AI Agents Compress Two-Week Cyber Attack Into 10 Hours

A human attacker used a coordinated team of frontier AI agents to breach an enterprise network in under 10 hours, a process that typically takes human operators approximately two weeks. This shift toward AI-driven orchestration allows adversaries to execute complex breaches with a speed and scale previously reserved for large, professional red teams.

According to researchers from Palo Alto Networks' Unit 42, the attacker did not rely on novel zero-day vulnerabilities. Instead, the agents systematically exploited common security gaps, including an exposed public API endpoint, exposed tokens, and hardcoded credentials found within code repositories. Once inside, the attacker seized root access and hijacked CI/CD pipelines. In a notable turn of irony, the adversary repurposed the victim's own AI infrastructure to provide the compute power necessary for further movements within the network. The breach concluded with the attacker leaving behind a detailed technical report outlining the organization's security weaknesses.

The Shift to AI Orchestration

While AI has long been used to automate isolated tasks—such as drafting phishing emails or generating simple scripts—this incident represents a fundamental shift toward orchestration. In this model, the human attacker functions as a manager who sets high-level objectives, while specialized AI agents work in parallel to monitor the environment, evaluate results, and re-plan the attack in real-time.

Unit 42 researchers noted that the operational workflow relied on LLM calls to multiple agents, using structured markdown files for inter-agent communication and AI-generated custom scripts. This automated workflow effectively turned the hacking process into a high-velocity assembly line. The intelligence of the attack lay in the coordination rather than the exploitation; the agents simply moved through existing exposures faster and more systematically than any human could.

Implications for Enterprise Defense

This breach demonstrates that AI agents can dramatically increase the velocity of an attack without needing to discover new vulnerabilities. For the industry, this means the traditional window for detection and response has effectively collapsed. When a two-week operation is compressed into a single workday, periodic security audits and manual response playbooks become obsolete.

To counter 'machine-speed' adversaries, enterprises must transition toward continuous monitoring and automated containment. This includes implementing short-lived credentials to limit the utility of stolen tokens and deploying AI-driven defenses capable of reacting at the same speed as the attacker. The ability of AI to synthesize data and execute moves in parallel means that any static defense is now a liability.

What's Next

Security teams are now tasked with identifying the specific indicators of AI-orchestrated attacks, such as the structured markdown and Python caches left behind in this incident. While the tools used in this breach were frontier AI agents, the industry is watching to see if similar orchestration frameworks will be open-sourced or sold as services on the dark web, potentially democratizing high-velocity attacks for less skilled actors.