Ten Hours, Not Two Weeks: What a Real AI-Assisted Breach Actually Looks Like
Everything covered on this site so far this month has come from evaluation environments, lab disclosures, or academic research. Palo Alto Networks' Unit 42 published something different on September 2: a first-hand account of a genuine criminal intrusion, where a real attacker used frontier AI agents to autonomously breach a real enterprise network — start to finish, in under ten hours. Unit 42's own estimate: the same intrusion using traditional, human-driven tradecraft would typically take a red team about two weeks.
What actually happened
The attacker gained initial access by exploiting a public-facing API to tunnel into the target's network, then handed tactical execution to AI agents that mapped the internal environment, combed source-code repositories for hard-coded tokens and passwords, and used those credentials to reach the organization's secrets management system — harvesting master administrative credentials and seizing effective root control. From there, the agents hijacked CI/CD pipelines to exfiltrate cloud access keys, attempted to plant backdoors directly into the organization's infrastructure-as-code (blocked by the target's branch-protection controls), and finally used the stolen cloud keys to commandeer the victim's own AI infrastructure as staging ground for further operations. Unit 42 counts more than 50 distinct MITRE ATT&CK techniques used across the intrusion. A detail worth sitting with: the attacker directed their agents to compile an 80-page technical security audit of the victim's own environment as part of the operation — using AI not just to break in, but to document the break-in at a level of thoroughness that would ordinarily require a dedicated human team.
Why speed, not sophistication, is the actual headline
Unit 42 is explicit that no novel zero-day and no unusually elite tradecraft were required here. What changed was tempo. The agents parsed raw tool output and moved to the next step continuously, in real time, monitoring, evaluating, and re-planning without the natural pauses that structure human-driven intrusions. That compression is the whole story: the same techniques defenders have trained against for years, executed at a pace that outruns most organizations' human-speed detection and response processes.
Mapping the intrusion against two frameworks at once
Unit 42 did something unusual for an incident writeup: it mapped the attack against both MITRE ATT&CK (the standard framework for conventional intrusion techniques) and MITRE ATLAS (the newer, AI-specific counterpart) side by side, stage by stage. The initial access and reconnaissance phase maps to ATT&CK's exploitation of a public-facing application, paired with ATLAS's own category for AI-automated reconnaissance. Credential harvesting from code repositories maps to ATT&CK's credentials-in-files technique, alongside ATLAS's credential-harvesting category. The privilege escalation stage, infiltrating the secrets manager, pairs a standard credential-access technique with ATLAS's entry for privilege escalation via automated pivot. Pipeline abuse pairs modifying cloud infrastructure with ATLAS's ML/DevOps pipeline interception category. And the final stage, using stolen keys to invoke the victim's own AI models, pairs the well-established "valid accounts" technique with ATLAS's specific category for LLM invocation via stolen API keys.
Laid out this way, the intrusion reads less like a single novel attack and more like conventional tradecraft with an AI-specific technique bolted onto each stage — which is exactly the point Unit 42 is making: nothing here required inventing a new category of attack, just applying AI capability to accelerate every step of an already-known one.
A concrete, checkable set of tells, and what to actually do about it
Unit 42 doesn't just describe the incident, it gives defenders something to act on, in two parts. First, detection: AI-driven intrusions in this pattern leave recognizable indicators, including structured Markdown files used to pass information between agent sessions, custom scripts bearing tell-tale signs of AI generation, and behavioral patterns like bursty API request bursts, rapid authentication state changes, and parallel authentications from unexpected identities.
Second, response and prevention, which Unit 42 frames around four specific practices: synchronized containment playbooks that can revoke credentials, terminate sessions, freeze CI/CD pipelines, and isolate cloud accounts simultaneously rather than sequentially; treating AI itself as core infrastructure requiring a full inventory of every model endpoint, API key, and MCP gateway with least-privilege policies and logging applied to each; active hunting for the behavioral loops described above rather than waiting for a conventional alert to fire; and mandatory multi-party code review with immutable branch protection on infrastructure-as-code repositories specifically, which is worth noting is the one control that actually stopped part of this attack — the victim's branch-protection settings blocked the attacker's attempt to plant a backdoor in their Terraform configuration.
Where this sits relative to everything else covered this month
The distinction worth being precise about: everything else in this month's coverage — Hugging Face, UK AISI's findings, the multi-agent coordination research — involved AI systems behaving unexpectedly inside environments built to study or deploy them. This is a human attacker deliberately weaponizing the same underlying capability against a target with no evaluation framing at all. Both are real, and both matter, but they're different threats requiring different responses. This incident is the clearer, more direct answer to the question the Collective Cyber Defense letter raised at the end of last month: AI-enabled attacks compressing timelines isn't a future risk to prepare for. It already happened, and Unit 42 just showed exactly how.