# AI Agents Breached a Company's Network in Under 10 Hours, Unit 42 Says

Page: https://hirantha.me/blog/ai-agents-breached-a-companys-network-in-under-10-hours-unit-42-says
Published: 2026-09-06
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: ai agents, ransomware, unit 42, incident response, agentic ai

> Palo Alto Networks' Unit 42 says an attacker used AI agents to go from zero access to root credentials in under 10 hours, then had the AI write up the findings.

## A two-week attack compressed into ten hours

An incident response team at Palo Alto Networks' Unit 42 has documented a break-in that moved at a pace no human-only crew could match: from first foothold to root access across an enterprise network in under 10 hours. Unit 42 estimates the same intrusion, done by hand, would normally take a skilled team about two weeks. The attacker told investigators during ransom negotiations that the speed came from pairing frontier artificial intelligence (AI) models with attack-specific agentic frameworks, not from any new exploit.

That detail matters as much as the timeline. Nothing about the vulnerabilities used was novel. The gain came entirely from letting software run more of the attack loop - deciding what to try next, acting on it and adjusting - without waiting on a person.

## How the break-in actually unfolded

Unit 42 and a follow-up writeup in The Register lay out the chain step by step:

- **Entry**: the attacker got in through a public-facing web service, the same kind of access point human red teams have used for years.
- **Mapping**: an automated reconnaissance agent charted the victim's internal microservices, work that normally eats up days of a human tester's time.
- **Credential harvesting**: separate subagents combed code repositories for hard-coded tokens and passwords.
- **Privilege escalation**: those credentials got the attacker into the secrets-management system, where they lifted master administrative credentials.
- **Lateral movement**: what Unit 42 calls "specialist pivot agents" then checked how far that access reached across cloud accounts, identity systems, CI/CD (continuous integration/continuous deployment) pipelines, containers and SaaS (software-as-a-service) applications.
- **Pipeline abuse**: the CI/CD pipelines themselves were hijacked to pull additional cloud access keys.
- **Turning the victim's own AI against it**: in the most unusual step, the attacker repurposed the victim's own cloud AI compute and endpoints to keep running the intrusion.

Across the whole operation, Unit 42 counted more than 50 distinct techniques drawn from the MITRE ATT&CK framework (a widely used catalogue of attacker tactics and techniques), strung into what it describes as a single automated loop of monitoring, evaluating, acting and re-planning in real time. A human crew would typically work through a fraction of that in the same window, largely because each step needs someone to notice the result and decide the next move. Here, agents did both.

## The attacker left behind a security audit

The most striking detail isn't the speed - it's what happened after the network was compromised. The attacker directed the AI agents to compile an 80-page technical report cataloguing dozens of the exploited weaknesses in the victim's own infrastructure, then used that document as leverage during ransom negotiations. In effect, the intrusion produced a professional-grade penetration test as a side effect, handed back to the victim as proof of how thoroughly they'd been owned.

Unit 42 has not named the victim, the industry it operates in, or the specific AI models and frameworks involved, and did not respond to requests for further detail, according to The Register. The report was published on September 2, 2026.

## Why defenders should care about the mechanics, not just the headline

It's tempting to read this as "AI hacks company in 10 hours" and move on, but the more useful takeaway is about persistence. Unit 42's researchers point out that agentic tooling doesn't just speed up any one step - it lets an attacker establish redundant footholds across SSH keys, cloud identities and CI/CD systems simultaneously, which is exactly the kind of multi-front persistence that makes incident response slower and messier afterward. A defender who kicks the attacker out of one system may find the agents already re-established access somewhere else before anyone noticed.

The entry point and the credential-harvesting techniques here are not new; they're the same public-facing exposures and hard-coded-secret problems that show up in incident reports every year. What's changed is how much of the follow-through - the reconnaissance, the pivoting, the credential validation across a dozen systems - can now run unattended and in parallel.

## What this means in practice

Organizations that assume they have days to detect and contain a breach after initial access should treat that assumption as outdated. The practical defenses this incident points to are unglamorous but concrete: get hard-coded credentials out of code repositories, rotate secrets stored in secrets managers regularly, put tighter guardrails on what a CI/CD pipeline's service accounts can reach, and monitor for unusual internal reconnaissance patterns rather than relying solely on perimeter alerts. None of that requires exotic new tooling - it requires closing the same gaps this attacker walked through, just faster than before.

## Questions

**What made this attack different from a normal breach?**
The attacker used frontier AI models paired with agentic frameworks to run reconnaissance, credential theft and lateral movement as one continuous automated loop, compressing a roughly two-week manual operation into under 10 hours.

**Did the attacker use a zero-day exploit?**
No. Unit 42 found no novel exploit involved; the speed came from automating and parallelizing well-known techniques like exploiting a public-facing service and harvesting hard-coded credentials, not from new vulnerabilities.

**What was the 80-page audit the attacker left behind?**
After compromising the network, the attacker had the AI agents compile a technical report documenting dozens of exploited security weaknesses, then used it as leverage during ransom negotiations.

**Which company was affected?**
Unit 42 has not disclosed the victim's name or industry, and it did not respond to requests for further details, according to The Register.

**What should organizations do in response?**
Focus on the fundamentals attackers still rely on: remove hard-coded credentials from code repositories, rotate secrets regularly, restrict what CI/CD service accounts can access, and watch for unusual internal reconnaissance rather than only perimeter alerts.

## Sources

- [An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation](https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/), Unit 42 (Palo Alto Networks)
- [AI agents carried out every step of this ransomware attack, then left the victim an 80-page security audit](https://www.theregister.com/security/2026/09/02/ai-agents-carried-out-every-step-of-this-ransomware-attack-then-left-the-victim-an-80-page-security-audit/5294009), The Register