Unit 42 published an incident report this week describing a ransomware intrusion that a human attacker ran almost entirely through frontier AI agents, compressing what the firm says would normally be roughly two weeks of coordinated human tradecraft into under 10 hours. My argument is not that this is the first AI-assisted attack, it is not, but that most security programs are still measuring their own response speed against an adversary timeline that this incident shows no longer exists.
The counter-argument first
The obvious objection is that this was one incident, handled by one skilled human operator who happened to be an early adopter of agentic tooling, and that most ransomware crews are still running manual playbooks. That is fair as a statement about today’s average attacker. It is not a reason to set policy around the average attacker instead of the fastest one. Detection and response programs are built to catch the leading edge of adversary capability, not the median, because the leading edge is what eventually becomes the median. Unit 42’s own researchers, Renzon Cruz, Nicolas Bareil, Eric Semaan and Omar Jbari, wrote that “what made the attack stand out was AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft.” Nothing about the tooling used here is exotic or gated behind nation-state resourcing. It is publicly available frontier models and agent frameworks, aimed at ordinary intrusion tasks.
What actually happened
According to Unit 42, the attacker breached a public-facing API, then handed reconnaissance, credential harvesting, privilege escalation and lateral movement across cloud, identity, CI/CD and container environments to specialized agents that, in the researchers’ words, “monitored, evaluated, acted and re-planned in real time, increasing speed throughout the attack chain.” The agents pulled hardcoded secrets from code repositories, used those to reach the secrets management system, and from there obtained credentials that gave the attacker root-level control. They also hijacked the victim’s own cloud AI infrastructure to use as post-compromise tooling, effectively making the victim’s compute budget pay for the later stages of its own attack. When it was done, the attacker directed an agent to produce an 80-page technical audit of everything it had found, a courtesy no human ransomware operator has historically bothered to extend.
Media Partner
Why the old benchmarks stop working
Most incident response programs are still built around a version of the attacker that needs sleep, needs to re-orient between each pivot, and needs days to map an unfamiliar environment before doing anything destructive. Mean-time-to-detect and mean-time-to-respond figures that security teams report to boards, often expressed in days, were calibrated against that attacker. A 10-hour end-to-end compromise does not fit inside a detection cycle built to catch a multi-day one. By the time a SOC analyst has finished triaging the first alert from an automated reconnaissance agent, under the old model, the attacker is still mapping the network. Under this one, they may already hold root.
This is where the industry’s response so far has been inadequate. The prevailing advice after incidents like this has been to add more AI to the defensive side, faster detection models, automated triage, agentic SOC tooling, as though the fix is a speed match rather than a structural one. Speed matching an adversary that can spin up parallel agents at will is a race defenders cannot reliably win by adding more automation on their own side alone, because the attacker’s agents do not need change management, do not need to preserve business continuity, and do not answer to a change advisory board.
What should actually change
The more defensible response is architectural, not just faster tooling. Unit 42’s own guidance points the right direction: synchronized, pre-authorized containment playbooks that can revoke credentials, kill OAuth sessions, freeze CI/CD pipelines and isolate cloud accounts simultaneously, without waiting for a human to approve each step, because the human approval step is exactly the latency the attacker no longer has. It also means treating every AI model endpoint, API key and MCP gateway inside the organization as core infrastructure with its own inventory and least-privilege policy, not as a developer convenience bolted onto existing access controls. The pattern of attackers using agents instead of novel exploits has already shown up elsewhere this quarter, and the assumption that a system is safe because no one has automated an attack against it yet keeps failing the same way. Boards asking their security leaders for a mean-time-to-respond number should also be asking whether that number was tested against an attacker that does not sleep, does not hesitate, and does not need a change window.
Source: Unit 42, Palo Alto Networks
