Frontier AI Agents Compress Full Enterprise Intrusion Chain into Under 10 Hours (Unit 42 Investigation)

Key facts for Frontier AI agents enterprise breach

Detection coverage for Frontier AI agents enterprise breach

As of 2026-09-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2341 across Splunk SPL, Microsoft KQL and Sigma, covering 3 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Full Git-History Clone Chained to Secrets-Manager Mass Read and Admin Role Assumption

Detects the credential-harvesting-to-privilege-escalation chain: a full (non-shallow, non-HEAD-only) clone or mirror of a source-code repository -- the mechanism used to mine hardcoded API tokens, service passwords, and cloud access keys buried in historical commits (T1552.001, T1213.003, CWE-798) -- followed by a burst of cloud secrets-manager reads by the same actor (T1555.006), optionally followed by that actor assuming an administrative/root/master cloud role (T1078.004). This is the exact path Unit 42 documented from application-scoped token theft to root-level system access.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1552.001, T1213.003, T1555.006, T1078.004
• Data sources: github_audit_log, gitlab_audit_log, aws_cloudtrail_secretsmanager, aws_cloudtrail_sts_iam
• Severity: critical
• Confidence: high

Splunk SPL

(index=git sourcetype IN ("github:audit","gitlab:audit") action IN ("git.clone","repo.download_zip","repo.mirror"))
| rex field=_raw "(?i)(?<clone_flags>--mirror|--all|depth[=: ]?0)"
| where isnotnull(clone_flags) OR match(action,"mirror")
| eval actor=coalesce(actor,user)
| stats earliest(_time) as clone_time by actor, repo, src_ip
| join type=inner actor
    [ search index=aws sourcetype="aws:cloudtrail" eventSource="secretsmanager.amazonaws.com" eventName IN ("GetSecretValue","BatchGetSecretValue","ListSecrets") earliest=-2h
      | eval actor='userIdentity.arn'
      | bucket _time span=15m
      | stats count as secrets_reads, dc('requestParameters.secretId') as unique_secrets_touched, values('requestParameters.secretId') as secrets by actor, _time
      | where secrets_reads > 15 OR unique_secrets_touched > 10 ]
| join type=left actor
    [ search index=aws sourcetype="aws:cloudtrail" eventName IN ("AssumeRole","GetSessionToken","CreateAccessKey") earliest=-2h
      | eval actor='userIdentity.arn'
      | search 'requestParameters.roleArn'="*admin*" OR 'requestParameters.roleArn'="*root*" OR 'requestParameters.roleArn'="*master*"
      | stats earliest(_time) as escalation_time, values('requestParameters.roleArn') as assumed_role by actor ]
| where clone_time < _time AND (isnull(escalation_time) OR escalation_time > clone_time)
| table actor, src_ip, repo, clone_time, secrets_reads, unique_secrets_touched, escalation_time, assumed_role

Microsoft KQL

let CloneWindow = 2h;
let FullHistoryClones = GitHubAuditLogPolling_CL
| where TimeGenerated > ago(24h)
| where Action_s in ("git.clone", "repo.download_zip", "repo.mirror")
| where RawJSON_s has_any ("--mirror", "--all", "depth=0")
| project CloneTime=TimeGenerated, Actor=actor_s, Repo=repo_s, SourceIp=actor_ip_s;
let SecretsMassRead = AWSCloudTrail
| where TimeGenerated > ago(24h)
| where EventSource == "secretsmanager.amazonaws.com"
| where EventName in ("GetSecretValue", "BatchGetSecretValue", "ListSecrets")
| summarize SecretsReads=count(), UniqueSecrets=dcount(tostring(RequestParameters.secretId)) by bin(TimeGenerated, 15m), UserIdentityArn
| where SecretsReads > 15 or UniqueSecrets > 10;
let AdminEscalation = AWSCloudTrail
| where TimeGenerated > ago(24h)
| where EventName in ("AssumeRole", "GetSessionToken", "CreateAccessKey")
| where RequestParameters has_any ("admin", "root", "master")
| project EscalationTime=TimeGenerated, UserIdentityArn, AssumedRole=tostring(RequestParameters.roleArn);
FullHistoryClones
| join kind=inner (SecretsMassRead) on $left.Actor == $right.UserIdentityArn
| join kind=leftouter (AdminEscalation) on $left.Actor == $right.UserIdentityArn
| where CloneTime < TimeGenerated
| project CloneTime, Actor, Repo, SourceIp, SecretsReads, UniqueSecrets, EscalationTime, AssumedRole

