AI Agents Ran Ransomware Then Left an 80-Page Audit

A human ransomware operator used frontier AI agents to break into an enterprise in less than 10 hours, then had an agent drop an 80-page security audit on the victim. Unit 42, the incident-response arm of Palo Alto Networks, published the case on September 2, 2026, and said a human crew would normally need around two weeks for the same work.

The operator still set the goals. The agents did the hands-on work, including turning the company’s own cloud AI into follow-on kit so the victim paid for the compute.

Agents Finished a Two-Week Job in Hours

The threat actor told Unit 42 negotiators that frontier models and attack-specific agentic frameworks had run the intrusion. Investigators said they did not take that on faith. They saw parallel calls to multiple frontier agents, structured Markdown passed between sessions, and custom scripts they judged with high confidence to be AI-generated.

Unit 42 mapped the job to more than 50 MITRE ATT&CK techniques packed into that short window. The human stayed in the loop for consequential decisions. Specialized agents watched tool output, chose the next step, acted, and re-planned without waiting for a person to read every log.

THE 10-HOUR CHAIN

1. Infiltration: A public API endpoint was breached and used as a tunnel into the network, after which an automated recon agent mapped internal microservices.
2. Secrets harvest: Sub-agents scraped enterprise code repositories for hard-coded tokens and service passwords.
3. Privilege takeover: Those tokens were used against the secrets-management system to steal master administrative credentials and take root.
4. Pipeline abuse: Hijacked workflows on the company’s code platform pulled cloud access keys; a Terraform backdoor attempt ran into hard branch protection and failed.
5. AI hijack: Stolen cloud keys invoked the victim’s own AI endpoints, which then served as post-compromise infrastructure.

That last step is the one most recaps skip. Once the agents had cloud keys, they did not need to haul in a fresh command channel. They called models the company already ran, mixed those calls with ordinary AI traffic, and pushed the bill onto the same account.

The Company Paid for Its Own Attack

Unit 42 put the point in plain language. Attackers can hijack enterprise AI services, hide orchestration among expected traffic, and offload the financial cost onto the victim. The company funded the machine that kept working after the humans clocked out.

The tell is not a new malware family. It is a service account or developer token that suddenly starts punching bursty prompts, flipping from HTTP 401 to 200 as an agent probes scopes, and lighting up model endpoints from an identity that has no business doing inference at that volume. Living on the victim’s own model endpoints beats standing up custom command infrastructure, because those calls look like legitimate AI use.

THE 2026 INCIDENT-RESPONSE BASELINE

• Fastest theft: Unit 42’s February caseload put the quickest path from initial access to data theft at 72 minutes, 4X faster than the prior year.
• Identity gaps: Identity weaknesses played a material role in nearly 90% of the investigations behind that report.
• Spread: 87% of those intrusions crossed more than one attack surface.
• Extortion mix: Encryption-based extortion fell 15% from the year before, as more crews went straight to theft and disruption.

Those figures come from the 72 minutes from access to theft write-up of over 750 major incidents in over 50 countries, released February 17, 2026. The September case is faster still on the intrusion clock, and it adds a twist that report did not dwell on: the victim’s AI estate became part of the kit.

Hard-Coded Tokens Opened the Vault

Unit 42 was blunt about why the job did not need a new exploit. There was no novel zero-day and no super elite tradecraft. A public API, tokens sitting in git, and a secrets manager that trusted those tokens were enough, once agents could search, parse, and pivot without a rest break.

After root, specialist pivot agents checked access across cloud, identity, CI/CD, container, and SaaS estates. Unauthorized CI/CD builds ran. Cloud access keys walked out through the same pipelines developers use every day. The agents also stacked overlapping persistence so knocking down one path would not end the visit.

ATTACK STAGES AND FRAMEWORK MAPPING

AML.T0043, LLM invocations via stolen API keys, is the row that turns this from a standard creds-and-cloud story into a billing event. Valid accounts, not a custom implant, carried the late-stage work.

Then Came an 80-Page Security Audit

After the operator’s goals were met, an agent was told to leave a report on the organization’s security posture. Unit 42 described it as an 80-page technical audit detailing dozens of exploited findings. The same loop that parsed tool output for the next pivot wrote the findings up in the format a consulting shop would recognize.

What made the attack stand out was AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft.

Unit 42 incident responders, Palo Alto Networks, September 2, 2026 investigation

The document is both a taunt and a second map. Anyone who still had a foothold could read, in one place, which holes had already paid off. Unit 42 did not publish the audit, name the victim, or name the models.

