An enterprise intrusion investigated by Palo Alto Networks’ Unit 42 shows how artificial intelligence can accelerate familiar attack techniques into a much faster, parallel operation. According to the report, a human operator paired frontier AI models with attack-oriented agent frameworks and obtained root-level credentials in under ten hours—a scope of work that a conventional human red team might take about two weeks to complete.

The attacker reportedly described the setup during ransom negotiations. Rather than manually advancing through every command, the operator used agents that could observe results, choose actions and revise plans. Unit 42 mapped more than 50 MITRE ATT&CK techniques across the operation. The striking feature was not a new exploit: investigators said the speed came from automating known tradecraft and coordinating many tasks at once.

From an exposed service to the secrets vault

Initial access began through a public-facing web service. After tunneling into the internal environment, the attacker launched automated reconnaissance to discover microservices and map possible routes through the network. Sub-agents then searched enterprise code repositories for hard-coded tokens, service passwords and other credentials that developers had left in source or configuration files.

Those secrets created a direct escalation path. Stolen tokens were used to enter the organization’s secrets-management system, where the intruder obtained master administrative credentials and root-level reach. The sequence reinforces a basic but often neglected lesson: a vault cannot protect credentials if access tokens for the vault are exposed elsewhere, and secret scanning must cover both current code and repository history.

The attacker also abused the continuous integration and deployment environment. Custom workflows were used to extract cloud keys, while an attempt was made to insert backdoors into Terraform infrastructure definitions. Branch-protection controls reportedly stopped the Terraform changes, demonstrating the value of independent review even when other layers have already failed.

Cloud and AI infrastructure became targets

With cloud credentials in hand, the intruder took control of the victim’s own AI infrastructure and repurposed its computing resources. This adds a new concern to the traditional goals of theft and extortion: organizations may unknowingly supply the processing power, model access or API capacity used to continue an attack.

Investigators found operational traces that may help defenders recognize similar campaigns. These included parallel requests to multiple large language models, structured Markdown documents used to hand context between agent sessions, and custom utilities with interface patterns associated with AI-generated software. None is conclusive alone, but together with unusual authentication and pipeline activity they can strengthen an investigation.

The agents even generated an extensive technical audit of the victim’s weaknesses, producing an 80-page report that could be used as leverage. The episode illustrates how the output of automated reconnaissance can serve both operational planning and extortion without requiring a large human team.

Defending at machine speed

Organizations should not respond by focusing only on which model an attacker used. The exploitable conditions were conventional: an exposed entry point, secrets embedded in repositories, powerful tokens, permissive automation and cloud identities that could be chained together. Defensive controls must break that chain and react fast enough to contain parallel activity.

• Remove hard-coded secrets and continuously scan commits, build artifacts and repository history.
• Use short-lived, narrowly scoped workload identities instead of reusable cloud keys.
• Require multiple reviewers for infrastructure-as-code and protect deployment branches from direct changes.
• Build coordinated playbooks that revoke credentials, isolate services and pause pipelines together.
• Treat model endpoints, API keys and AI compute as governed production infrastructure.

Automation changes the economics of intrusion

AI did not make the underlying weaknesses novel; it made exploiting them cheaper and faster. An operator can delegate discovery, credential searching and persistence attempts to multiple agents while concentrating on goals and exceptions. Security teams should therefore measure their ability to detect and contain an identity-driven attack in hours, not days. Strong code review blocked one persistence attempt in this case, but reducing privileges and coordinating containment are what can prevent a fast-moving compromise from reaching root access in the first place.