Agentic AI Wiki
AI Blog / Ten hours, fifty techniques, no zero-days — the clock was the vulnerability
AI Blog

Ten hours, fifty techniques, no zero-days — the clock was the vulnerability

Unit 42 published an intrusion that ran cloud, identity, CI/CD and SaaS in under ten hours using more than fifty documented ATT&CK techniques and no zero-day, then had a documentation agent write the victim an 80-page audit. Nothing in the tradecraft was new; the response clock is what broke. Containment that waits for a human decision chain is now the control that fails.

By Agentic AI Wiki 12 min read

The most alarming line in Unit 42's account of a ten-hour enterprise breach is not the ten hours — it is that the attacker used more than fifty documented ATT&CK techniques and not one zero-day. Nothing in the tradecraft was new; what changed is that all of it executed faster than the meeting in which somebody decides to revoke a credential. If your security programme was sized against a dwell time measured in days, the thing that just broke is your response clock, and no additional detector fixes a clock.

What was reported

Palo Alto Networks' Unit 42 published the investigation on 2 September 2026, with updates over the following two days. A human ransomware operator, who described their tooling during the ransom negotiation, drove frontier models through attack-specific agentic frameworks and left tactical execution to the agents: they monitored, evaluated, acted and re-planned in real time. Sub-agents combed source repositories for hard-coded tokens and service passwords; a separate agent reached the organisation's secrets management system and took master administrative credentials; the pipeline was used to trigger unauthorised CI/CD builds and emit cloud access keys; the victim's own cloud AI infrastructure was claimed and reused as post-compromise infrastructure. Then a documentation agent wrote the victim an 80-page technical security audit of everything it had exploited.

What was observedThe obvious readingWhat it actually tells you
Under 10 hours end to end AI made attackers faster Your containment SLO is now longer than the whole intrusion
50+ ATT&CK techniques, no zero-day Unsophisticated, then Every control was satisfied rather than bypassed
Repos → secrets manager → CI/CD → cloud keys A lateral movement chain A chain of standing privileges you granted somebody permanently
An 80-page audit of the victim's weaknesses Taunting The attacker finished with a better asset inventory than the defender has
The privilege chain the agents walked, stage by stage A left-to-right chain of six stages. Initial access leads to source repositories, where sub-agents harvest hard-coded tokens and service passwords. Those reach the secrets management system, from which master administrative credentials are taken. Those authorise unauthorised CI/CD builds, which yield cloud access keys, which grant master keys to the victim's cloud AI infrastructure — reused as post-compromise infrastructure. A band beneath the chain notes that every link is an authorised use of a standing credential, that more than fifty documented ATT and CK techniques were used, and that no zero-day exploit appears anywhere in the chain. Six links, every one an authorised use of a standing credential Initial access No zero-day. Known technique. Source repositories Sub-agents harvest hard-coded tokens. Secrets manager Master administrative credentials taken. CI/CD pipeline Unauthorised builds trigger; keys emitted. Cloud AI infrastructure Master keys claimed; reused to mask activity. What fired in the SOC at each link Nothing that distinguished it from ordinary automation: a credential in use is a credential in use, and a pipeline build is a pipeline build. What the attacker supplied Frontier models plus attack-specific agentic frameworks, monitoring, evaluating, acting and re-planning in real time. More than fifty documented ATT&CK techniques. What the attacker did not need A zero-day. Novel malware. Elite tradecraft. A privilege the environment did not already grant to somebody, standing, all the time. Elapsed: under ten hours from initial access to impact Unit 42 estimates the same chain would take a coordinated human red team roughly two weeks. The techniques did not change. The clock did.
Every link is an authorised use of a credential that was standing there before the attacker arrived. The agents did not defeat the chain; they walked it at machine speed.

The absence of a zero-day is the finding

Reporting on this story keeps reaching for the ten hours, which is the number that photographs well. The load-bearing detail is the one underneath it: no novel exploit, no elite tradecraft, nothing that a well-resourced human team could not have done. That means the attack tells you almost nothing new about attacker capability and almost everything about the assumption your controls were tuned against.

