Palo Alto Networks’ specialized threat team Unit 42 reported that over the summer a human attacker used frontier AI agents to compromise a European IT and software company in under 10 hours — a process Unit 42 says would normally take human attackers about two weeks. Palo Alto helped defend the firm against a subsequent extortion attempt and published a step-by-step description of the tactics, while withholding certain details such as the target company’s name, the attacker’s identity and which AI models were used.
How the breach unfolded
- External reconnaissance: The incident began when the human operator launched an AI agent to perform reconnaissance. The agent executed a large-scale internet scan looking for ways into the company’s network.
- Initial access: The scan found and exploited a public API endpoint — essentially a service door the company exposed to the internet so external software can interact with its systems. Unit 42 leader Andy Piazza said AI is particularly effective at this kind of scanning because internet-connected devices are constantly probed.
- Internal mapping: Once inside the network, the agent conducted internal reconnaissance to discover which systems and software were running. In this breach, the attacker identified the company’s code pipeline and code repositories as valuable targets.
- Credential harvesting: Sub-agents searched code repositories and extracted credentials such as passwords and tokens that developers had left embedded in source code. Piazza noted many organizations fail to adequately lock down logins and credentials, a basic practice that would prevent much common malicious activity.
- Lateral movement and living off the land: Using the stolen credentials, the attacker accessed the system the company uses to build and deploy its software and then obtained keys to its cloud accounts. That allowed the attackers to operate through the victim’s own AI tools and infrastructure, a technique known as “living off the land” that makes detection harder.
Outcome and response
The attacker — or its agents — ultimately demanded a ransom. According to Piazza, defenders identified the activity and removed the attackers before they achieved full success. An AI agent nonetheless left behind an approximately 80-page technical report documenting the organization’s vulnerabilities.
Why this matters
- Speed, not novelty: The case demonstrates that AI may not invent fundamentally new attack techniques but can greatly accelerate and scale well-known methods. As Piazza put it, malicious agentic attacks resemble legitimate AI use: "Go do a thing, bring back some results, let me make a decision, and I’ll tell you the next steps." Human direction remains a key element.
- Increasing attack surface: The incident highlights risks tied to public APIs, credentials embedded in code, and insufficient access controls. It also raises concerns that as bad actors gain access to AI compute and AI systems see more sensitive data, the potential for AI-assisted intrusions will grow.
Takeaway
Unit 42’s findings underline the need for organizations to secure exposed APIs, remove secrets from code, harden build and deployment systems, and tighten cloud key and credential management — measures that can reduce the effectiveness of AI-accelerated attacks even when attackers employ sophisticated agent frameworks.
