Unit 42 timed an agentic intrusion at fifty ATT&CK techniques in under ten hours
The attacker needed no zero-day, only frontier AI agents that cut a two-week intrusion down to a single shift, and the control that stopped their Terraform backdoor was a branch-protection gate rather than an alert.
The Scientist · Science desk
What happened
- Unit 42 investigated a ransom intrusion in which a human attacker ran frontier AI agents in an automated loop and executed more than 50 MITRE ATT&CK techniques against an enterprise network in under 10 hours.
- The agents moved in stages, tunnelling in through a public web service, mapping internal microservices, combing code repositories for hard-coded tokens, and using those tokens to take master administrative credentials from the secrets manager.
- By Unit 42's account nothing exotic was required, with no novel zero-day and no elite tradecraft, and the distinguishing feature of the operation was AI-assisted efficiency.
- With stolen cloud keys the attacker converted the victim's own AI endpoints into post-compromise infrastructure, running further moves on the company's compute and its bill.
- The attacker also had an agent write up the intrusion, leaving behind an 80-page technical audit of the organisation's security posture listing dozens of exploited findings.
Why it matters
- What it limits constraint Response programmes tuned to a dwell time measured in weeks have almost no room to operate when a full chain fits inside one shift, and the squeeze lands on human triage rather than on tooling throughput.
- Who has to decide decision Spending justified by faster detection now has to argue against controls that refuse an action at the moment it is attempted, because refusal costs nothing in wall-clock time and an alert costs a person's attention.
- Who's exposed exposure Forkast's tally of unpatched agent-stack holes and 17,800 public agent add-ons, some impersonating Anthropic and OpenAI, points at an entry surface that most asset inventories do not currently list.
- What doesn't add up contradiction Forkast frames this as the first agentic attack while Unit 42's own threat intelligence director calls it one of the first few documented, which is the difference between a milestone and a sample of unknown size.
Next story · Invest · Sep 30
Palo Alto Networks built a service on the Anthropic model that found 75 flaws in its own productsConfirmed2 publishers
Fifty techniques inside ten hours works out to one about every twelve minutes [17]. Set that against the two weeks Unit 42 says a comparable human effort would have taken [4], and the calendar compresses by roughly 34 times [19]. The labour-hour ratio is much smaller, because two weeks of red team calendar is not 336 hours at the keyboard. But elapsed time is the currency detection budgets are written in: mean time to detect, shift handover, the queue an alert sits in overnight.
The attribution to AI rests on two kinds of evidence that do not carry equal weight. The attacker said so during ransom negotiation, claiming frontier models and attack-specific agentic frameworks [6], and an adversary negotiating a payment has an incentive to sound formidable. The sturdier material is what Unit 42 observed in the environment: parallel LLM calls to several frontier agents, structured Markdown files carrying state between agents and sessions, and custom scripts the team assesses with high confidence to be AI-generated because of their UI elements [7]. Unit 42 offers those artifacts, plus Python caches and paired asset folders, as indicators defenders can hunt on [13].
The most instructive moment in the case file is a failure. The agents tried to plant backdoors in Terraform configurations, and branch-protection controls stopped them [9]. That control does not detect, escalate or notify. It refuses the write at the moment of the write, so its latency is independent of how fast the requester is thinking. What the agents did succeed at, including mapping internal microservices, pulling hard-coded tokens out of code repositories and walking those tokens into the secrets management system for master administrative credentials [8], ran against controls whose response time includes a person. Unit 42 also describes overlapping persistence across SSH keys, serverless functions, container restart policies, cloud identities and CI/CD pipelines, maintained and tested in parallel [12]. The parallelism, not the individual technique, is what a human operator cannot match.
What one incident cannot establish is a rate. Forkast cites CrowdStrike's 2026 Threat Hunting Report, published on August 3, for the finding that AI agent-triggered detection leads are growing 2.5 times as fast as human-triggered ones [14], and for a campaign that issued nearly 200,000 model requests in two minutes [23], about 1,670 per second [27]. That second figure measures volume rather than autonomy; a loop can be very loud without deciding anything. The growth multiple is a rate on a base neither source gives.
The vendor response was already in flight. Okta's Agent SSO reached general availability on August 24 and Broadcom showed AgentMinder at VMware Explore on August 31 [16], both before the September 2, 2026 date Forkast gives for the attack [3], and HiddenLayer's $100 million Series B landed on that same day [15]. None of it was built in response to this case, which is reason to treat agentic-defence product claims as untested against this particular pattern.
Unit 42's own assessment is that attackers will keep adding agents to their tool sets [22], and the mechanism it identifies is narrow and credible: agents parse raw tool output and take the next step immediately, collapsing the gaps between stages [18]. The interval that decides cases like this one is between an autonomous action and a human looking at it, and here it had to be shorter than ten hours to matter [2].
What to watch
- Whether a second documented case reports dwell time before the ten-hour sprint and how the intrusion was detected, both absent from this report.
- Whether Unit 42's proposed indicators, structured Markdown and Python caches among them, survive a measured false-positive rate in ordinary development environments.
