AI-driven ransomware intrusion escalation

Researchers at Palo Alto Networks’ Unit 42 identified a ransomware intrusion where attackers utilized AI agents to accelerate network movement. The intrusion was completed in under 10 hours, a process estimated to take human operators approximately two weeks to perform manually. The attack involved over 50 techniques, using frontier AI models and agentic frameworks to conduct reconnaissance, search source-code repositories for credentials, and hijack enterprise code applications to exfiltrate cloud access keys.

Further details revealed that the attack began by compromising a publicly accessible API. Specialized AI agents worked in parallel to map internal microservices and search for embedded tokens, allowing the attacker to gain root access and move into cloud environments. In a notable development, the attacker repurposed the victim company’s own cloud AI services to provide the computational resources for the attack, masking malicious traffic as legitimate activity.

The breach demonstrated high operational efficiency through an “observe-decide-execute-replan” loop. In a highly unusual move, the attacker used a specific AI agent to document the security flaws discovered during the breach, leaving behind an 80-page technical report detailing dozens of vulnerabilities.