Unit 42 Says No Novel Zero-Day Was Needed: An AI-Assisted Intrusion Under Ten Hours

Palo Alto Networks' Unit 42 says a human attacker used frontier AI agents to breach an enterprise network in less than 10 hours, work it estimates would normally take human operators around two weeks. In Unit 42's assessment no novel zero-day was needed: the agents cut the time between ordinary steps, and that time is what a human-paced response depends on.

The 30-Second Version

• Unit 42 locates the speed in the time between steps: agents "designed to parse raw tool output and quickly take next steps".
• The chain was ordinary: a public web service, hard-coded tokens in repositories, the secrets manager, a hijacked code application, then the victim's own model endpoints.
• The only control Unit 42 reports holding was "hard branch-protection controls"; it does not say what the rule required, and recommends "mandatory, multi-party code reviews and immutable branch protection".
• "Less than 10 hours" has no stated basis, "around two weeks" is Unit 42's estimate, and there is no detection clock beside either.
• Persistence ran across five surfaces at once. The answer is a pre-authorized containment playbook scoped to the identity that tripped it, plus five inventories built before the incident.

Part 1: What the Post Says, and What It Leaves Out

The attacker is "a human attacker", with no group name, alias or prior attribution. The victim is "an enterprise network", with no name, sector, size, country or cloud provider. The post gives no date for the intrusion and no indicators of compromise a defender can search for.

Unit 42's opening line uses the word "autonomously". The Figure 1 caption in the same post is the corrective: "The actor sets objectives and makes consequential decisions. Specialized agents execute, share results and adapt in real time." The attacker's own voice in the record is one sentence, told to Unit 42 "in negotiations": that they used "frontier AI models and attack-specific agentic AI frameworks". Unit 42 defines neither phrase. Figure 1 names five agent roles (reconnaissance, exploit development, credential and context, "Specialist Pivot Agents", documentation), but the post does not say how many agents ran or where they were hosted.

Unit 42's verbs describe access: "extracting hard-coded tokens and service passwords", "harvesting master administrative credentials", and "hijacked an enterprise code application via custom workflows to exfiltrate cloud access keys". Source code is on the list too ("raid source repositories"; Figure 1: "source code and configuration"). No sentence says a customer record left the building.

Part 2: The Gap Between Steps

Unit 42 names the mechanism: "AI agents reduce the time between steps in the attack flow: AI agents in this attack were designed to parse raw tool output and quickly take next steps, speeding up the overall attack flow." The attacker removed most of the waiting and kept the thinking. The two weeks Unit 42 estimates for human operators would be partly thinking and mostly waiting: for a scan to finish and be read in the morning, for a colleague to finish the piece they own.

The claim needs narrowing. A loop removes operator latency. Tool latency stays: a scan that takes four hours takes four hours whoever launched it, and a business-hours change window opens when it opens.

The incident cannot tell you how much of the tempo came from the model. Unit 42 reports one technique that failed. Figure 1 makes failure part of the loop ("A failed request becomes feedback for the next attempt"; the human orchestrator "Revisits blocked tasks"), but the post gives no failure rate. In a separate case, Gambit Security's report on the Aurora ransomware operator says: "The majority of the commands failed to achieve the stated objective on the first attempt." If the failure rate here was anything like that, "less than 10 hours" is partly a claim about parallelism. One of the indicators of AI use that Unit 42 lists is "LLM calls to multiple frontier AI agents in parallel", and Figure 1's pivot agents operate "in parallel to reduce idle time from specialist handoffs". Unit 42 does not separate the gain from running loops side by side from the gain of running each without pauses.

Part 3: The Chain, Hop by Hop

Unit 42 prints the chain as five stages and maps them to ATT&CK and ATLAS in a table marked "For illustration". The six ATT&CK IDs check out; none of the six ATLAS ID-name pairs matches ATLAS release 2026.08 or 2026.09. AML.T0043 is Craft Adversarial Data, not "LLM Invocations via Stolen API Keys"; five of the names are in no ATLAS release; and "Initial Access" is a tactic (AML.TA0004), not a technique.

public web service breached ──► recon agent maps internal microservices
            │
            ▼
sub-agents comb repositories ──► hard-coded tokens, service passwords
            │
            ▼
exposed tokens ──► secrets manager ──► master admin credentials / root
            │
            ▼
code application hijacked via custom workflows ──► cloud access keys
   (Terraform backdoor attempted; branch protection stopped it)
            │
            ▼
stolen cloud keys ──► victim's AI endpoints as post-compromise infrastructure

After the first hop, Unit 42 ties no step to an exploit.

Repositories. Sub-agents "combed enterprise code repositories, extracting hard-coded tokens and service passwords." The finding is old. A loop adds completeness: it reads to the end of its budget. Unit 42 gives no scope for what was read, so assume every repository the compromised service could reach was read and every secret in it taken.

