TL;DR

Palo Alto’s Unit 42 has documented an intrusion where a human criminal delegated the entire operation to AI agents, compromising an enterprise network in under ten hours — work its responders put at roughly a fortnight by hand. On the way out, an agent left an 80-page assessment of the victim’s security failings.

What the agents actually did

The chain reads like a competent penetration test executed at machine pace. Agents ran reconnaissance, then the intruder tunnelled in through an exposed API endpoint. Inside, an automated agent mapped the internal microservices while others combed source repositories for credentials that developers had left in the code. Those keys opened the organisation’s secrets store, which yielded master administrative access and root over the estate.

From there, what the report calls “specialist pivot agents” confirmed reach into cloud, identity, container, SaaS and build-pipeline environments. The attacker then subverted the CI/CD workflows to lift cloud keys and repurpose the victim’s own AI services as attack infrastructure — burning the target’s compute while orchestration traffic hid among legitimate activity.

Unit 42’s framing is the part worth quoting: what stood out was “AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft”. The attacker left tactical decisions to agents that “monitored, evaluated, acted and re-planned in real time”. No exotic vulnerability was required. Speed was the weapon.

What defenders are told to do

Palo Alto’s prescription is unsurprising from a vendor but not therefore wrong: match machine speed with automated response — playbooks that isolate cloud accounts, freeze the build pipelines, kill OAuth sessions and revoke credentials all at once, rather than one after another.

The second recommendation is the one UK firms can act on this week without buying anything. Treat AI as infrastructure: inventory the tool integrations first, then the MCP gateways, the keys issued against each API, and every endpoint a model can be reached on — then apply least privilege and rate limits. Organisations that cannot list these assets cannot defend them — and the shortfall is widespread, with 88% of UK executives believing unapproved AI is already running inside their business.

Looking forward

This is the incident the market has been pricing for. Insurers began rewriting cyber cover for agents that exceed instructions last week, and OpenAI has said its next model can find zero-days unaided. The uncomfortable detail here is that none of that capability was needed. Ordinary tradecraft, automated, was sufficient.