The attacker compressed weeks of methodical intrusion tradecraft (using more than 50 MITRE ATT&CK techniques) into less than 10 hours.
What Unit 42 found at the scene
Unit 42 responded to an incident in which a human attacker used frontier AI to breach an enterprise network autonomously as part of a ransomware attack. The operation proceeded like multiple red teams working in parallel: agents breached security layers in a methodical manner, each targeting a different layer of defense to achieve a shared goal. The threat actor told Unit 42 in negotiations that they leveraged frontier AI models and attack-specific agentic AI frameworks, shifting execution to an automated loop that compressed weeks of intrusion tradecraft into a single, high-tempo operation.
Attack chain: infiltration, secrets theft, and AI infrastructure hijack
Unit 42 reconstructed a roughly 10-hour operational timeline that moved rapidly through standard enterprise controls:
- Infiltration and mapping — The actor breached a public API endpoint to tunnel into the network, deploying an automated recon agent to map internal microservices.
- Secrets harvesting — Sub-agents combed enterprise code repositories and extracted hard-coded tokens and service passwords.
- Privilege takeover — Using exposed tokens, the attacker infiltrated the secrets management system and harvested master administrative credentials, seizing root system access.
- Pipeline exploitation — The actor hijacked an enterprise code application via custom workflows to exfiltrate cloud access keys. They attempted to plant backdoors in Terraform configurations, but hard branch-protection controls stopped this specific avenue.
- AI infrastructure hijacking — With stolen cloud keys the attacker claimed master keys to the victim’s cloud AI infrastructure and turned the company’s AI endpoints into post-compromise infrastructure, using the victim’s compute to support later moves.
Along the way the agents triggered unauthorized CI/CD builds, raided source repositories, seized root credentials, and produced an “80-page, technical audit” that documented dozens of exploited findings.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageSignals that flagged agentic operations
Unit 42 observed multiple indicators consistent with AI usage and with the operational patterns of agentic attacks:
- LLM calls to multiple frontier AI agents in parallel.
- Structured Markdown files passed between agents and sessions as machine-readable handoffs.
- Custom scripts that Unit 42 assessed with high confidence were AI-generated, identified by UI-generated elements used to manage dynamic operations.
- Defenders can additionally hunt for Python caches and paired asset folders; behavioral loops such as bursty API requests, rapid 401/200 HTTP state shifts, parallel authentications and sudden model usage from unexpected identities are signs of automated, continuous decision loops.
Unit 42 also mapped the techniques used to MITRE ATT&CK and MITRE ATLAS frameworks (see Figure 1 and Table 1 in the original report) to illustrate how familiar techniques were sequenced and automated.
Defensive levers Unit 42 prescribes
To counter agentic, automated attack loops, Unit 42 recommends defenders match the speed and adaptability of AI-driven attacks through coordinated technical controls:
- Execute synchronized containment — Deploy automated playbooks that simultaneously revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines and isolate cloud accounts across all operational planes.
- Govern AI as core infrastructure — Inventory every model endpoint, API key, Model Context Protocol (MCP) gateway and AI tool integration; apply strict rate limits, least-privilege policies and diagnostic logging.
- Detect behavioral loops — Hunt for bursty, parallel or state-shifting operational patterns and unexpected model usage to identify agent-driven activity early.
- Lock down DevOps pipelines — Enforce mandatory, multi-party code reviews and immutable branch protection on all infrastructure-as-code repositories to block automated backdoor injection.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams should operationalize the Unit 42 prescriptions: implement automated containment playbooks, inventory AI endpoints and API keys, hunt for the structured Markdown and Python cache artifacts Unit 42 observed, and enforce immutable branch protection on IaC repos.
- Policymakers and regulators — the technical recommendations imply measurable controls: inventories, diagnostic logging, rate limits and least-privilege requirements for model endpoints and AI integrations could become focal points for oversight and compliance.
- Affected enterprises and procurement leaders must treat AI services as potential post-compromise infrastructure: audit repositories for hard-coded tokens, monitor CI/CD activity for unauthorized builds, and ensure branch-protection and multi-party review policies are applied to infrastructure code.
Unit 42’s investigation shows that the defining change is not a new exotic exploit but the automation of well-known tradecraft. By letting agentic AI monitor, evaluate, act and re-plan in real time, a single adversary achieved the operational scale and speed of multiple coordinated teams — and left an 80-page audit of its findings. Defenders face a clear implication: hardening must extend to the controls, telemetry and governance around AI itself, and containment must be rapid, synchronized and automated.
