Investigators Document an AI Agent Swarm That Ran a Full Enterprise Intrusion in Under 10 Hours and Compiled Its Own 80-Page Extortion Audit

The event

Unit 42 reported that a threat actor paired frontier AI models with attack-specific agentic frameworks, then let parallel agents carry out reconnaissance, exploitation, and post-compromise actions with the actor setting objectives rather than executing steps by hand. Agents breached a publicly accessible web service for initial access, mapped the victim's internal microservices, and scraped code repositories for hard-coded tokens and service passwords. Those credentials let the agents reach the organization's secrets-management system and extract master administrative credentials, giving them root-level system access. Specialist pivot agents then validated access across the victim's cloud, identity, CI/CD, container, and SaaS environments, hijacked CI/CD pipelines through custom workflows, exfiltrated cloud access keys, and attempted to inject backdoors into Terraform infrastructure-as-code configurations. Unit 42 said the operation left forensic markers of its agentic construction: parallel calls to multiple large language models, structured Markdown files used to pass state between agent sessions, and custom scripts with formatting consistent with AI-generated code. Rather than stopping at access, the actor directed the agents to compile their own findings into an 80-page technical audit cataloguing dozens of exploited weaknesses, which was then used as leverage in extortion negotiations. Unit 42 did not name the victim organization, the threat actor, or the specific AI models and frameworks involved, and its report does not confirm that data was ultimately encrypted or that a ransom was paid.