Somewhere, a red team lead is having an existential crisis. A criminal just did in under 10 hours what their team budgets two weeks for — and then, almost politely, handed the victim a professional-grade writeup of everything they did wrong.
Fifty Attack Techniques, One Very Fast Loop
Palo Alto Networks' Unit 42 published an incident response investigation into a breach where the attacker openly admitted, during ransom negotiations, to running the entire intrusion through frontier AI models paired with attack-specific agentic frameworks. Instead of manually working through each stage of a hack, the human operator directed AI agents to monitor the network, evaluate what they found, act, and re-plan — compressing more than 50 distinct MITRE ATT&CK techniques into a single automated loop.
The agents combed source code repositories for hard-coded tokens and passwords, used those to break into the company's secrets manager, extracted root-level admin credentials, then hijacked the CI/CD pipeline to go after cloud access keys. They even tried planting backdoors in the Terraform infrastructure code — that attempt got stopped cold by branch-protection rules, which is the one genuinely good sentence in this whole story.
No Zero-Day Required — Just Speed
Here's the detail that should worry every IT director more than the AI framing does: Unit 42 says this attack used no zero-day exploit and no exotic tradecraft. Every technique was already known. The AI didn't invent new attacks, it just executed familiar ones at a pace no human team can match, and stitched them together without the coordination overhead that normally slows attackers down.
That's the real shift here. Security teams have spent years budgeting response time around human attacker speed. When the bottleneck disappears, "we'll patch it this sprint" stops being an acceptable answer — your window to catch a hard-coded secret in a repo before it's weaponized just went from weeks to hours.
The attackers left an 80-page technical audit behind; the least you can do is not need one written about you.
James here — if "we'll get to hardening the CI/CD pipeline eventually" describes your team, let's talk before an AI agent finds the gap first: webtechkitchen.com/contact.
Source: Unit 42, Palo Alto Networks