The attacker did not need a new zero-day. They needed one exposed API and enough automation to turn every discovery into the next action before the defenders could catch up.
Unit 42 says a human-directed operation used frontier AI models and attack-specific agent frameworks to traverse an enterprise in less than ten hours. The reported path crossed internal services, source repositories, secrets management, cloud, identity, CI/CD, containers, SaaS, and the victim’s own AI infrastructure.
TL;DR
- Unit 42 observed an enterprise intrusion that it says compressed work comparable to roughly two weeks of human operations into under ten hours.
- The initial foothold was a public API endpoint; the attack then abused known weaknesses, credentials, and excessive permissions rather than a novel zero-day.
- Evidence consistent with AI use included parallel model calls, structured Markdown passed between agents, adaptive scripts, and rapid replanning.
- Some attribution to AI also relies on what the threat actor told Unit 42 during negotiations. The exact models and frameworks were not disclosed.
- Defenders should focus on cross-domain containment speed and cumulative behavior, not attempt to identify whether each command “looks AI-generated.”
What Unit 42 Reported
The operation began by breaching a public API and using automated discovery to map internal microservices. Agents searched source repositories for credentials, reached the organization’s secret-management system, and obtained high-level administrative access.
From there, the activity spread across control planes. Unit 42 reports unauthorized CI/CD builds, cloud-key theft, identity and SaaS access, and the misuse of the victim’s cloud AI resources. The attacker also directed the agents to leave an 80-page assessment describing weaknesses they had exploited.
Unit 42 mapped more than 50 MITRE ATT&CK techniques across the case and described agents that monitored results, evaluated failures, acted, and replanned. That is materially different from asking a chatbot for a PowerShell command. It is an execution loop tied to live systems.
But the evidence has limits. Unit 42’s account says the threat actor described using frontier models and agentic frameworks during negotiations. The investigators also observed artifacts consistent with that claim, but the public report does not name the models, expose their provider telemetry, or allow an outside party to reconstruct every human-versus-agent decision. “AI-assisted” is the defensible description. “Fully autonomous” is stronger than the public evidence permits.
The New Problem Is Tempo
Every individual control failure in the chain is familiar: an exposed endpoint, secrets in repositories, overpowered service identities, permissive build systems, and connected cloud control planes. The change is how quickly one success can be tested against the next layer.
Public API foothold -> automated service discovery -> source and credential search -> secrets-manager access -> cloud and identity takeover -> CI/CD and container abuse -> data access and persistence across control planesA SOC that investigates each alert as a separate ticket will reconstruct that chain after the attacker has finished it. The defensive unit must be the identity and its accumulated reach: what new systems did it touch, what secrets did it read, what builds did it trigger, and what permissions did it exercise within the same short window?
Detection for a Ten-Hour Intrusion
Build cross-domain sequences around control-plane events. Correlate a public-service anomaly with source-repository access, secrets retrieval, new cloud tokens, unusual CI/CD jobs, container administration, and SaaS logins. Any one event may be allowed. Their rapid succession from a new principal, source, or workload is not normal administration.
Protect build systems as production. Alert when a user or service account changes pipeline definitions, requests secrets, creates an unreviewed runner, or launches a build outside its normal repository and schedule. Rotate exposed credentials and invalidate derived sessions; otherwise the attacker can continue after the original secret is changed.
Contain identity, cloud, source control, and CI/CD together. Disabling an endpoint while leaving stolen cloud tokens active is a human-speed response to a machine-speed chain.
Defensive Plan: Make Each Success a Dead End
| Owner | Action | Why it interrupts the attack | How to verify it worked |
|---|---|---|---|
| API and application owners | Inventory public endpoints, require authentication where appropriate, test object- and function-level authorization, and block server-side access to management networks unless explicitly required. | The reported operation began at a public API and used that position to discover internal services. Narrow authorization and egress stop one API bug from becoming an internal reconnaissance platform. | From an external test account, attempt each sensitive operation and internal destination. Record denied requests in application and gateway logs with endpoint, identity, and reason. |
| Secrets and repository owners | Remove static secrets from current code, scan commit history, forks, build artifacts, issue attachments, and logs, then rotate every confirmed exposure and revoke derived sessions. | Deleting the current file leaves the secret in history and leaves already issued cloud or SaaS sessions alive. Rotation closes the credential pivot used to cross control planes. | The old secret and its sessions fail; history scanning returns no live credential; the replacement is scoped to one workload and has a recorded owner and expiry. |
| IAM and cloud teams | Replace broad service roles with task-specific identities, short-lived credentials, and explicit restrictions on secret retrieval, token creation, and role assumption. | Agents can test permissions continuously. Least privilege forces them to acquire a new authorization boundary instead of turning one service identity into cloud administration. | Run the workload’s normal integration tests, then attempt a prohibited secret read and role assumption. Normal work must pass and both negative tests must be denied and logged. |
| DevSecOps | Protect pipeline definitions with review, isolate runners by trust level, use workload identity instead of stored cloud keys, and require provenance for release artifacts. | If source access automatically grants pipeline editing and deployment credentials, the attacker can convert repository compromise into production control. Independent approval and short-lived workload identity break that inheritance. | A controlled unreviewed pipeline change cannot run in production; a runner from another repository cannot obtain deployment credentials; release verification rejects an unsigned or unproven artifact. |
| SOC engineering | Correlate first-seen API behavior, repository access, bulk secret reads, token creation, pipeline changes, runner creation, and SaaS administration in a short time window around the same identity or source. | Each event can look legitimate alone. The rapid accumulation of access is the durable signal of an automated cross-domain chain. | Replay a purple-team sequence across test systems and confirm one incident preserves the ordered timeline, affected identities, control planes, and containment actions. |
| Incident commander | Pre-authorize a cross-domain kill switch covering endpoint isolation, account disablement, token and session revocation, repository lockdown, runner suspension, and cloud-key rotation. | Serial escalation between six platform teams gives a fast operator time to finish. Parallel containment removes every trust path derived from the first compromise. | Run a timed tabletop and a technical test in a sandbox. Measure from declaration to confirmed revocation in each platform and document any control that requires manual vendor support. |
The useful metric is time from the first cross-domain signal to verified loss of attacker access. Mean time to close a ticket says little when the intrusion can finish before the ticket is assigned.
AI did not make the exposed API or excessive permission. It made the time available to tolerate them much shorter.
Related Posts
- JADEPUFFER: Inside the First Documented Agentic Ransomware Attack - an earlier, narrower case and the evidence limits around agent autonomy.
- Identity-First Attacks in Cloud: How Permissions Become the New Perimeter - why authenticated access crosses security-product boundaries.
- Non-Human Identities: The Attack Surface Your Security Team Isn’t Managing - service accounts, tokens, and automation identities attackers inherit.
- AWS IAM Privilege Escalation to Data Exfil: The Full Attack Chain - a concrete cloud control-plane chain.