AI Agents Breached Enterprise Network in 10 Hours, Unit 42 Reports

AI-powered intrusion compressed weeks of attack work into hours

Palo Alto Networks' Unit 42 threat intelligence team has documented what it describes as one of the first confirmed cases of an autonomous AI agent successfully breaching an enterprise network. The intrusion took less than 10 hours from initial access to deep compromise—work that would typically require a coordinated red team effort spanning approximately two weeks.

The human threat actor confirmed during negotiations that they deployed frontier AI models and attack-specific agentic frameworks to conduct the breach. The AI agents executed more than 50 techniques catalogued in the MITRE ATT&CK knowledge base, leaving behind an 80-page report detailing the vulnerabilities they exploited.

Why it matters

This incident marks a fundamental shift in the threat landscape. AI agents didn't introduce novel attack methods—they executed well-known techniques with unprecedented speed and automation. Traditional incident response assumes defenders have time to investigate each stage of an intrusion manually. When reconnaissance, credential theft, and persistence attempts happen in minutes rather than days, that assumption collapses. Organizations now face adversaries that operate at machine speed, requiring equally automated detection and containment capabilities.

Anatomy of the autonomous attack

The breach began when the attacker compromised a publicly accessible web service to tunnel into the target network. From there, an automated reconnaissance agent mapped internal microservices across the environment.

The attacker deployed specialized sub-agents to harvest secrets from enterprise code repositories, extracting hard-coded tokens and service passwords. With these credentials, the threat actor infiltrated the organization's secrets management system, escalating to administrative credentials and root access.

The intrusion continued as the attacker pivoted to hijack a code application, stealing cloud access keys. An attempt to establish persistence by planting a backdoor in Terraform configurations was blocked by branch protection controls. After obtaining cloud keys, the actor targeted the victim's AI infrastructure directly, converting the company's own AI endpoints into post-compromise infrastructure—a technique Unit 42 calls LLM hijacking. The agents also triggered unauthorized CI/CD builds, demonstrating their ability to manipulate software development pipelines.

Defending against machine-speed threats

Andy Piazza, Senior Director of Threat Intelligence at Unit 42, emphasized that "the techniques weren't novel in themselves—rather the attacker's agentic system carried out well known techniques with unprecedented speed and agentic automation." He noted the incident highlights the urgent need to protect enterprise credentials, application secrets, and AI infrastructure.

Unit 42 recommends organizations implement synchronized containment through automated playbooks capable of revoking credentials, terminating sessions, freezing CI/CD pipelines, and isolating cloud accounts simultaneously across multiple systems. Security teams need comprehensive visibility into model endpoints, API keys, Model Context Protocol gateways, and AI tool integrations, paired with strict rate limits, least-privilege access, and detailed logging.

Defenders should hunt for operational patterns that reveal AI agent activity: bursts of API requests, rapid authentication state changes, parallel logins, and unexpected model usage can indicate an autonomous system moving through an environment.

The broader implication is clear—AI doesn't require zero-day vulnerabilities to transform attacks. By accelerating existing techniques, it fundamentally changes the defensive equation. Enterprises need automated detection, containment, and recovery systems operating at the same speed as the threats they face.

These details were first reported by Unit 42 and published by Cyber Magazine.