AI agents ran a full ransomware breach in under 10 hours

Palo Alto's Unit 42 published an investigation on September 2 into an enterprise ransomware intrusion that ran end to end in under 10 hours. The same tradecraft normally takes a human operator about two weeks. The attacker was a person, but the execution was agentic: frontier models inside an attack framework, monitoring, evaluating, acting, and re-planning in real time. Then the operator had a documentation agent write the victim an 80-page security audit of everything it had just broken.

What actually happened

Initial access came through a publicly accessible web service. Nothing exotic. From there the agents worked the environment the way a very fast, very patient consultant would:

• Mapped internal microservices and architecture
• Pulled hardcoded tokens and service passwords out of repositories
• Harvested master administrative credentials from the secrets manager
• Hijacked CI/CD pipelines and attempted to inject a backdoor
• Commandeered the victim's own cloud AI endpoints as post-compromise infrastructure

Unit 42 counts more than 50 MITRE ATT&CK techniques across cloud, identity, CI/CD and SaaS. The line worth pinning to a wall is their assessment of why it worked: AI-assisted operational efficiency, without a novel zero-day and without elite tradecraft. Nothing in the chain required a new exploit. It required speed.

The 80-page audit is the part that will get quoted, and it deserves to be. It's a technical report on dozens of exploited findings, produced by the same agents that exploited them, handed to the victim as leverage. As a piece of extortion theater it's grim. As a signal it's clear enough: the marginal cost of thorough documentation went to roughly zero, on both sides.

Why AI-driven ransomware matters for your business

Ten hours is shorter than a night. It is shorter than a long weekend. If your detection story is "we'd notice something weird by the next business day," that story is now a full breach behind.

Look at the order of operations, because it's the same order your own build system runs in. Repositories, then secrets manager, then CI/CD. That path is the fastest route from one exposed service to everything you own, and most small teams have it wide open internally because the pipeline needs broad access to do its job. A hardcoded token in a repo used to be a finding you'd fix next sprint. Against an agent that greps every repo in minutes, it's the whole breach.

Unit 42's recommendations translate cleanly to a small stack. Pre-write the playbook — credential revocation and pipeline freeze as one command you can run at 2am, not a decision tree you improvise. Inventory your AI endpoints, API keys and gateways and rate-limit them, because your own inference budget is now attacker infrastructure. Hunt behavioral loops — bursty API calls, parallel authentications — instead of signatures, because there's no malware family to match here. And require multi-party review with immutable branch protection on infrastructure-as-code, since the backdoor attempt went through the pipeline, not around it.

We've covered agent-run ransomware and autonomous exploitation campaigns before. This one is different in a specific way: earlier cases showed agents finding a way in. This one shows agents running a full enterprise compromise on a clock, and the thing that saved nobody was that none of it was clever.

Sources: Unit 42, Palo Alto Networks, The Register.