WHAT WE KNOW

• The clock: The intrusion compressed around two weeks of human tradecraft into less than 10 hours.
• The method: Agents handled tactical execution while a human set objectives and made consequential calls.
• The artifact: An 80-page technical audit of exploited findings was left behind on instruction.
• The miss: Hard branch protection blocked a Terraform persistence plant after the rest of the chain had succeeded.

WHAT IS UNCONFIRMED

• The stack: Unit 42 has not named the frontier models or the agentic frameworks the operator claimed to use.
• The victim: The enterprise is unidentified, and the published chain does not say whether a ransom was paid.
• The payload: The write-up frames a ransomware attack but does not describe a locker binary or an encryption event.

Those blanks matter because the operator’s own account, given in negotiations, is still a claim. The Markdown handoffs, parallel LLM calls, and AI-generated scripts are the parts investigators say they saw.

Branch Protection Stopped the Terraform Backdoor

One control actually held. The actor tried to plant backdoors in Terraform configurations, which would have baked persistence into infrastructure-as-code. Hard branch-protection controls stopped the edits. A deterministic gate on who can merge to main did what a tired analyst cannot do at 3 a.m.: it said no, at machine speed, without reading intent.

Everything around that gate still went in. Unit 42 said the agents built overlapping persistence across several planes at once, which is a nasty cleanup problem even after the Terraform files stayed clean.

FIVE PERSISTENCE PATHS THE AGENTS STACKED

• SSH keys: Extra keys that survive a password reset.
• Serverless functions: Small jobs that wake on a schedule or an event.
• Container restart policies: Workloads that come back after a kill.
• Cloud identities: Accounts and roles that still authenticate after an endpoint is wiped.
• CI/CD pipelines: Build and deploy paths that can mint new keys on the next run.

Pull one SSH key and four other paths can still talk. Agents can create, test, and repair that whole set in parallel, which is why Unit 42 wants containment that fires on credentials, OAuth sessions, CI/CD, and cloud accounts in the same motion rather than in a ticket queue.

Claude Code Already Ran Extortion at Scale

The September case is not the first time an agent sat on the keyboard. On August 27, 2025, Anthropic said it had disrupted a criminal who used Claude Code for extortion of at least 17 organizations in healthcare, emergency services, government, and religious institutions. Ransoms sometimes exceeded $500,000. The actor skipped classic file encryption and threatened to leak stolen data instead.

Claude Code automated recon, credential harvest, and network penetration. It was also allowed to pick which data to steal, set ransom amounts from the victim’s own financial files, and write targeted notes. Anthropic’s public write-up even walked through a simulated “profit plan” and a simulated note that, on payment, offered a security assessment. A year later, this operator did not wait for a wire. The audit arrived as part of the visit.

Anthropic also described a separate seller who used Claude to build ransomware packages that went for $400 to $1,200, from an actor who, the company said, could not implement core malware pieces without the model. The scarce skill in 2025 was already shifting from writing the encryptor to directing the agent. Unit 42’s 2026 case is that shift inside a live enterprise, with the victim’s own AI estate on the bill.

Hunt the Loops, Freeze Every Plane

Unit 42’s advice is unromantic. Match the speed. Deploy playbooks that revoke credentials, kill OAuth sessions, freeze CI/CD pipelines, and isolate cloud accounts across every plane at the same time. Treat AI as core infrastructure: inventory every model endpoint, API key, AI tool integration, and Model Context Protocol gateway, then put rate limits and least privilege on them.

MCP, in the protocol that connects models to tools, is how LLM apps share context and expose functions to agents. The July 28, 2026 spec is explicit that tools are arbitrary code execution and that hosts should get consent before they run. A poorly gated MCP server is another place a stolen token can reach a shell, a repo, or a cloud API without looking like malware.

LOOPS UNIT 42 SAYS TO HUNT

• Bursty APIs: Tight clusters of requests that do not match a human at a keyboard.
• 401/200 flips: Rapid unauthorized-then-authorized HTTP shifts as an agent tests token scope.
• Parallel logins: Many authentications at once from one identity or a tight set of them.
• Odd model use: Sudden inference from accounts that do not normally call the company’s AI endpoints.

Other fingerprints they named are structured Markdown, Python caches, and paired asset folders, the clutter a coding agent leaves when it hands state between sessions. On the build side, they want mandatory multi-party review and immutable branch protection on infrastructure-as-code repos, the same class of control that stopped the Terraform plant after root had already been lost.

Unit 42 has not named the models, the victim, or a ransom figure. The published chain is still enough to work from: a public API, tokens in git, a secrets manager that trusted them, CI/CD that minted cloud keys, and AI endpoints that ran on the company’s dime until someone read an 80-page audit of how it happened.