A threat actor used frontier AI models and attack-specific agentic frameworks to breach an enterprise environment, harvest root credentials, and hijack cloud AI infrastructure in under 10 hours.
Documented by Palo Alto Networks Unit 42, the incident demonstrates how AI-assisted automation can compress an intrusion that might normally require multiple human red-team operators and roughly two weeks of work into a single machine-speed campaign.
The attacker reportedly used an automated loop in which specialized AI agents monitored tool output, evaluated options, executed actions, and replanned their next steps.
AI Agents Breach Enterprise Network
Rather than relying on a previously unknown vulnerability or exceptionally novel tradecraft, the actor used existing attack methods at a far higher operational tempo.
Unit 42 observed indicators of coordinated AI-agent use, including parallel large language model calls, structured Markdown files used to exchange context between agents and sessions, and custom automation scripts believed to be AI-generated.
The agents collectively performed more than 50 techniques aligned with the MITRE ATT&CK framework.
The attacker retained responsibility for setting objectives and consequential decisions, while individual agents performed reconnaissance, credential collection, privilege escalation, and persistence activities.
The campaign began by exploiting a publicly accessible web service, enabling the actor to establish a tunnel into the enterprise network.
An automated reconnaissance agent then mapped internal microservices and discovered reachable services across the environment. After mapping the environment, sub-agents searched enterprise source-code repositories for hard-coded credentials, service passwords and tokens.
The exposed secrets reportedly allowed the attacker to access the organization’s secrets-management platform and harvest master administrative credentials, ultimately gaining root-level system access.
The actor also targeted the victim’s DevOps environment. They abused custom workflows in an enterprise code application to exfiltrate cloud access keys and attempted to insert backdoors into Terraform configurations.
Strong branch-protection controls prevented the infrastructure-as-code modification attempt, underscoring the value of immutable protections and mandatory review gates.
Using stolen cloud credentials, the attacker invoked the victim’s AI endpoints and repurposed the organization’s compute resources as post-compromise infrastructure.
This tactic could allow adversaries to blend orchestration activity into otherwise legitimate AI-service traffic while shifting compute costs to the compromised organization.
The attacker additionally left an 80-page technical report describing the victim’s security posture and dozens of exploited weaknesses.
Unit 42 said defenders should treat AI systems as core enterprise infrastructure rather than isolated experimental tools.
Organizations should inventory model endpoints, API keys, Model Context Protocol gateways and AI integrations, then apply least-privilege access controls, rate limits and comprehensive diagnostic logging.
Security teams should also watch for agentic behavioral patterns, including bursty API activity, rapid HTTP authentication-state changes, parallel login attempts and abnormal model usage from unexpected identities.
Incident-response playbooks need synchronized containment across identity, cloud, and DevOps systems. Recommended actions include revoking credentials, terminating OAuth sessions, freezing CI/CD pipelines, and simultaneously isolating affected cloud accounts.
Finally, enterprises should protect code repositories and infrastructure-as-code workflows with multi-party review, strong branch protection and secret-scanning controls.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
