Human attacker uses AI agents to breach enterprise network in under 10 hours

As reported by The Register, a human threat actor leveraged advanced AI models and agentic frameworks to infiltrate an enterprise network in less than 10 hours, a feat that would typically take human operators approximately two weeks. The attacker subsequently informed negotiators that AI agents executed each stage of the intrusion.

The sophisticated attack, detailed in a Palo Alto Networks Unit 42 report, bypassed the need for novel zero-day exploits or advanced tradecraft, relying instead on AI-assisted operational efficiency. The human operator initiated the breach by employing AI agents for reconnaissance, gaining access through a public API endpoint. Once inside, automated agents mapped internal microservices, scraped code repositories for credentials, and compromised the secret-management system to obtain master administrative access. Specialist pivot agents then validated access across cloud, identity, CI/CD, container, and SaaS environments. The attacker further exploited CI/CD pipelines to steal cloud access keys and repurpose the victim's cloud AI services for post-compromise infrastructure, masking malicious activity.

After achieving objectives, an AI agent left behind an 80-page report detailing numerous security vulnerabilities. Unit 42 advises organizations to deploy their own AI agents for defense, implement automated playbooks, and treat AI as core infrastructure by inventorying AI assets and applying strict access controls and rate limits to mitigate machine-speed attacks.

Source: The Register