A hacker breached a company's corporate network in less than 10 hours using autonomous AI agents. After completing the attack, the attacker left the victim with an 80-page audit report of their security system.
A hacker breached a company's corporate network in less than 10 hours using autonomous AI agents. After completing the attack, the attacker left the victim with an 80-page audit report of their security system.
According to analysts at Unit 42 (a cybersecurity division of Palo Alto Networks), during ransom negotiations, the hacker stated that he used advanced artificial intelligence models and special agent frameworks, where separate AI agents were responsible for each stage of penetration, writes Cybernews.
Experts estimate that a typical attack of this scale involving only humans would typically take about two weeks. The use of artificial intelligence has reduced this time to less than 10 hours.
"Instead of using unique zero-day vulnerabilities, the attacker assigned tactical execution to AI agents. They monitored the network status in real time, assessed the situation, acted and adjusted plans," Unit 42 noted.
Agents conducted initial reconnaissance and compromised a public API endpoint for initial network access.
While one agent mapped internal microservices, others simultaneously analyzed code repositories, extracting hard-coded tokens and passwords. This allowed access to the secret management system and root-level master passwords.
Individual agents confirmed access to cloud services, identity systems, and CI/CD containers. By hijacking CI/CD processes, the hackers turned the victim company’s own cloud AI services into their own infrastructure, forcing it to pay for the attack’s computing power.
A special "documentation agent" compiled an 80-page security audit detailing dozens of vulnerabilities discovered and exploited.
Unit 42 emphasizes that protecting against automated AI agents requires similar speed of response. Companies are recommended to implement automated protection scripts that can simultaneously revoke credentials, revoke OAuth sessions, freeze CI/CD pipelines, and isolate cloud accounts.
