TL;DR
Unit 42 published an investigation on 2 September into an intrusion in which a human attacker used AI agents to run, in under ten hours, work it estimates would normally take multiple red teams around two weeks — more than 50 MITRE ATT&CK techniques, ending with the victim’s own AI endpoints turned into attack infrastructure. The report states the attack stood out for its AI-assisted operational efficiency “without the need for a novel zero-day or super elite tradecraft,” and Unit 42 corrected the piece on 3 September to say this was an intrusion rather than a ransomware attack, after the ransomware framing had circulated. The consequence for anyone running security: controls calibrated to human attacker speed are now mis-set, and the control that actually stopped part of this attack was branch protection on infrastructure-as-code. The uncertainty: the AI attribution originates with the attacker’s own account during negotiation, corroborated by observed indicators, with no model named.
In plain English
Agentic AI — AI that runs a multi-step task on its own, deciding what to do next based on what just happened, rather than answering one question at a time.
MITRE ATT&CK — a public catalogue of known attacker techniques. A technique listed in it is documented and already known to defenders.
Zero-day — a vulnerability nobody has patched, because nobody outside the attacker knows it exists. This attack did not use one.
Secrets manager — the system holding an organisation’s passwords, tokens and keys.
CI/CD pipeline — the automated process that builds and deploys code.
Branch protection — a repository setting that blocks changes to important code unless review rules are satisfied. It is the control that stopped part of this attack.
Infrastructure as code — managing servers and cloud resources through configuration files, such as Terraform, which means live infrastructure can be changed by editing a file.
Least privilege — giving each account or key only the access it needs, so a stolen credential opens less.
At the foot of Unit 42’s report on an AI-assisted network intrusion, published on 2 September, sits a line added the next morning:
Updated Sept. 3, 2026, at 5:25 a.m. PT to clarify that the attack was an intrusion, and not a ransomware attack.
By then the story had already travelled as agentic ransomware. Unit 42’s own title is An AI-Assisted Cyber Attack, and its first sentence describes “a human attacker” who “used frontier AI to breach an enterprise network autonomously as part of a ransom attack.”
Worth being precise about what the correction does and does not say, because I have seen it read both ways today. Extortion was involved — the report refers to negotiations with the threat actor. What Unit 42 removed was ransomware: the encrypting payload that gives the word its meaning. An extortion intrusion and a ransomware attack are different things, and only one of them was reported all week.
The incident itself is real and worth understanding, so let me separate it from its coverage.
An attacker breached a public API endpoint, then ran the rest through AI agents. A recon agent mapped internal microservices. Sub-agents combed enterprise code repositories for hard-coded tokens and service passwords. Those tokens opened the secrets management system, which yielded master administrative credentials and root access. From there the attacker hijacked a code application through custom workflows to exfiltrate cloud access keys, and finally turned the victim’s own AI endpoints into post-compromise infrastructure. Unit 42 notes this let them “hide orchestration traffic among expected traffic, and offload the financial cost onto the victim.”
Unit 42 counts more than 50 MITRE ATT&CK techniques across that chain, in under ten hours. Its comparison is that the same work would represent “a coordinated effort from multiple red teams, which would normally take human operators around two weeks” — that estimate describes several teams working together, not one attacker’s fortnight.
Then this, word for word:
What made the attack stand out was AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft.
No new vulnerability. Nothing exotic. More than 50 MITRE techniques means more than 50 techniques already catalogued and published — the playbook was public, and a competent human could have run every step. The agents cut the delay between each step. Unit 42 describes the mechanism plainly: the agents were “designed to parse raw tool output and quickly take next steps.”
The techniques were ordinary. The agents just did them faster. I would not put a multiplier on it, because Unit 42 gives “around two weeks” against “less than 10 hours” without saying whether the two weeks is calendar time or working time, and those produce very different ratios. The two figures stand on their own.
That distinction matters, because it changes what you should do about it. The ransomware framing is worth correcting for that reason. If the story is that AI has invented new attacks, the sensible response is to wait for someone to sell you a defence. If the story is that known attacks now finish in hours, the response is that every control calibrated to human attacker speed is currently mis-set — and that is something you can go and inspect this afternoon.
An on-call rotation that assumes someone notices lateral movement within a shift. Credential rotation windows measured in days. A CI/CD approval gate that waits for a reviewer who is not currently working. Detection thresholds tuned to tolerate normal peak traffic. All of those were reasonable against an intrusion that unfolded over days. None of them survive one that finishes in under ten hours.
One detail in the attack chain matters more than any of this framing. After the attacker had already taken master administrative credentials, they attempted to plant backdoors in the victim’s Terraform configurations and failed, because — in Unit 42’s words — “hard branch-protection controls stopped this.” Branch protection is not an AI defence. It is a free, long-standing setting that most repositories can switch on from a settings page, and it held against an attacker who already had root, because it does not require a person to be available to approve anything.
The AI attribution deserves one more look, because of where it originates. Unit 42 says: “The threat actor told us in negotiations that they leveraged frontier AI models and attack-specific agentic AI frameworks.” That is the criminal’s own account of their tooling, offered during a negotiation, to the firm investigating them. Unit 42 corroborates it with observed indicators — LLM calls to multiple frontier AI agents in parallel, structured Markdown files passing information between agents and sessions, and custom scripts it assesses with high confidence to be AI-generated. But the claim starts with the attacker, and the report describes “frontier AI models” without naming one. It does not attribute this to any particular lab’s model, and neither should anyone else.
Unit 42’s diagram caption is the most careful description of the arrangement: “The actor sets objectives and makes consequential decisions. Specialized agents execute, share results and adapt in real time.” A person set the objectives and made the decisions. The agents carried out the steps.
The defensive advice in the report is unglamorous and worth following in full. Inventory every model endpoint, API key, MCP gateway and AI tool integration, and apply rate limits, least privilege and diagnostic logging to them as you would any production credential — the attack’s final move only works if nobody is watching those endpoints. Hunt for what Unit 42 calls operational loops: “bursty API requests, rapid 401/200 HTTP state shifts, parallel authentications and sudden model usage from unexpected identities.” Build containment playbooks that revoke credentials, terminate OAuth sessions, freeze pipelines and isolate cloud accounts simultaneously, because doing those one after another takes longer than an automated attack needs to move on. Enforce multi-party code review and immutable branch protection across infrastructure-as-code.
There is one genuinely useful thing the agents left behind. Unit 42 says defenders can identify agentic attacks “by watching for indicators such as the use of structured Markdown, Python caches and paired asset folders.” Agent frameworks write their working notes to disk, so the same agent framework that let the attacker skip pauses between steps also wrote log files defenders can search.
The attacker also directed the agent to leave the victim an 80-page technical audit of the security posture it had just exploited. It is the detail everyone will remember, and it changes nothing about what to do on Monday. What to do on Monday is check whether anything you rely on assumes an attacker needs a fortnight.