A threat actor used frontier artificial-intelligence models and attack-specific agentic frameworks to breach an enterprise environment, harvest root credentials, and hijack cloud AI infrastructure in less than 10 hours.
The investigation, documented by Palo Alto Networks Unit 42, highlights a significant shift in intrusion operations. AI-assisted automation compressed an attack that could otherwise demand several human red-team operators and approximately two weeks of coordinated work into a machine-speed campaign.
Rather than independently deciding on strategic objectives, the AI agents functioned as specialized operational workers, continuously processing information and executing technical tasks under the attacker’s direction.
Hackers Use Frontier AI Agents to Breach Enterprise Network
The campaign did not depend on a zero-day vulnerability or unusually sophisticated new malware. Instead, the attacker applied known intrusion techniques at exceptional speed and scale through a structured agentic workflow.
Unit 42 observed evidence of coordinated AI-agent activity, including parallel large-language-model queries, structured Markdown files used to preserve context across agents and sessions, and custom automation scripts believed to have been generated or improved using AI.
The agents performed more than 50 techniques mapped to the MITRE ATT&CK framework. The attacker retained control over high-impact decisions, including target selection, objectives, and actions that could have operational consequences.
Individual agents then handled reconnaissance, credential discovery, privilege escalation, lateral movement, persistence, and data collection. This division of labor enabled rapid replanning when tools returned unexpected results or a defensive control blocked a particular route.
The intrusion began with exploitation of a publicly accessible web service. The initial compromise allowed the actor to establish a tunnel into the enterprise network, creating a path for internal enumeration and follow-on activity.
An automated reconnaissance agent mapped internal microservices, identified accessible services, and passed findings to other specialized agents.
After mapping the environment, sub-agents searched enterprise source-code repositories for hard-coded credentials, service passwords, API tokens, and cloud access keys.
The exposed secrets reportedly enabled access to the organization’s secrets-management platform, where the attackers harvested master administrative credentials and obtained root-level system access.
The actor also targeted the victim’s DevOps environment. They abused custom workflows in an enterprise code-management application to exfiltrate cloud credentials and attempted to implant backdoors into Terraform configurations.
Strong branch-protection controls prevented the infrastructure-as-code modification attempt, demonstrating that mandatory reviews, protected branches, and immutable deployment controls can still disrupt AI-accelerated attacks.
Using stolen cloud credentials, the attacker invoked the victim’s AI endpoints and repurposed the organization’s compute resources as post-compromise infrastructure.
Such activity may allow attackers to hide orchestration within legitimate AI service traffic while shifting compute costs to the compromised organization.
The attackers also left behind an 80-page technical assessment describing the victim’s security posture and dozens of weaknesses identified during the operation.
The report illustrates how agentic systems can automate not only exploitation, but also comprehensive post-compromise analysis.
Unit 42 advised organizations to treat AI environments as core enterprise infrastructure rather than isolated experimental systems. Security teams should inventory model endpoints, API keys, Model Context Protocol gateways, AI agents, and connected cloud services.
Defenders should apply least-privilege controls, rate limits, secret scanning, and detailed diagnostic logging across AI, identity, cloud, and DevOps environments. Analysts should investigate bursty API traffic, rapid changes in authentication state, parallel login attempts, unusual model usage, and access from unexpected identities.
Incident-response plans should coordinate containment across identity providers, cloud accounts, CI/CD platforms, and code repositories. Rapidly revoking credentials, terminating OAuth sessions, freezing pipelines, and isolating affected cloud resources may be essential to stopping an AI-orchestrated intrusion before it expands.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
