AI agents carry out a ransomware attack on their own and complete in 10 hours what takes two weeks

The attacker piloted AI agents at each stage of the intrusion and then left the victim with an 80-page security audit produced by the same agents.

According to Unit 42, the threat intelligence division of Palo Alto Networks, a hacker used state-of-the-art AI models and agentic attack frameworks to conduct a complete intrusion into a company's network in less than ten hours — an operation that would normally have required human operators for about two weeks. Agents provided initial reconnaissance via a public API access point, mapped internal microservices, and then searched code repositories for hard-coded credentials and tokens, which were then used to reach the secrets management system and steal root credentials.

The human operator simply supervised agents capable of monitoring, evaluating, acting and rescheduling themselves in real time, combining more than fifty techniques listed in the MITRE ATT&CK framework within a single automated loop. As a sign of the extent of the automation, the attacker ended up sending the victim company an 80-page security audit, also written by the AI agents as the intrusion progressed. Unit 42 emphasizes that the effectiveness of the attack was not based on any new flaw or exceptional technical prowess, but only on the speed of execution enabled by the automation.