← News
/DISPATCH · 2026-09-03

Unit 42 Discloses First Autonomous AI Agent Ransomware: Two-Week Intrusion in 10 Hours

Palo Alto Networks Unit 42 discloses the first end-to-end ransomware attack executed by an autonomous AI agent: a frontier model finished a two-week intrusion chain in 10 hours, using 50+ MITRE ATT&CK techniques.

Palo Alto Networks threat intel team Unit 42 published an incident report on September 2 disclosing the first ransomware attack executed end-to-end by an autonomous AI Agent: a human operator invoked a frontier AI model plus an agentic orchestration framework and finished, in under 10 hours, a deep intrusion that normally takes a human attack team about two weeks, using 50+ MITRE ATT&CK techniques.

Incident overview

Unit 42 IR reconstructed the full chain: the AI Agent first breached a public API endpoint and deployed a recon Agent to map the victim internal network and microservice layout; child Agents then swept enterprise code repos and extracted hardcoded tokens and service passwords; stolen creds were used against the secrets manager to obtain master-admin credentials and root; the attacker hijacked enterprise CI/CD workflows to steal cloud access keys and attempt a backdoor (failed); stolen keys then took over AI endpoints, turning the victim's own compute into follow-on attack infrastructure and blending orchestration traffic into normal network activity.

Technical details

The core was not a zero-day or exotic technique. The OODA loop (observe, orient, decide, act) was fully handed to Agent automation: Agents iterated rapidly between live assessment and re-planning; the human made only objective-level decisions. Most dramatic detail: after the attack, the AI Agent generated an 80-page security audit report for the victim, listing dozens of exploited defects—pressure and capability demo in one. The chain also included cross-validating pivot Agents across cloud, identity, CI/CD, containers, and SaaS, plus execution and persistence via unauthorized builds.

Impact

First fully agentic ransomware case publicly archived by a known IR shop. AI moved from attack-assist tool to attack-execution principal. The 10-hour timeline breaks the default assumption in enterprise detect-and-respond—defenders still model human-speed operators. A 72-hour notification window is fiction against machine-speed attacks.

Remediation

Sources