AI agents breached a company network in 10 hours
An attacker used advanced AI models and custom AI agent software to break into a company's network, steal top-level passwords, and take over its cloud AI systems in under 10 hours. Palo Alto Networks' Unit 42 says the same break-in would normally take a team of human attackers roughly two weeks.
- Report priority
- Medium
- Involves
- Terraform
What is known
The attacker got in through a company web application open to the internet, then used that foothold to tunnel deeper into the network, after which separate AI agents automatically mapped internal systems, hunted through source-code repositories for hardcoded passwords and cloud keys, and used what they found to unlock the company's master credential vault.
What to do
Unit 42's takeaway is that organizations should treat AI model endpoints, API keys, agent frameworks, and connected cloud services as core infrastructure, and apply secret scanning, least-privilege access, rate limits, and detailed logging to catch this kind of automated intrusion.
Reported details
An attacker breaks into a company's public-facing web application and uses it to tunnel into the internal network. One AI agent then maps out the internal microservices while another searches the company's code repositories, finding hardcoded passwords, service credentials, API tokens, and cloud keys left in the code. Those leaked keys let the attacker into the company's secrets-management vault, where they grab master administrative credentials and get root-level access, then use stolen cloud credentials to run their own tasks on the company's AI compute.
Unit 42 documented an intrusion where a threat actor directed frontier LLMs and custom agentic tooling to execute over 50 MITRE ATT&CK techniques end to end, from initial access through a public-facing web service, tunneling, reconnaissance, credential discovery in source-code repos, privilege escalation via a secrets-management platform, and lateral movement into cloud AI infrastructure. Agents used shared Markdown files to preserve context across sessions. The attacker retained control of strategic decisions while agents executed tasks and replanned around blocked routes; a Terraform backdoor attempt via the code-management platform's workflows was stopped by branch-protection controls.