The attacker left a report behind. Eighty pages, technical, detailing dozens of exploited findings across the victim's network, produced on the attacker's instruction by the AI agents that had just spent under 10 hours taking the place apart. Palo Alto Networks' Unit 42 responded to the incident and published its account on September 2, 2026.
It was a ransomware attack, and by Unit 42's assessment there was nothing exotic in it. No zero-day. No elite tradecraft. What made it stand out was AI-assisted operational efficiency: a human attacker set the objectives and made the consequential decisions, while frontier AI models running inside attack-specific agentic frameworks did the tactical work, monitoring, evaluating, acting and re-planning in real time. The attacker confirmed as much to Unit 42 during ransom negotiations.
Unit 42 puts the compression plainly. The agents used more than 50 MITRE ATT&CK techniques and produced impact "at the scale of a coordinated effort from multiple red teams, which would normally take human operators around two weeks". It took less than 10 hours.
Ten hours, five moves
The timeline Unit 42 reconstructed runs like this. The actor breached a public API endpoint to tunnel into the network, then deployed an automated reconnaissance agent to map internal microservices. Sub-agents combed enterprise code repositories for hard-coded tokens and service passwords. Those tokens got them into the secrets management system, where they harvested master administrative credentials and seized root system access.
From there the agents hijacked an enterprise code application through custom workflows and exfiltrated cloud access keys. They also tried to plant backdoors in Terraform configuration, the code that defines cloud infrastructure, and failed: hard branch-protection controls stopped it. That is the one point in the whole timeline where a preventive control held.
The victim's own AI became the attack platform
The last stage is the one worth sitting with. Using the stolen cloud keys, the attacker turned the victim's AI endpoints into post-compromise infrastructure, running the rest of the operation on the company's own compute. Unit 42 spells out why that is attractive beyond the obvious: orchestration traffic to a company's own AI services blends into traffic that is expected there, and the bill lands on the victim.
Agents are noisy in ways humans are not
Defenders are not without signal. Unit 42 observed LLM calls going out to multiple frontier AI agents in parallel, structured Markdown files passing information between agents and sessions, and custom scripts assessed with high confidence to be AI-generated because of their UI elements. On disk, the team points to structured Markdown, Python caches and paired asset folders as recognizable artifacts of an agentic operation.
Behaviorally, the tell is the loop: bursty API requests, rapid shifts between 401 and 200 HTTP responses, parallel authentications, and sudden model usage from identities that have never touched a model before.
Containment has to move at the same speed
Unit 42's recommendations follow from that timeline rather than from a product sheet. Containment playbooks need to revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines and isolate cloud accounts simultaneously rather than in sequence, because a sequential response hands an automated loop the time it needs to re-establish itself. The team notes the attacker used agents to build overlapping persistence across SSH keys, serverless functions, container restart policies, cloud identities and CI/CD pipelines, and to maintain and test that whole portfolio in parallel, which is tedious for a human operator and trivial for a fleet of agents.
The other half is inventory: every model endpoint, API key, Model Context Protocol (MCP) gateway and AI tool integration treated as core infrastructure, with strict rate limits, least-privilege policies and diagnostic logging attached.
The investigation is written up by Renzon Cruz, Nicolas Bareil, Eric Semaan and Omar Jbari in Unit 42's report. It follows earlier Unit 42 work on an attacker who let an AI agent pick its own targets, and separate research into an agent fleet that backdoored thousands of websites. The through-line is not that AI invented a new attack. It is that the gaps between steps, the hours a defender used to have while an intruder read tool output and worked out what to do next, are closing.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.