Detection, triage, escalation and containment are all budgeted in units of time, and the budget is set by how long you believe an intruder will be inside before doing irreversible damage. An enterprise that can revoke credentials and freeze a pipeline within a day has bought real protection against a two-week intrusion and none at all against a ten-hour one. The techniques did not get past the controls; they finished before the controls' response path did.

Hours from initial access to full compromise A horizontal bar chart on a scale of zero to 360 hours. A coordinated human red team performing the same work is estimated by Unit 42 at roughly two weeks, about 336 hours, drawn as the longest bar. A twenty-four hour containment target, shown as a reader's own variable rather than a measured figure, is a short bar of 24 hours. The observed intrusion is under ten hours, the shortest bar and highlighted in the accent colour. The chart shows that the attacker's clock now runs shorter than a common containment target. Hours from initial access to full compromise Coordinated human red team Unit 42's estimate for the same work ≈336h A 24-hour containment target your variable, not a measured figure 24h The observed intrusion agent-executed, no zero-day <10h 0 90 180 270 360 hours The two measured bars come from the Unit 42 investigation: the intrusion ran in under ten hours, against an estimate of roughly two weeks for a coordinated human team doing the same work. The middle bar is a target you set, drawn to scale for comparison.
Two measured bars and one you set yourself. If the middle bar is longer than the bottom one, the response path is not a control — it is a formality that completes after the incident.

This is also why "the agents were doing what a human would do, just faster" is not the reassurance it sounds like. Speed converts a detectable sequence into an undetectable one, because detection is only useful if something happens between the alert and the impact. Compress the interval far enough and a mature SOC becomes a very good forensics team.

The 80-page audit is the part worth stealing

The documentation agent reads as theatre — an extortion flourish, a way to make the ransom note credible. Look past the motive and it is a measurement. In a few hours, on an environment the attacker had never seen before, an agent produced a technically accurate, complete inventory of exploitable weaknesses across cloud, identity, CI/CD and SaaS. Most defenders cannot produce that document about their own estate, and the ones who can pay a consultancy for it annually and receive it six weeks after the fieldwork.

That asymmetry is not about model capability, it is about who is willing to run the enumeration. The attacker had no change-advisory board, no maintenance window, no ticket asking why the scan touched production. You have credentials they had to steal and permission they never sought — and the same class of tooling is available to you legitimately. The reproducible finding in this report is that agent-driven enumeration of a live enterprise estate now works well enough to write eighty defensible pages, which means it works well enough to feed your own remediation backlog.

Do it as a read-only exercise with scoped credentials, an approved window and an egress allowlist — the same discipline any internal agent needs. The output you want is not a score; it is the ordered list of standing privileges that chain, which is exactly what the attacker's document contained.

What actually changes the outcome

Three responses to a ten-hour intrusion, and what each one actually buys Three columns. Pre-authorised containment lets a defined signal revoke credentials, freeze pipelines and cut egress without a human decision chain; it removes the meeting from the critical path but risks a false containment. Ending standing master credentials shortens the privilege chain itself so a stolen token expires before it is useful; it is slow to implement and breaks brittle automation. Buying a better detector adds another content classifier at the front; it does not change the response clock, which is the constraint that this intrusion exposed. Where the ten hours actually lands Pre-authorised containment A defined signal revokes tokens, freezes pipelines and cuts egress without waiting for a decision. Removes: the human decision chain from the critical path. Costs: a false containment, sometimes. Needs a rehearsed rollback. No standing master keys Short-lived, scoped credentials, so a token harvested at hour two has expired by hour four. Removes: links from the privilege chain itself. Costs: quarters, not sprints. Breaks brittle automation first. Another detector One more classifier in front of the same alert queue, read by the same on-call rotation. Removes: some fraction of initial access attempts. Does not move the response clock. The clock is the constraint here.
Two of these shorten the interval that mattered. The third is the one most budgets will fund.

