Skip to content
Threat Feed
Subscribe
high advisory

Autonomous Agentic AI-Driven Enterprise Intrusion

A threat actor utilized autonomous AI agents to compress weeks of manual intrusion tradecraft into a 10-hour campaign, involving API exploitation, secrets harvesting, and hijacking of CI/CD and AI infrastructure.

Unit 42 researchers identified an enterprise breach orchestrated by human actors leveraging frontier AI models and agentic AI frameworks. This operation bypassed traditional security layers in under 10 hours, a feat that would typically require approximately two weeks for human-operated red teams. The attack relied on automated loops where agents monitored, evaluated, acted, and re-planned in real time to accelerate the attack chain.

The adversary utilized LLM calls to parallelize agent operations, passed information between sessions using structured Markdown, and deployed custom scripts to manage dynamic tasks. Beyond the immediate impact, the attackers used the victim's own cloud AI infrastructure as post-compromise infrastructure, offloading operational costs while blending into expected traffic. The attackers concluded the intrusion by leaving an 80-page technical audit of the organization's security posture as a report.

Attack Chain

  1. Initial access via exploitation of a public-facing API endpoint to gain network ingress.
  2. Deployment of an automated reconnaissance agent to perform internal microservice mapping.
  3. Secrets harvesting by sub-agents scanning enterprise code repositories for hard-coded tokens and service passwords.
  4. Infiltration of the enterprise secrets management system using harvested tokens to elevate to administrative system credentials.
  5. Hijacking of CI/CD pipelines via custom workflows to exfiltrate cloud access keys and attempt backdoor injection into infrastructure-as-code configurations.
  6. Persistence establishment across SSH keys, serverless functions, container restart policies, and cloud identities.
  7. Hijacking of cloud-based AI endpoints to repurpose the victim’s compute power for future malicious operations.

Impact

The successful compromise resulted in unauthorized access to sensitive source code, master administrative credentials, and cloud-based AI infrastructure. The use of automated agents allowed the adversary to maintain persistent access across multiple environments (CI/CD, cloud identities, containers) in parallel, significantly increasing the difficulty of manual containment efforts.

Recommendation

Prioritize the following actions to defend against machine-speed agentic threats:

  • Inventory and govern AI infrastructure, including model endpoints, API keys, and Model Context Protocol (MCP) gateways; apply strict rate limits and logging.
  • Implement automated playbooks that execute synchronized containment, including credential revocation, OAuth session termination, and CI/CD pipeline freezing.
  • Enforce multi-party code reviews and immutable branch protection on infrastructure-as-code repositories to prevent automated backdoor injection.
  • Hunt for indicators of AI agent activity, specifically bursts of API requests, rapid shifts between 200/401 HTTP status codes, and presence of structured Markdown or Python cache files in unusual directories.

Immediate actions

Inventory all AI model endpoints, Model Context Protocol gateways, and API keys.

SOC 48h

Threat Hunt

Search for bursty API traffic patterns or rapid 401 to 200 HTTP status code transitions indicative of automated authentication attempts.

T1078 high high confidence hunt now

Data: Web server access logs, API gateway logs