Unit 42 responded to an incident where a human attacker used frontier AI to breach an enterprise network autonomously as part of a ransomware attack. The agents breached the company's security layers in a methodical manner, each targeting a different layer of defense to achieve a shared goal. The impact was at the scale of a coordinated effort from multiple red teams, which would normally take human operators around two weeks.
The threat actor told us in negotiations that they leveraged frontier AI models and attack-specific agentic AI frameworks. By shifting execution to an automated loop, the attacker compressed weeks of methodical intrusion tradecraft (using more than 50 MITRE ATT&CK techniques) into less than 10 hours.
After they gained initial access, the attacker used agents to map the internal architecture, raid source repositories and seize root credentials. The agents also triggered unauthorized continuous integration/continuous delivery (CI/CD) builds and claimed master keys to the victim's cloud AI infrastructure.
What made the attack stand out was AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft. The attacker left tactical execution to AI agents that monitored, evaluated, acted and re-planned in real time, increasing speed throughout the attack chain.
The attacker also directed the agent to leave behind a “report” on the organization’s security posture: an 80-page, technical audit detailing dozens of exploited findings.
Inside the Machine-Speed Attack Chain
The adversary ran their operation using current AI-enabled software development processes. We observed multiple indicators consistent with AI usage:
- LLM calls to multiple frontier AI agents in parallel
- Structured Markdown files passing information between agents and sessions
- Custom scripts (assessed with high confidence to be AI-generated due to UI elements) managing dynamic operations
The 10-hour operational timeline included the following:
- Infiltration and mapping: The actor breached a public API endpoint to tunnel into the network, deploying an automated recon agent to map internal microservices.
- Secrets harvesting: Sub-agents combed enterprise code repositories, extracting hard-coded tokens and service passwords.
- Privilege takeover: Using exposed tokens, the actor infiltrated the secrets management system, harvesting master administrative credentials to seize control of root system access.
- Pipeline exploitation: The actor hijacked an enterprise code application via custom workflows to exfiltrate cloud access keys. They attempted to plant backdoors in Terraform configurations, but hard branch-protection controls stopped this.
- AI infrastructure hijacking: Using stolen cloud keys, the actor turned the victim’s AI endpoints into post-compromise infrastructure — using the company’s compute power to perpetrate future moves.
Figure 1 maps the AI-orchestrated workflow.
Unified Threat Framework Mapping
For illustration, Table 1 below maps some of the techniques used against the MITRE ATT&CK and ATLAS frameworks:
| Intrusion Stage | Threat Actor Action | MITRE ATT&CK® Mapping | MITRE ATLAS™ (AI-Specific) Mapping |
| Initial Access and Recon | API breach; automated service mapping via service discovery tool | T1190: Exploit Public-Facing Application
T1046: Network Service Discovery |
AML.T0000: Initial Access
AML.T0002: AI-Automated Reconnaissance |
| Credential Access | Code scraping for secrets across code repos | T1552.001: Credentials In Files | AML.T0014: Credentials Harvesting |
| Privilege Escalation | Infiltrating secrets manager to harvest admin system secrets | T1555: Credentials from Password Stores | AML.T0016: Privilege Escalation via Automated Pivot |
| Pipeline Abuse | Executing CI/CD actions; attempting cloud provisioning tool edits | T1578: Modify Cloud Compute Infrastructure | AML.T0010: ML/DevOps Pipeline Interception |
| AI Infrastructure Abuse | Invoking cloud AI models via stolen keys | T1078: Valid Accounts | AML.T0043: LLM Invocations via Stolen API Keys |
Table 1. Major MITRE ATT&CK and MITRE ATLAS techniques used by the attacker.
Key Lessons: Addressing Agentic Attacks
This incident exposes how an attacker who understands how to deploy frontier AI agents effectively can dramatically speed up the pace of their attack. We assess that attackers will increasingly add AI agents to their tool sets. Organizations should take note of the following to address agentic attacks:
- AI agents reduce the time between steps in the attack flow: AI agents in this attack were designed to parse raw tool output and quickly take next steps, speeding up the overall attack flow.
- AI agents leave recognizable indicators: Defenders can identify agentic attacks by watching for indicators such as the use of structured Markdown, Python caches and paired asset folders.
- Attackers can use AI to establish redundant persistence across the environment: In this incident, the attacker used AI agents to efficiently establish overlapping persistence across SSH keys, serverless functions, container restart policies, cloud identities and CI/CD pipelines. Using AI agents can make it easier for an attacker to maintain and test this entire portfolio in parallel.
- Attackers can use an organization’s AI tools as post-compromise infrastructure: Attackers can hijack enterprise AI services to assist in their attacks. This allows threat actors to hide orchestration traffic among expected traffic, and offload the financial cost onto the victim.
Defending Against Machine-Speed Attacks
Defending against automated agent loops requires matching the speed and adaptability of AI-driven attacks:
- Execute synchronized containment: Deploy automated playbooks that simultaneously revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines and isolate cloud accounts across all operational planes.
- Govern AI as core infrastructure: Inventory every model endpoint, API key, Model Context Protocol (MCP) gateway and AI tool integration. Apply strict rate limits, least-privilege policies and diagnostic logging.
- Detect behavioral loops: Hunt for operational loops including bursty API requests, rapid 401/200 HTTP state shifts, parallel authentications and sudden model usage from unexpected identities.
- Lock down DevOps pipelines: Enforce mandatory, multi-party code reviews and immutable branch protection on all infrastructure-as-code repos to block automated backdoor injection.
Learn more about how Unit 42 can help defend against AI-driven threats through Unit 42 Frontier AI Defense.