Three responses follow directly from the shape of the report, and only two of them are about the incident that happened rather than the one you would prefer to prepare for.

  • Pre-authorise containment for a named set of signals. Decide now, in daylight, which observations justify revoking every token issued to a service, freezing deployments, and cutting egress — and let the system do it without a human in the path. Containment that requires assembling a call bridge is a two-week control. Rehearse the rollback until a false containment is a twenty-minute inconvenience rather than an outage, because that rehearsal is what makes the automation politically survivable. This is the same argument as a kill switch: a stop that needs a meeting is not a stop.
  • Shorten the chain rather than watching it. Each link in the diagram exists because a credential sits somewhere permanently. Hard-coded tokens in repositories, a secrets manager holding master administrative credentials, a pipeline identity with cloud key issuance, a cloud account whose AI infrastructure keys are long-lived — none of those are agent-specific problems, and all of them are the reason ten hours was enough. Short-lived, scoped, workload-bound credentials mean a token harvested at hour two is useless at hour four. See scoped credentials.
  • Treat CI/CD as a production boundary with production controls. Triggering builds and emitting cloud keys was a mid-chain link here, and in most organisations the pipeline has more effective authority than any individual and a fraction of the monitoring. Every build that mints a credential should be attributable to a change, and unattributed builds should be one of your pre-authorised containment signals.

What does not follow is buying another content detector. There was no injected prompt and no malicious document here — this was an operator with stolen access using ordinary techniques through a very fast harness. That distinction matters for budgeting, and it is the same distinction we drew in the Aurora intrusions: the agent was the labour, not the exploit.

How this fits the year's other agent incidents

Three published cases in 2026 now share one property, and it is not a technical one. In agent CVEs the vulnerabilities resolved to authorisation decisions rather than memory-safety bugs. In GhostJacking every action the agent took was one it was permitted to take. Here, more than fifty techniques executed without a single novel exploit. In all three the security control that failed was a boundary someone had drawn generously, on the assumption that crossing it took human effort and human time.

Sysdig's JADEPUFFER, documented in July 2026 and widely described as the first confirmed agentic ransomware operation, was a single-track intrusion. What Unit 42 describes is different in kind: multiple specialised agents working in parallel across cloud, identity, CI/CD and SaaS, with a human setting objectives rather than typing commands. That is a division of labour, and division of labour is what turns a technique list into a two-week programme — or, now, into an afternoon.

FAQ

Was this attack carried out by an autonomous AI?

No. A human ransomware operator ran the intrusion and told negotiators they had used frontier models with attack-specific agentic frameworks. The agents handled tactical execution — monitoring, evaluating, acting and re-planning — while a person set the objectives. That is the important framing: the agent was the labour, not the attacker.

Does this mean AI has given attackers new capabilities?

Not in this case. The intrusion used more than fifty already-documented ATT&CK techniques and no zero-day exploit. The change is throughput: work that Unit 42 estimates would take a coordinated human red team about two weeks completed in under ten hours. New speed, old tradecraft.

Why did the attacker leave an 80-page security audit?

The attacker directed a documentation agent to produce it, and as extortion pressure it is effective. The more useful reading for defenders is what its existence demonstrates: agent-driven enumeration of an unfamiliar enterprise estate now produces a complete, technically accurate weakness inventory in hours.

Would better detection have stopped it?

Detection was not obviously the failure. Every link in the chain was an authorised use of a standing credential, so there was little for a content or signature control to fire on, and the interval between any plausible alert and irreversible impact was too short for a human escalation path. Pre-authorised containment and shorter-lived credentials address the actual constraint; another classifier does not.

What is the single most useful thing to do this week?

Time your own containment path end to end: from a defined signal to every service token revoked, deployments frozen and egress cut. If that number is larger than ten hours — and for most organisations, measured honestly, it is — you have found the gap this report is about, and you can start converting decision steps into pre-authorised ones.

Further reading

On this wiki:

Sources: