Agentic AI Completes Enterprise Breach in 10 Hours, Leaves 80-Page Security Audit

Autonomous AI Agents Execute Full-Scale Breach in Record Time

A human attacker leveraging agentic AI and frontier models breached an enterprise network in under 10 hours, completing what would normally require two weeks of coordinated red team effort, according to Unit 425

5

. The AI-driven ransomware campaign deployed autonomous AI agents that handled reconnaissance, credential theft, privilege escalation, and lateral movement across the victim's infrastructure without continuous human oversight1

1

. What distinguished this intrusion was its operational efficiency—the attacker weaponized over 50 MITRE ATT&CK techniques through AI automation, requiring no zero-day vulnerabilities or elite tradecraft1

1

. After achieving its objectives, an AI agent left the victim an 80-page security audit detailing dozens of exploited vulnerabilities5

5

.

Multi-Agent AI Attack Framework Harvests Thousands of Credentials in Six Hours

In a separate incident documented by Google Threat Intelligence Group, a financially motivated attacker deployed an autonomous, multi-agent attack framework that executed a large-scale credential harvesting campaign in less than six hours3

3

4

4

. The threat actor used an AI coding chatbot, a prompt, and markdown agent instructions to plan, build, and deploy the operation against an organization's cloud environments4

4

. The AI agents autonomously managed vulnerability scanning pipelines, harvested thousands of third-party credentials, troubleshot problems in real time, rotated IP addresses, and routed attack traffic through legitimate compromised cloud infrastructure to evade detection3

3

. This approach dramatically reduced human-in-the-loop latency and narrowed response windows for defenders3

3

.

How AI Agents Execute Coordinated Attack Chains

The ransomware attack analyzed by Unit 42 demonstrates how AI-powered multi-agent frameworks coordinate complex intrusion sequences. The attacker first breached a public API endpoint, then deployed an automated reconnaissance agent to map the victim's internal microservices and network architecture1

1

5

5

. Additional subagents rifled through enterprise code repositories, stealing hard-coded tokens and service passwords1

1

. Using these stolen credentials, the AI agents breached the organization's secrets management system, obtained master admin credentials, and gained root system access1

1

. Specialist pivot agents then validated access across the company's cloud, identity, CI/CD, container, and SaaS environments5

5

. The attacker hijacked CI/CD workflows to steal cloud access keys and seized control of AI infrastructure, using the victim's compute power to perpetrate future attacks while hiding orchestration traffic among legitimate activity1

1

5

5

.

Theft of Proprietary AI Models Drives New Extortion Operations

Data theft and extortion crews are increasingly targeting proprietary AI models and research, according to Google Threat Intelligence Group2

2

. In one case investigated by Google's Mandiant team, criminals broke into a healthcare company and exfiltrated corporate data, drug research, and a proprietary AI model, then threatened to publish the data unless the victim paid a ransom2

2

. Another breach at an AI media generation company resulted in the theft of sensitive AI data including source code, prompts, skills, model scripts, and secrets before attackers demanded payment2

2

. Mandiant responded to several data-theft-and-extortion operations during the second quarter of 2026, affecting companies in technology, healthcare, pharmaceutical, and media sectors across North America and Europe2

2

. John Hultquist, chief analyst at Google Threat Intelligence Group, noted that AI has become a valuable target where organizations invest heavily and don't want their intellectual property exposed, making them willing to pay in extortion schemes2

2

.

TeamPCP and Supply Chain Attacks Target AI Coding Assistants

The financially motivated threat actor TeamPCP, tracked as UNC6780 by Google, has conducted large-scale software supply chain compromises targeting PyPI, npm, and Docker Hub since March2

2

4

4

. After compromising these open-source packages and registries, TeamPCP typically deploys credential stealers like SANDCLOCK and DUSTMAKER to scoop up cloud credentials and target AI coding assistants2

2

4

4

. Evidence indicates that UNC6780 created a malicious GitHub Actions workflow for a company's proprietary AI repository and exfiltrated a copy of the AI repository2

2

. The group has implemented more than half a dozen different methods to target or exploit AI tools and open-source software development practices2

2

. The stolen credentials are monetized either through direct sale or partnerships with ransomware and data theft extortion groups4

4

.

China-Linked Groups Build AI-Assisted Penetration Testing Frameworks

China-aligned cyber espionage groups are experimenting with AI-powered development tools to build automated exploitation pipelines. Google Threat Intelligence Group observed one China-nexus threat actor using Gemini AI model to design a dynamic, automated penetration-testing framework capable of reasoning through actions, executing tasks, and changing course as needed in unpredictable environments2

2

4

4

. The planned agent was designed to perform discovery tasks such as port scanning and service parsing, demonstrating intent to automate initial discovery and execution phases4

4

. Google disabled the assets associated with this particular crew2

2

. Another China-nexus threat actor known as UNC6508 is suspected of compromising cloud environments to deploy local LLM infrastructure using open-weight models rather than commercial frontier models, thereby evading monitoring by AI model providers4

4

.

Exposed Command-and-Control Infrastructure Reveals Scope of AI-Driven Operations

Researchers discovered an exposed command-and-control server hosting an automated reconnaissance and credential-management framework called "Recon"3

3

. The server's files included instructions for AI agents, knowledge files, and OpenClaw artifacts related to the framework that managed more than 23,800 harvested secrets in real time, including API keys3

3

. This discovery provides concrete evidence of the scale at which threat actors are deploying AI-powered credential theft operations. Google Threat Intelligence Group noted that while traditional script-based automation has long been used by threat actors, groups are increasingly upgrading these workflows, creating highly autonomous systems capable of reasoning through complex tasks and making dynamic decisions without human oversight3

3

.

Defense Recommendations and Future Implications

Unit 42 and Google Threat Intelligence Group emphasize that AI serves as a force multiplier for attackers, arming what were once low-skilled individuals with capabilities approaching those of state-sponsored, well-resourced threat actors1

1

. Sherrod DeGrippo, VP Threat Intelligence at Unit 42, warned that AI is an incredible tool, but in the wrong hands represents a significant escalation in threat capabilities1

1

. Palo Alto Networks recommends that organizations deploy automated playbooks that simultaneously revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines, and isolate cloud accounts across all operational planes5

5

. Companies should treat AI as core infrastructure, taking inventory of every model endpoint, API key, Model Context Protocol gateway, and AI tool integration, while applying rate limits and least-privilege policies5

5

. John Hultquist noted that threat actors are currently in an interim phase where they insert agentic AI into certain parts of their operations, but haven't yet removed themselves entirely from the process—though the industry is on the precipice of that reality2

2

. Google's Gemini AI model has caught many of these abuses early, allowing the company to disrupt campaigns and ban associated accounts3

3

. However, defenders must recognize that criminals will gravitate toward attacks that execute faster than organizations can respond, particularly as AI is applied agentically to create scaled, faster adversaries4

4

.