Ten Hours, Fifty Techniques, Zero New Ones. No zero-day required.
Palo Alto Networks' Unit 42 published a case study on September 2, 2026, documenting an intrusion its own investigators called out for one specific reason: nothing about it was technically novel. More than 50 techniques mapped cleanly to the MITRE ATT&CK framework, all of them familiar. What was not familiar was the clock. Work that Unit 42 estimated would take a coordinated human red team roughly two weeks was compressed into less than ten hours.
A human attacker directed the operation but delegated tactical execution to a fleet of purpose-built AI agents. Initial access came through a breached public API endpoint. From there, a reconnaissance agent automatically mapped the victim's internal microservices. Separate sub-agents combed source code repositories for hardcoded tokens and service passwords. Another agent used those credentials to reach the organization's secrets management system and extract root-level administrative credentials. A pipeline agent hijacked CI/CD workflows to exfiltrate cloud access keys.
The most striking detail is what happened next. The attacker used the stolen cloud keys to commandeer the victim's own AI infrastructure and route the attack's orchestration traffic through it, hiding malicious activity inside the normal flow of legitimate model calls. The victim's own compute became the attacker's infrastructure, and the victim's own traffic patterns became the attacker's cover.
Before departing, the agents generated an 80-page security audit documenting every vulnerability exploited during the intrusion, apparently as a byproduct of the same documentation agent used to track the operation, and left it behind for the victim. Unit 42's Sam Rubin, speaking to reporters the day before the investigation concluded, put the significance plainly: the defenses built up over years were not necessarily built for or prepared for these machine-speed attacks.
This is not the first documented agentic ransomware incident. In July 2026, Sysdig disclosed JADEPUFFER, widely described at the time as the first confirmed case of a single AI agent independently exploiting an unpatched Langflow server and destroying a production database. The September case Unit 42 documented is categorically different in scale: not one agent against one exposed service, but a coordinated, multi-agent system operating in parallel across an entire enterprise network, spanning cloud, identity, and CI/CD systems simultaneously.
CSO Online's coverage included an important caveat worth preserving rather than smoothing over: independent analysts note the evidence points to a human-directed intrusion in which AI orchestrated delegated tactical work, not a fully autonomous attack end to end. That distinction does not make the incident less significant. It sharpens what it actually demonstrates: a single operator, without novel tradecraft, can now direct machine-speed execution across an entire attack chain that used to require an entire team working over weeks.
Strip away the speed and the headline, and the intrusion's substance is a familiar chain: exposed endpoint, harvested source-code secrets, extracted root credentials, hijacked pipeline keys, repurposed cloud infrastructure. Every stage after initial access depended on a standing credential being reachable to whatever process reached it next. The agents did not need to defeat a single control designed to stop them. They needed the credentials at each stage to already be sitting somewhere readable, the same condition every agent-security incident this year keeps confirming.
Unit 42's own prescription is directionally correct and worth stating plainly: defenders need automated playbooks that simultaneously revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines, and isolate cloud accounts across all operational planes at once, rather than one after another. Fast, coordinated revocation matters enormously once an intrusion is detected. But detection and revocation both operate after a real credential has already been read and used. The harder question the ten-hour timeline raises is what happens in the gap before detection, when the agent already holds a value that should never have been readable to it in the first place. Match machine speed with machine-speed response, and the industry still has to answer what a compromised process was ever able to see.
Full write-up with sourcing at devfortress.net/blog/unit42-ten-hours, including where this fits alongside the credential-monetization pipeline we've traced through earlier incidents this year.
Resources
Platform: devfortress.net
Open-core: https://github.com/duncan982/devfortress-core
SDK: npm install devfortress-sdk
Textbook: DevFortress Master Edition — https://devfortress.gumroad.com/l/master-edition
Newsletter: https://devfortress.substack.com
DevFortress · Patent Pending — KIPI KE/P/2026/005970-005973
Top comments (0)