AI Agents Ran an Entire Enterprise Breach in Under 10 Hours

Palo Alto Networks' Unit 42 published an incident write-up on 2 September 2026 that deserves attention from anyone running an enterprise security function. A human attacker used frontier AI models and agentic frameworks to run a full intrusion end to end. Initial access to control of the environment took under 10 hours. Unit 42 puts the same work by human operators at roughly two weeks.

More than 50 MITRE ATT&CK techniques were used. The count matters less than the shape: the agents ran them in parallel rather than in sequence.

How the intrusion ran

Each stage maps to something most enterprises already have in production.

Initial access. The attacker breached a public API endpoint and deployed an automated reconnaissance agent to map internal microservices.

Secrets harvesting. Sub-agents combed the organisation's code repositories, pulling hard-coded tokens and service passwords.

Privilege escalation. With those credentials the actor reached the secrets management system itself and harvested master administrative credentials.

Pipeline exploitation. The attacker hijacked an enterprise code application through custom workflows to exfiltrate cloud access keys, then tried to plant backdoors in Terraform configurations. Branch protections blocked that step, which is the one encouraging fact in the report.

AI infrastructure hijacking. Using the stolen cloud keys, the actor turned the victim's own AI endpoints into post-compromise infrastructure, running later activity on the company's compute.

The agents coordinated through structured Markdown files that passed state between sessions. Unit 42 assesses with high confidence that the custom scripts were AI-generated.

The 80-page audit

At the end, the attacker directed the agent to leave a report behind: an 80-page technical audit of the organisation's security posture, documenting dozens of exploited findings.

It reads as a taunt, and it is one. It also states plainly what has changed. Producing that document used to be the expensive part of an engagement. Here it came out as a byproduct of the attack itself.

What Unit 42 recommends

Their guidance is specific, and none of it involves buying an AI detection product.

• Match the attack's speed. Automated playbooks that revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines and isolate cloud accounts at the same time. A response measured in days does not intersect an attack measured in hours.
• Inventory the AI estate. Every model endpoint, API key, MCP gateway and tool integration, with rate limits, least-privilege policies and diagnostic logging.
• Hunt for behavioural loops. Bursty API requests, rapid 401 to 200 state shifts, parallel authentications, sudden model usage from unexpected identities. Agents leave a different traffic signature than people do.
• Harden DevOps. Mandatory multi-party code review and immutable branch protection on infrastructure-as-code repositories.

What I take from it

Every stage exploited something ordinary. A public API. Secrets sitting in repositories. A secrets manager reachable from a compromised identity. A CI/CD system with write access. Model endpoints holding generous keys.

None of that is new. What is new is that chaining them together competently has become cheap. Most of us have been carrying that security debt at an interest rate we were willing to pay, and the rate just moved.

If your incident response plan assumes an attacker moves at human pace, it is a plan for a different threat than the one Unit 42 documented.

Source: Unit 42, Palo Alto Networks