AI Agents Just Compressed a Two-Week Ransomware Attack Into 10 Hours

• The Mess: A human attacker used frontier AI and agentic frameworks to breach an enterprise network, automate reconnaissance, steal credentials and hijack internal infrastructure. Unit 42 says the operation used more than 50 MITRE ATT&CK techniques and compressed roughly two weeks of human work into less than 10 hours.
• The Damage: The agents reached root credentials, source repositories, CI/CD systems and cloud AI infrastructure, turning the victim’s own systems into part of the attack machine.
• The Fix: Lock down AI agents, rotate exposed credentials, enforce least privilege, isolate CI/CD and AI infrastructure, and monitor for machine-speed bursts of authentication and API activity.

This was not a lab demo.

Unit 42 responded to a real enterprise incident where a human threat actor used frontier AI models together with attack-specific agentic frameworks during a ransomware operation.

The attacker did not simply ask an LLM how to hack a server.

They built an automated loop.

The human established the objectives. AI agents handled reconnaissance, interpreted results, selected the next actions and repeated the process. More than 50 MITRE ATT&CK techniques were used during the intrusion.

The result was ugly: work that Unit 42 estimates would normally require around two weeks of human operators was compressed into less than 10 hours.

The Attack Started With a Public API

The attacker first breached a public-facing API endpoint and used it as a tunnel into the internal environment.

An automated reconnaissance agent then mapped internal microservices.

From there, the operation moved rapidly.

Sub-agents searched enterprise source repositories for hard-coded tokens, service passwords and other credentials. Those secrets provided access to the organization’s secrets-management infrastructure.

That opened the door to something much worse.

The attackers obtained master administrative credentials and seized root-level access.

The agents were not merely collecting information. They were continuously processing the results and deciding what to do next.

CI/CD Became Part of the Attack

The intrusion also reached the victim’s software-development pipeline.

Attackers used custom workflows to extract cloud access keys and attempted to modify Terraform configurations to establish additional access.

One thing actually stopped them.

Strong branch-protection controls prevented the attempted backdoor injection.

That detail matters.

The AI did not magically defeat every defense. Existing security controls still blocked parts of the attack.

But wherever controls were weak enough, the agents moved extremely quickly.

Then the Attackers Hijacked the Victim’s AI Infrastructure

The stolen cloud credentials gave the attacker access to the victim’s AI endpoints.

Those systems were then repurposed as post-compromise infrastructure.

In other words, the victim’s own AI resources could help the attacker continue attacking the victim.

That creates an unpleasant feedback loop.

Compromise credentials.

Access AI infrastructure.

Use the infrastructure to accelerate further operations.

Repeat.

The attacker also established overlapping persistence through SSH keys, serverless functions, container restart policies, cloud identities and CI/CD pipelines.

AI agents made it practical to build and test multiple persistence mechanisms in parallel.

The Hacker Left an 80-Page Security Report

Perhaps the strangest part came after the attack.

The attacker instructed the agent to produce a technical report describing the victim’s security posture.

The result was an 80-page audit containing dozens of exploited findings.

The same automation that helped break the environment could apparently document why it was vulnerable.

That is a brutal illustration of the new problem.

Attackers do not necessarily need a spectacular zero-day.

They can take ordinary weaknesses, credentials, exposed services and bad configuration — then use automation to chain them together at a speed humans struggle to match.

Defenders Need to Watch for Machine-Speed Behavior

Unit 42 identified several indicators associated with the agentic workflow.

These included structured Markdown files used to pass information between agents and sessions, Python caches and paired asset directories. Researchers also observed calls to multiple frontier AI agents running in parallel.

The network behavior can be just as revealing.

A human operator normally introduces pauses between reconnaissance, credential theft, privilege escalation and lateral movement.

An automated agent can execute the next step almost immediately.

That changes the defensive equation.

Security teams should watch for bursts of API requests, rapid authentication state changes, parallel logins and unexpected model usage tied to compromised identities.

Credentials should also be revoked quickly when compromise is suspected. OAuth sessions, CI/CD credentials, cloud identities and AI API keys cannot be treated as separate incidents when an attacker has crossed multiple control planes.

This Was Not an AI Supervillain

There is an important caveat.

Unit 42 does not claim that the attacker discovered some magical autonomous hacking capability that requires no humans.

The human remained responsible for objectives and consequential decisions.

The breakthrough was operational efficiency.

AI handled the repetitive cognitive work between those decisions: parsing tool output, searching repositories, mapping infrastructure, testing access and adapting to results.

That distinction makes the incident more interesting, not less.

The barrier to conducting a complicated intrusion is not only technical knowledge. It is also time.

Agentic AI attacks the time problem.

And ten hours is a very different defensive window from two weeks.

Bugstoday Opinion

The scary part is not that AI can hack.

We already knew that.

The scary part is that an attacker can now throw a capable agent at a messy enterprise environment and let it grind through the boring parts of the intrusion at machine speed.

No revolutionary zero-day.

No cinematic super-hacker.

Just exposed credentials, weak boundaries, automation and a human who knows what they want.

That combination is enough.

Bugstoday verdict: The attacker’s biggest upgrade is no longer skill. It is speed.

Sources:

• Unit 42 — An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
• MITRE ATT&CK
• MITRE ATLAS
• Palo Alto Networks Unit 42 — AI Security Research