What happened
Unit 42, Palo Alto Networks' incident response arm, published a report on an intrusion it says shows what AI-assisted attacks already look like. A human ransomware attacker used frontier AI models and agentic attack frameworks to breach an enterprise network in less than 10 hours, work Unit 42 estimates would normally take human operators around two weeks. During negotiations the attacker said AI agents carried out each step of the intrusion, and even left the company an 80-page security audit of its own network.
"What made the attack stand out was AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft," the Unit 42 team wrote. "The attacker left tactical execution to AI agents that monitored, evaluated, acted and re-planned in real time, increasing speed throughout the attack chain."
The sequence Unit 42 reported reads like a checklist of controls that failed. Agents performed reconnaissance and breached a public API endpoint to tunnel into the network. An automated recon agent mapped internal microservices while subagents scraped code repositories for hard-coded tokens and service passwords. Those credentials opened the secret management system, where the agents stole master administrative credentials for root access. Specialist pivot agents then validated access across the company's cloud, identity, CI/CD, container and SaaS environments, hijacked CI/CD workflows to steal cloud access keys, and turned the victim's own cloud AI services into post-compromise infrastructure. Unit 42 has not disclosed which models or frameworks were used.
Why this is a GRC story
The notable thing is that this attack did not need a zero-day or exotic tradecraft. It ran on failures that GRC teams already own: hard-coded secrets sitting in code repositories, a public API endpoint that became a tunnel into the network, CI/CD pipelines that could mint cloud access keys, and no limits on what an internal service could spend or reach. When credentials are everywhere and pipelines can mint more of them, a machine-speed agent inherits the whole estate.
Unit 42's advice points to the fixes. Treat AI as core infrastructure: keep an inventory of every model endpoint, API key, MCP gateway and AI tool integration, and apply rate limits and least privilege to them. Response has to be automated too. Revoking credentials, terminating OAuth sessions, freezing CI/CD pipelines and isolating cloud accounts need to happen at once through playbooks, because humans cannot react at agent speed.
There is a governance lesson in the audit, too. The attacker understood the victim's attack surface well enough to document it, which means the victim did not. The claim that a company has no AI risk because it does not build AI no longer holds. The risk cuts both ways: attackers using AI against you, and your own AI services and spend turned against you. Both belong in the risk register, with an owner and evidence.
What to watch
Watch whether other incident response firms report similar cases, and whether insurers and regulators start asking for AI asset inventories and secret management evidence in due diligence. For GRC teams, two concrete checks follow from this report: can you revoke every credential and freeze every pipeline at once, and do you know every public API endpoint and every place a key is stored? If the answer is no, an agent could find what you could not.
Attribution: Analysis based on The Register's reporting and related public reporting. This article is original commentary, not a repost of the source material.