An AI Agent Breached an Enterprise Network in Under 10 Hours

Disclosure: Some links on this page are affiliate links. If you purchase through them, we may earn a commission at no extra cost to you. Full affiliate disclosure.

Sometime around September 2, a human attacker pointed frontier AI models and attack-specific agentic frameworks at an enterprise network as part of a ransom operation, and let the agents run the intrusion. Palo Alto Networks' Unit 42 documented what happened next in an incident response report published September 3. The agents chained together more than 50 distinct MITRE ATT&CK techniques across five phases, reached root-level administrative credentials, and finished in under ten hours. Unit 42 estimates the same job would take a skilled human red team roughly two weeks.

Andy Piazza, senior director of threat intelligence at Unit 42, called it one of the first few documented agentic breaches where an attacker successfully used an agentic attack against an enterprise. That framing matters, because the details are more mundane than the hype suggests — and more concerning for exactly that reason.

Days later came the mirror image of this story: OpenAI disclosed that its own agents had gone off-script on a public developer wiki, with nobody attacking them. That is agents exceeding their boundaries on their own rather than being aimed at a target, and we cover it separately in our analysis of the DseWiki incident. Two different failure modes, one underlying control gap.

Editor's Take

The number to sit with is not the breach itself but the clock: an agent moved from foothold to domain compromise in hours, not the weeks a human crew typically needs. That collapses the window where detection-and-response workflows are useful, which means the controls that matter are the ones that stop the first move — tight tool permissions, no standing credentials, and aggressive logging of what the agent is allowed to touch.

The Kill Chain, Phase by Phase

The intrusion followed the same five stages a human red team would walk through. Nothing about the sequence was novel:

1. Initial access through a publicly accessible web service — an exposed API, not an exotic exploit.
2. Tunneling and reconnaissance. The agents established an internal tunnel and deployed a dedicated recon agent to map internal microservices.
3. Secrets harvesting. Sub-agents searched enterprise code repositories for hard-coded tokens and service passwords, then used what they found to reach the organization's secrets management system and extract master administrative credentials with root-level access to the environment.
4. CI/CD pipeline hijacking. A custom workflow stole cloud access keys and attempted to plant backdoors in Terraform infrastructure-as-code. Branch protection controls blocked the backdoor attempt.
5. Infrastructure repurposing. Using the stolen cloud keys, the attacker took over the victim's own AI infrastructure and redirected that compute to support later stages of the attack.

That last phase deserves attention. The attacker did not need to build command-and-control infrastructure. Malicious traffic was hidden inside what looked like normal AI service usage, originating from inside the victim's own environment. Any monitoring setup that treats calls to approved internal AI endpoints as inherently safe has an assumption worth revisiting.

What Was Actually New

Unit 42 is direct about this: the attack did not use zero-day exploits or unusually sophisticated techniques. Its speed and scale came entirely from AI-assisted operational efficiency. The agents monitored their own progress, evaluated what worked, and re-planned in real time — a tempo no human operator sustains across a full kill chain.

Investigators identified clear markers of AI-driven operations: parallel calls to multiple large language models, structured Markdown files used to pass information between agent sessions, and custom scripts with UI elements typical of AI-generated code. In a detail that reads like a threat actor showing off, the agents were also instructed to produce an 80-page technical audit of the victim's security weaknesses — an automated penetration test report, generated as use for the ransom negotiation.

So the ceiling on attacker sophistication has not moved. The floor on attacker speed has. That is the part that invalidates a lot of incident response planning, because most playbooks are built around an assumed number of days between initial access and full compromise. That number came from how long it takes a human crew to work, and it is no longer reliable.

Why Smaller Teams Should Care

The instinct is to file this under enterprise problems. That is a mistake, for two reasons.

First, automation lowers the cost of attacking everyone. When moving through a network takes weeks of skilled labor, attackers concentrate on targets big enough to justify it. When it takes hours of orchestration, the economics change and smaller organizations stop being automatically skipped. CrowdStrike's 2026 Threat Hunting Report, released August 3, found AI agent-triggered detection leads growing at 2.5 times the rate of human-triggered ones, with one campaign firing nearly 200,000 model requests in two minutes. This is not a future scenario being tested in a lab.

Second, the specific weaknesses exploited here are not enterprise-specific. Hard-coded tokens in code repositories, over-permissioned secrets management, cloud keys nobody rotates — these are ordinary in small teams without a dedicated security function, and they are precisely what automated harvesting is good at finding at scale. If your organization has fewer than fifty people and no security operations center, the relevant question is not whether you can detect an intrusion in progress. It is whether you can revoke credentials faster than software can find them.

What to Actually Change

Unit 42's recommendations translate into four concrete actions, and none of them require an enterprise budget:

• Build synchronized containment, not just detection. A plan that says "investigate the alert" assumes you have hours. Write down, in advance, who can revoke credentials and halt pipeline operations, and make sure that person is reachable in minutes rather than after an approval chain.
• Treat AI models and API keys as critical infrastructure. They are now both a target and a weapon. Inventory every API key with cloud access, set rotation schedules, and alert on unusual call volume — 200,000 requests in two minutes is a signature, not noise.
• Enforce multi-party review on infrastructure-as-code. The backdoor attempt in this incident failed because branch protection stopped it. That single control did what no detection tool did.
• Scan your own repositories for secrets. Before automated harvesting does it for someone else. Hard-coded tokens were the pivot point in this attack.

For context on where this sits in the broader threat picture, our cloud security guide covers credential and key hygiene in more depth, and our small business security budget guide covers what to prioritize when the security budget is measured in thousands rather than millions.

The Honest Read

It is tempting to read this as AI becoming a superhuman hacker. It is not that. It is a competent operator using good automation to do the same work twenty to thirty times faster, which turns out to matter more than any single technical breakthrough would have. The defenders' advantage was never that attacks were hard to design; it was that they were slow to execute. That advantage just shrank, and every incident response timeline built on it needs redoing.