Unit 42 Clocks an AI-Assisted Network Breach at Under 10 Hours

Unit 42, Palo Alto Networks’ threat research arm, investigated a network intrusion that a single human attacker completed in less than 10 hours by directing frontier AI models through custom agentic frameworks. Unit 42 says the resulting damage matched what it would normally expect from a coordinated, multi-week effort involving several human operators. The attacker told the researchers directly, during ransom negotiations, that they had built the operation around commercial AI models and attack-specific agent tooling.

What stands out in Unit 42’s account is not novelty. The firm found no zero-day exploit and no unusually sophisticated tradecraft: its investigators mapped the intrusion to more than 50 already-cataloged MITRE ATT&CK techniques, the same reference list defenders already train against. The change was tempo. According to Unit 42, AI agents handled monitoring, evaluation and the next-step decision in a continuous loop, cutting out the pauses that normally slow a human operator down.

Unit 42 describes the operation moving through several stages inside that single overnight window: initial access into the network, internal reconnaissance, credential harvesting from code repositories, escalation to administrative control, abuse of software delivery pipelines, and finally the hijacking of the victim’s own cloud AI infrastructure to support further activity. One attempted step, planting a backdoor in infrastructure configuration files, was blocked by the victim’s existing branch-protection controls, Unit 42 says, which the firm cites as evidence that conventional safeguards still hold ground against AI-accelerated attackers.

Unit 42 also reports that the attacker directed an agent to compile an 80-page technical audit of the victim’s security weaknesses, a byproduct the firm frames as a preview of how thorough automated reconnaissance can now be inside a single incident.

Three findings carry the most weight for defenders, per Unit 42’s own summary. Unit 42 says agent-driven activity leaves a recognisable residue that human intrusions rarely do: structured Markdown notes passing instructions from one agent session to the next, cached Python artefacts, folders of paired assets. The investigators also found persistence layered redundantly spanning CI/CD pipelines, cloud identities, container restart policies, serverless functions and SSH keys, planted faster than any security team could realistically strip it out one item at a time. And a compromised organization’s own AI infrastructure can become the attacker’s compute, letting malicious traffic blend into expected usage while the victim pays the bill.

This is one vendor’s account of one incident, and Unit 42 sells the products it recommends in response, so its “increasingly” framing about attacker adoption of AI is a forecast, not a measured trend. The 10-hour figure and the two-week baseline it is compared against are both Unit 42’s own estimates rather than independently audited numbers. Readers should weigh the case as a documented worst case, not a representative average.

Unit 42’s own defensive recommendations center on speed matching speed: automated containment playbooks that revoke credentials and freeze pipelines simultaneously rather than sequentially, an inventory of every model endpoint, API key and MCP gateway treated as core infrastructure, and mandatory multi-party review on infrastructure-as-code repositories.

The detail Unit 42’s report leaves implicit is the budget consequence. If AI genuinely compresses a multi-week intrusion into hours, the security metric that determines outcome is no longer how many tools a team owns but how long it takes a security operations center to notice and act, meaning detection latency, not headcount or tool count, is the line item worth defending in the next budget cycle. Security teams evaluating their 2027 spend should ask whether their mean time to detect is measured in hours or in days before assuming their current stack is adequate against this kind of adversary.

Reporting based on an incident investigation published by Unit 42, Palo Alto Networks’ threat research arm, on September 2, 2026.