An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
A Unit 42 investigation revealed an attack where a human attacker leveraged frontier AI to autonomously breach an enterprise network and conduct a sophisticated ransomware operation in under 10 hours. The attacker utilized AI agents to map the network, steal credentials, hijack CI/CD pipelines, and ultimately weaponize the victim’s AI infrastructure. This demonstrates a growing trend of attackers incorporating AI to accelerate their attack cycles and highlights the need for organizations to proactively defend against these increasingly automated threats.
Unit 42 responded to an incident where a human attacker utilized frontier AI to breach an enterprise network autonomously as part of a ransomware attack. The attack, completed in under 10 hours, showcased a significant shift in attacker methodology, moving beyond traditional tradecraft to incorporate AI-powered automation. The attacker employed AI agents to map the internal architecture, raid source repositories and seize root credentials, effectively compressing weeks of methodical intrusion tradecraft into a remarkably short timeframe.
This incident exposed how an attacker who understands how to deploy frontier AI agents effectively can dramatically speed up the pace of their attack. The attacker used AI agents to parse raw tool output and quickly take next steps, speeding up the overall attack flow. The attacker also left behind a ‘report’ on the organization’s security posture: an 80-page, technical audit detailing dozens of exploited findings.
The 10-hour operational timeline included the following: Infiltration and mapping: The actor breached a public API endpoint to tunnel into the network, deploying an automated recon agent to map internal microservices. Secrets harvesting: Sub-agents combed enterprise code repositories, extracting hard-coded tokens and service passwords. Privilege takeover: Using exposed tokens, the actor infiltrated the secrets management system, harvesting master administrative credentials to seize control of root system access. Pipeline exploitation: The actor hijacked an enterprise code application via custom workflows to exfiltrate cloud access keys. They attempted to plant backdoors in Terraform configurations, but hard branch-protection controls stopped this. AI infrastructure hijacking: Using stolen cloud keys, the actor turned the victim’s AI endpoints into post-compromise infrastructure — using the company’s compute power to perpetrate future moves.
For illustration, Table 1 below maps some of the techniques used against the MITRE ATT&CK and ATLAS frameworks:
Table 1. Major MITRE ATT&CK and MITRE ATLAS techniques used by the attacker.
Defending against automated agent loops requires matching the speed and adaptability of AI-driven attacks: Execute synchronized containment: Deploy automated playbooks that simultaneously revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines and isolate cloud accounts across all operational planes. Govern AI as core infrastructure: Inventory every model endpoint, API key, Model Context Protocol (MCP) gateway and AI tool integration. Apply strict rate limits, least-privilege policies and diagnostic logging. Detect behavioral loops: Hunt for operational loops including bursty API requests, rapid 401/200 HTTP state shifts, parallel authentications and sudden model usage from unexpected identities. Lock down DevOps pipelines: Enforce mandatory, multi-party code reviews and immutable branch protection on all infrastructure-as-code repos to block automated backdoor injection.