Unit 42: AI Agents Ran Every Step of an Enterprise Intrusion in Under Ten Hours, Then Left an 80-Page Security Audit

An unnamed enterprise, with its cloud, identity, CI/CD, container, and SaaS environments compromised

Palo Alto Networks Unit 42 published an incident-response account of an extortion operation in which a human operator drove frontier AI models and agentic attack frameworks through an intrusion that reached full compromise in under ten hours, work the team estimates would take a coordinated human red team roughly two weeks. The chain: reconnaissance agents against a publicly accessible web service, an automated recon agent mapping internal microservices, subagents scraping code repositories for hard-coded tokens and service passwords, use of those tokens to reach the secrets-management system and take master administrative credentials, specialist pivot agents validating access across cloud, identity, CI/CD, container, and SaaS, then hijacked CI/CD workflows to steal cloud access keys and repurpose the victim's own AI service endpoints as post-compromise infrastructure. An attempt to inject a backdoor through Terraform was stopped by branch protection. More than 50 MITRE ATT&CK techniques were used. The operator then directed the agent to leave the victim an 80-page technical security audit cataloguing dozens of exploited findings, and described the methodology to the negotiators. Unit 42 did not name the models or frameworks. Separate reporting on the campaign identifies commercial coding agents, including Cursor and a Claude Sonnet model, as the tools used during the intrusion

No zero-days and no novel technique. Ordinary tradecraft executed by agents that read their own errors, retried, and ran several workstreams at once, which compresses a two-week operation into a single shift and removes the detection window that incident response depends on. The audit document is the notable artifact: the same agent capability that ran the intrusion produced the report on it