- Whether CrowdStrike publishes the absolute counts behind the 2.5x growth in AI agent-triggered detection leads.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence56
- Adoption52
- Hype gap+32
- Incentives80
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Unit 42 responded to an incident in which a human attacker used frontier AI to breach an enterprise network autonomously as part of a ransom attack.
- [2]
By shifting execution to an automated loop, the attacker compressed weeks of methodical intrusion tradecraft, using more than 50 MITRE ATT&CK techniques, into less than 10 hours.
- [3]
Forkast dates the attack to September 2, 2026, says Unit 42 documented it on September 3, and names the researchers as Renzon Cruz, Nicolas Bareil, Eric Semaan and Omar Jbari.
- [4]
Unit 42 assessed the impact as at the scale of a coordinated effort from multiple red teams, which would normally take human operators around two weeks.
- [5]
What made the attack stand out was AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft.
- [6]
The threat actor told Unit 42 during negotiations that they leveraged frontier AI models and attack-specific agentic AI frameworks.
- [7]
Unit 42 observed multiple indicators consistent with AI usage: LLM calls to multiple frontier AI agents in parallel, structured Markdown files passing information between agents and sessions, and custom scripts assessed with high confidence to be AI-generated due to UI elements.
- [8]
The 10-hour timeline ran from breaching a publicly accessible web service and deploying an automated recon agent to map internal microservices, to sub-agents combing enterprise code repositories for hard-coded tokens and service passwords, to using exposed tokens to infiltrate the secrets management system and harvest master administrative credentials for root system access, to hijacking an enterprise code application to exfiltrate cloud access keys.
- [9]
The actor attempted to plant backdoors in Terraform configurations, but hard branch-protection controls stopped this.
- [10]
Using stolen cloud keys, the actor turned the victim's AI endpoints into post-compromise infrastructure, using the company's compute power for future moves, which lets an attacker hide orchestration traffic among expected traffic and offload the financial cost onto the victim.
- [11]
The attacker directed the agent to leave behind a report on the organization's security posture: an 80-page technical audit detailing dozens of exploited findings.
- [12]
The attacker used AI agents to establish overlapping persistence across SSH keys, serverless functions, container restart policies, cloud identities and CI/CD pipelines, and Unit 42 notes agents make it easier to maintain and test that entire portfolio in parallel.
- [13]
Unit 42 says defenders can identify agentic attacks by watching for indicators such as the use of structured Markdown, Python caches and paired asset folders.
- [14]
According to the CrowdStrike 2026 Threat Hunting Report released on August 3, AI agent-triggered detection leads are growing at 2.5 times the rate of human-triggered ones.
- [15]
On September 2, HiddenLayer raised $100 million in a Series B round, and a day earlier AIR Security secured $50 million across two seed rounds.
- [16]
Broadcom unveiled AgentMinder at VMware Explore on August 31, and Okta pushed Agent SSO into general availability on August 24.
- [17]
More than 50 techniques in under 10 hours is at least five techniques per hour, or one about every 12 minutes.
- [18]
Unit 42 says the AI agents in this attack were designed to parse raw tool output and quickly take next steps, reducing the time between steps in the attack flow.
- [19]
Two weeks of elapsed time is 336 hours, so an under-10-hour operation compresses the calendar by roughly 34 times.
- [20]
Andy Piazza, Senior Director of Threat Intelligence at Unit 42, called the incident "one of the first few documented agentic breaches where an attacker successfully leveraged an agentic attack against an enterprise."
- [21]
Forkast's headline describes the episode as "The First Agentic Attack".
- [22]
Unit 42 assesses that attackers will increasingly add AI agents to their tool sets.
- [23]
Forkast reports one campaign firing off nearly 200,000 model requests in just two minutes.
- [24]
Forkast lists critical unpatched vulnerabilities including CVE-2026-82526, an unauthenticated SQL injection in R2R with a CVSS score of 9.8, and CVE-2026-85620, an authorization bypass in Postgres MCP Pro at 9.2.
- [25]
Forkast counts 17,800 public agent add-ons, some already impersonating trusted names like Anthropic and OpenAI.
- [26]
Forkast argues the speed at which these agents operate often outpaces the ability of human administrators to audit them.
- [27]
Nearly 200,000 model requests in two minutes is about 1,670 requests per second.
Sources
2 independent publishers whose own reporting we read for this story.
- forkast.newsThe First Agentic Attack: How AI Is Reshaping the Economics of Cybersecurity – Forkast
1 article · September 5, 2026
- unit42.paloaltonetworks.comAn AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
1 article · September 5, 2026
Topics and entities
Topics
Entities
- OpenAI
- Palo Alto Networks
- Terraform
- MITRE ATT&CK
- Model Context Protocol
- Falcon Guardian AIDR
- Postgres MCP Pro
- Air Security
- Broadcom
- CrowdStrike
- MITRE ATLAS
- Okta
- HiddenLayer
- Anthropic
- Unit 42