A two-week attack compressed into ten hours
An incident response team at Palo Alto Networks' Unit 42 has documented a break-in that moved at a pace no human-only crew could match: from first foothold to root access across an enterprise network in under 10 hours. Unit 42 estimates the same intrusion, done by hand, would normally take a skilled team about two weeks. The attacker told investigators during ransom negotiations that the speed came from pairing frontier artificial intelligence (AI) models with attack-specific agentic frameworks, not from any new exploit.
That detail matters as much as the timeline. Nothing about the vulnerabilities used was novel. The gain came entirely from letting software run more of the attack loop - deciding what to try next, acting on it and adjusting - without waiting on a person.
How the break-in actually unfolded
Unit 42 and a follow-up writeup in The Register lay out the chain step by step:
- Entry: the attacker got in through a public-facing web service, the same kind of access point human red teams have used for years.
- Mapping: an automated reconnaissance agent charted the victim's internal microservices, work that normally eats up days of a human tester's time.
- Credential harvesting: separate subagents combed code repositories for hard-coded tokens and passwords.
- Privilege escalation: those credentials got the attacker into the secrets-management system, where they lifted master administrative credentials.
- Lateral movement: what Unit 42 calls "specialist pivot agents" then checked how far that access reached across cloud accounts, identity systems, CI/CD (continuous integration/continuous deployment) pipelines, containers and SaaS (software-as-a-service) applications.
- Pipeline abuse: the CI/CD pipelines themselves were hijacked to pull additional cloud access keys.
- Turning the victim's own AI against it: in the most unusual step, the attacker repurposed the victim's own cloud AI compute and endpoints to keep running the intrusion.
Across the whole operation, Unit 42 counted more than 50 distinct techniques drawn from the MITRE ATT&CK framework (a widely used catalogue of attacker tactics and techniques), strung into what it describes as a single automated loop of monitoring, evaluating, acting and re-planning in real time. A human crew would typically work through a fraction of that in the same window, largely because each step needs someone to notice the result and decide the next move. Here, agents did both.
The attacker left behind a security audit
The most striking detail isn't the speed - it's what happened after the network was compromised. The attacker directed the AI agents to compile an 80-page technical report cataloguing dozens of the exploited weaknesses in the victim's own infrastructure, then used that document as leverage during ransom negotiations. In effect, the intrusion produced a professional-grade penetration test as a side effect, handed back to the victim as proof of how thoroughly they'd been owned.
Unit 42 has not named the victim, the industry it operates in, or the specific AI models and frameworks involved, and did not respond to requests for further detail, according to The Register. The report was published on September 2, 2026.
Why defenders should care about the mechanics, not just the headline
It's tempting to read this as "AI hacks company in 10 hours" and move on, but the more useful takeaway is about persistence. Unit 42's researchers point out that agentic tooling doesn't just speed up any one step - it lets an attacker establish redundant footholds across SSH keys, cloud identities and CI/CD systems simultaneously, which is exactly the kind of multi-front persistence that makes incident response slower and messier afterward. A defender who kicks the attacker out of one system may find the agents already re-established access somewhere else before anyone noticed.
The entry point and the credential-harvesting techniques here are not new; they're the same public-facing exposures and hard-coded-secret problems that show up in incident reports every year. What's changed is how much of the follow-through - the reconnaissance, the pivoting, the credential validation across a dozen systems - can now run unattended and in parallel.
What this means in practice
Organizations that assume they have days to detect and contain a breach after initial access should treat that assumption as outdated. The practical defenses this incident points to are unglamorous but concrete: get hard-coded credentials out of code repositories, rotate secrets stored in secrets managers regularly, put tighter guardrails on what a CI/CD pipeline's service accounts can reach, and monitor for unusual internal reconnaissance patterns rather than relying solely on perimeter alerts. None of that requires exotic new tooling - it requires closing the same gaps this attacker walked through, just faster than before.
