The News
AI makes hacking easier and faster, but human villains are still a large part of the process.
Over the summer, a hacker was able to deploy frontier AI models to breach a European IT and software company in less than 10 hours — something that would ordinarily take human hackers around two weeks, said Palo Alto Networks, which helped defend the firm against an extortion attempt.
There’s a lot about the incident that Palo Alto couldn’t disclose — or doesn’t even know — including the specific company that was targeted, the identity of the human hacker, and what AI models were used. But their tactics offer a step-by-step look at how an agentic attack actually works.
Concerns about the cybersecurity threat stemming from AI are increasingly urgent after tech researchers and AI frontier lab CEOs recently warned the technology could hurt society in unpredictable ways. Several have called for model development to slow down.
But “the sky is not falling,” said Andy Piazza, who leads threat research at specialized Palo Alto cybersecurity team Unit 42, and who revealed previously undisclosed details about the attack.
In this article:
Know More
The 10-hour hack started when the (human) bad guy deployed an AI agent to do reconnaissance to figure out how to breach the company. The hacker essentially launched a massive internet scan that hunted for a way into the company’s network. It ultimately found and exploited a public API endpoint, which is essentially a door that companies expose to the open internet so outside software can talk to their systems.
That’s something “AI is pretty dang good at,” Piazza said, because “devices on the internet are being scanned all of the time, and so reconnaissance is not something you can really prevent.”
Once the hacker got into the company’s system, it deployed an agent to do internal recon to figure out what systems and software were running inside the network. In this case, the company’s coding pipeline and code repositories were identified as targets.
“You get a lot when you’re scanning inside of a network,” Piazza said. “You’re effectively trusted now because you’re inside the firewall. And they get a lot more details, and they can figure out what are the interesting systems they may want to go after from there.”
Sub-agents then went through code repositories and extracted credentials like passwords and tokens that developers had left, written directly into the company’s software. Piazza said too many businesses aren’t diligent enough about locking down their logins and credentials, a practice that “stops a lot of stupid badness on the internet.”
The agents then used those stolen logins to break into the system the company uses to build and deploy its software — and from there grabbed the keys to its cloud accounts, letting the hackers run their operation through the company’s own AI tools. That’s a technique known as “living off the land,” in which hackers use the victim’s own software to do harm, making it harder to detect.
That hacking strategy could become more common since AI systems are getting more access to sensitive company data, Piazza said: “We’re starting to see [that] bad guys are getting access to that AI compute.”
The attacker — or its agents — ultimately demanded a ransom, but “this is one of those good news stories where we identified it and got them out before they were fully successful,” he said. An AI agent still left behind an 80-page, technical report detailing the company’s vulnerabilities.
J.D.’s view
When someone talks about “AI hacking,” this is really the sort of thing they’re talking about: a human directing a swarm of AI agents to help them advance their malicious cause. This wasn’t the kind of near-autonomous hack like the one in July when OpenAI agents broke out of their testing ground and hacked AI company Hugging Face. (And even in that case, the models were trying to complete a task given to them by humans.) Those remain uncommon; it turns out even ill-intentioned AI agents need a human in the loop.
“The bad-guy use of agentic attacks looks a lot like the good-guy use of AI: ‘Go do a thing, bring back some results, let me make a decision, and I’ll tell you the next steps,’” Piazza explained.
And at least for now, AI isn’t doing anything novel that a human hacker can’t also do — it just ramps up the speed and scale of well-worn techniques. That should give some solace to people worried that robots are finding new ways to get around firewalls, but it also ramps up the pressure on organizations to lock down their systems, stat.