The secrets manager. "Using exposed tokens, the actor infiltrated the secrets management system, harvesting master administrative credentials to seize control of root system access." That is two moves, and the first is the hop you can break. The attacker reached the control designed to end hard-coded secrets by using a hard-coded secret.

The code application. "The actor hijacked an enterprise code application via custom workflows to exfiltrate cloud access keys. They attempted to plant backdoors in Terraform configurations, but hard branch-protection controls stopped this." This is the one place the attacker was refused outright. The agents also "triggered unauthorized continuous integration/continuous delivery (CI/CD) builds", and Table 1 lists "Executing CI/CD actions" in this stage, but Unit 42 does not say how the custom workflows got there or which identity ran them.

The model endpoints. "Using stolen cloud keys, the actor turned the victim's AI endpoints into post-compromise infrastructure — using the company's compute power to perpetrate future moves." Unit 42's reasoning is general: "This allows threat actors to hide orchestration traffic among expected traffic, and offload the financial cost onto the victim." Model calls reaching the victim's endpoint from the victim's own cloud identity look like the victim's own workload. Unit 42 does not say whether the endpoints were used afterwards for those "future moves".

Part 4: What the Agents Left Behind

Unit 42 lists three observations it calls "indicators consistent with AI usage". Another, besides the parallel LLM calls, is "Structured Markdown files passing information between agents and sessions", which is how one loop briefs another and how a loop resumes. The third is "Custom scripts (assessed with high confidence to be AI-generated due to UI elements)". The detection lesson it draws: "Defenders can identify agentic attacks by watching for indicators such as the use of structured Markdown, Python caches and paired asset folders." An agent framework leaves a working directory behind, and one on a host that should not have it is cheap to look for, and cheap for a tidier attacker to remove.

Then the document: "The attacker also directed the agent to leave behind a 'report' on the organization's security posture: an 80-page, technical audit detailing dozens of exploited findings." The scare quotes are Unit 42's. In Figure 1 the documentation agent's "standardized report" includes "descriptions, reproduction steps, impact statements and remediation guidance", the shape of a penetration-test report. No title or location is given, and the post does not describe it as sent to anyone, so readings of it as an insult or as a gift to the victim are equally unsupported. What it does support: generating a long structured document from a session's findings is what an agent framework does at almost no marginal cost.

Part 5: Persistence in Five Places at Once

The sentence for incident-response leads sits outside the five stages: "the attacker used AI agents to efficiently establish overlapping persistence across SSH keys, serverless functions, container restart policies, cloud identities and CI/CD pipelines."

Those are five different teams' problems. An SSH key survives password changes. A serverless function is persistence with no host to image. A container whose restart policy says always comes back whenever it exits; stopped by hand, it returns at the next daemon restart. An extra cloud role survives anything done at the host level, and a job added to a pipeline re-runs on every commit.

Unit 42 adds the inference: "Using AI agents can make it easier for an attacker to maintain and test this entire portfolio in parallel." A human operator establishes persistence in one or two places and hopes. A set of loops can establish it in five, verify each, and re-establish any a defender removes. Unit 42 does not say whether the persistence was fully removed or how long containment took.

Part 6: The Numbers

Unit 42 says the attacker "compressed weeks of methodical intrusion tradecraft (using more than 50 MITRE ATT&CK techniques) into less than 10 hours", and that the impact "would normally take human operators around two weeks". The basis for the 10-hour figure (log timestamps or the attacker's account) is not stated, two weeks is Unit 42's estimate rather than a measured baseline, and there are no per-stage times.

CyberScoop's report of an August 26 briefing gives a second baseline, paraphrasing Unit 42's Sam Rubin on what is evidently the same case: 10 hours against "at least 10 days". A September 22 Palo Alto Networks post by Rubin claims "97% faster", which matches the two-week figure rather than adding a third baseline: 10 hours is 3% of two weeks.

None of these figures has a second clock beside it. There is no date, no dwell time and no time to detect, so the hour count implies that your response has to fit in 10 hours only if the clock started when someone saw something.

The technique count is no better documented. The illustrative table shows six ATT&CK IDs across the five stages against a stated total of "more than 50", and does not say how the rest divide between the agents and the human. CyberScoop's briefing report has the attacker "exploit 50 applications and other weaknesses", a different claim from "more than 50" techniques.

Part 7: Containment That Fires on Every Plane at Once

Unit 42's first recommendation: "Execute synchronized containment: Deploy automated playbooks that simultaneously revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines and isolate cloud accounts across all operational planes." Against five parallel persistence surfaces, the word that matters is "simultaneously". A standard response revokes the credential that tripped the alert, then investigates, then revokes the next, and each revocation is a signal to the loop maintaining the rest.

The bullet leaves out scope, and scope decides whether a platform team will ever pre-authorize it. An org-wide account isolation fired on a rate heuristic is production down on a deploy day. A platform team will sign a playbook scoped to the principal that tripped the trigger: revoke its credentials on every plane at once, kill its sessions, freeze the pipeline jobs it can run, quarantine its cloud role. Sessions are on the list because revoking a password does nothing to logins already open.

The trigger has to be a number, set from your own gateway logs. Unit 42's third recommendation hunts "bursty API requests, rapid 401/200 HTTP state shifts, parallel authentications and sudden model usage from unexpected identities", but a 401 followed within seconds by a 200 from one source is also every token refresh and every SDK retry. The loop shows itself in the fan-out: 401s across many distinct services, or with many distinct credentials, from one source in a window, followed by 200s. A false positive then costs one principal's access, restorable in minutes.

The harder half is organizational. An alert fires, someone is paged, that person investigates and forms a view, then escalates to someone who can authorize containment. Each hand-off is a wait, and each was acceptable when the attacker was also waiting. Move the authority: a defined trigger runs the scoped playbook and the human reviews it afterwards. Rehearse it like a failover.

Part 8: What Has to Exist Before the Incident

Identity-scoped containment reaches credentials, sessions, pipeline jobs and cloud roles. Three of the five persistence surfaces are not identity objects: an SSH authorized key, a serverless function and a container restart policy survive the revocation of every credential you know about. Removing those is eviction, per surface, and it takes five lists that predate the incident: every SSH authorized key across the fleet, every serverless function and its trigger, every container with a restart policy and why, every cloud identity and who created it, every pipeline job and who last changed it. The cloud-identity and pipeline lists are usually a query each. A complete SSH key inventory across a real fleet is a project, because it means agreeing who owns the answer and covering the hosts nobody claims.

The chain itself can be broken in two places. Enumerate which identities can read which paths in your secrets manager and remove the ones that are there because it was convenient; the token that reads from the vault should not reach the master administrative credentials, and cutting that path breaks the hop from repositories to root. Then ask whether new workflow definitions need the same second party a code change does: branch protection held against the Terraform backdoor, while the agents still triggered unauthorized CI/CD builds in the stage Unit 42 describes as hijacking a code application "via custom workflows". Unit 42 asks for "immutable branch protection" without defining immutable; the useful reading is a rule the identities the attacker held cannot switch off.

Last, the model endpoints, which Unit 42 wants inventoried with "strict rate limits, least-privilege policies and diagnostic logging". Metadata is enough: which key, which identity, which source, how many calls, how much output, at what time. The signal it names, "sudden model usage from unexpected identities", is only visible if usage is attributed to identities at all.

The Big Misconceptions

“An AI broke into a company on its own.”

A human set the objectives, made the consequential decisions and negotiated the ransom; the agents ran the tactical loop. The phrase "every step" comes from The Register's headline. Unit 42 does not use it.

“This was a ransomware attack.”

Unit 42 added a note on September 3 "to clarify that the attack was an intrusion, and not a ransomware attack", and the same update changed "ransomware attack" in its lede to "ransom attack". The words "encryption" and "extortion" do not appear in the primary. Model this as a credential-and-infrastructure compromise with a ransom negotiation attached.

“We know which model did this.”

No model, vendor, version, API provider or framework is named. Unit 42 says it observed indicators "consistent with AI usage" and does not say it verified the attacker's claim. The Register reports that it asked which models and frameworks were used and did not immediately get an answer.

If You Remember Only Five Things

1. The mechanism was the gap between steps, and in Unit 42's assessment the attack needed no novel zero-day.
2. A human set the objectives and made the consequential decisions; agents ran the tactical loop.
3. Exposed tokens in repositories opened the secrets manager, and stolen cloud keys opened the victim's own AI endpoints.
4. Branch protection was the one control Unit 42 reports holding, and it held by refusing the change.
5. Containment has to be pre-authorized, scoped to the principal that tripped it and rehearsed, with the five inventories built beforehand.

Cheat sheet

Sources & Further Reading

• Palo Alto Networks Unit 42 — An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation: https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/
• Internet Archive — Unit 42 post as captured September 2, 2026: https://web.archive.org/web/20260902211307/https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/
• Internet Archive — Unit 42 post as captured September 3, 2026, after the clarification: https://web.archive.org/web/20260903124251/https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/
• The Register — AI agents carried out every step of this ransomware attack – then left the victim an 80-page security audit: https://www.theregister.com/security/2026/09/02/ai-agents-carried-out-every-step-of-this-ransomware-attack-then-left-the-victim-an-80-page-security-audit/5294009
• CyberScoop — Unit 42 warns AI has shifted balance of power from defenders to attackers: https://cyberscoop.com/unit-42-palo-alto-networks-warning-agentic-ai-frontier-models/
• Palo Alto Networks — Introducing Unit 42 Continuous Frontier AI Defense: https://www.paloaltonetworks.com/blog/2026/09/introducing-unit-42-continuous-frontier-ai-defense/
• Gambit Security — Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation: https://gambit.security/blog-posts/aurora-ransomware-targets-esxi-abuses-cursor-agent-for-exploitation
• MITRE — MITRE ATLAS Data: https://github.com/mitre-atlas/atlas-data

Current through October 9, 2026.