaknesses requires disciplined identity management, repository scanning, protected deployment pipelines and coordinated credential revocation.\n\nZuk's original platform thesis was that defenders needed security products to operate together rather than leave separate teams reconciling alerts after an intrusion. AI agents give attackers their own version of that coordination. The summer breach shows what happens when one operator can send several agents through an organization's existing seams at machine speed. It also shows that strong controls at any one of those seams can still break the chain.", "url": "https://wpnews.pro/news/palo-alto-says-ai-agents-breached-a-software-company-in-under-10-hours", "canonical_source": "https://runtimewire.com/article/palo-alto-ai-agents-breached-software-company-10-hours", "published_at": "2026-09-16 16:18:34+00:00", "updated_at": "2026-09-16 16:44:47.421100+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-policy"], "entities": ["Palo Alto Networks", "Unit 42", "Nir Zuk", "Semafor", "MITRE ATT&CK", "Terraform"], "alternates": {"html": "https://wpnews.pro/news/palo-alto-says-ai-agents-breached-a-software-company-in-under-10-hours", "markdown": "https://wpnews.pro/news/palo-alto-says-ai-agents-breached-a-software-company-in-under-10-hours.md", "text": "https://wpnews.pro/news/palo-alto-says-ai-agents-breached-a-software-company-in-under-10-hours.txt", "jsonld": "https://wpnews.pro/news/palo-alto-says-ai-agents-breached-a-software-company-in-under-10-hours.jsonld"}}