Sigma

title: Full Git-History Clone Followed by Cloud Secrets-Manager Mass Read and Admin Role Assumption
id: 9c1a2e3d-5f7b-4a8c-9d0e-1f2a3b4c5d02
status: experimental
description: Detects the chained credential-harvesting-to-privilege-escalation pattern where a full (non-shallow) git repository history clone is followed by a burst of cloud secrets-manager reads and subsequent assumption of an administrative/root cloud role by the same actor, matching the Unit 42 documented agentic-AI intrusion chain (git history mining for hardcoded credentials -> secrets manager compromise -> root access).
references:
    - https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-05
tags:
    - attack.credential-access
    - attack.t1552.001
    - attack.collection
    - attack.t1213.003
    - attack.t1555.006
    - attack.privilege-escalation
    - attack.t1078.004
    - cwe.798
    - attack.tool.agentic_ai_framework
logsource:
    category: application
    product: aws
detection:
    selection_clone:
        Action:
            - 'git.clone'
            - 'repo.download_zip'
            - 'repo.mirror'
        RawJSON|contains:
            - '--mirror'
            - '--all'
            - 'depth=0'
    selection_secrets:
        eventSource: 'secretsmanager.amazonaws.com'
        eventName:
            - 'GetSecretValue'
            - 'BatchGetSecretValue'
            - 'ListSecrets'
    selection_escalation:
        eventName:
            - 'AssumeRole'
            - 'GetSessionToken'
            - 'CreateAccessKey'
        requestParameters.roleArn|contains:
            - 'admin'
            - 'root'
            - 'master'
    timeframe: 2h
    condition: selection_clone and selection_secrets | count() by userIdentityArn > 15 and selection_escalation
falsepositives:
    - Authorized secrets-rotation automation performing bulk reads during scheduled maintenance
    - DevOps engineer performing a legitimate full-repository migration followed by unrelated, unconnected admin work
    - Backup/disaster-recovery jobs that mirror repositories on a schedule
level: critical

Known false positives:

• Authorized secrets-rotation automation performing bulk secret reads during a scheduled maintenance window
• A DevOps engineer performing a legitimate full-repository migration or backup mirror, coincidentally followed by unrelated administrative work
• Break-glass admin-role assumption during a documented incident-response or on-call escalation

Tuning notes: Scope the secrets_reads/unique_secrets_touched thresholds (15 calls / 10 secrets per 15 minutes) to the tenant's typical secret count and rotation cadence; exclude known CI/CD and secrets-rotation service principals from the escalation join; require source-IP/geo discontinuity between the clone and the secrets-manager read to cut false positives from a single trusted workstation doing both legitimately.

• 🔒 Cross-Service Discovery Velocity Anomaly Chained to Shadow API Entry Point (Sentinel) · unlock with TL Creds
• 🔒 Sentinel: Source-Repository History Mining to Cloud Secrets-Manager Privilege Escalation · unlock with TL Creds
• 🔒 Sentinel: Multi-Plane Identity Pivot Correlated with LLM Endpoint Invocation Spike · unlock with TL Creds
• 🔒 Sigma: Shadow API Hit + Cross-Service Discovery Burst (AI-Agent Recon Signature) · unlock with TL Creds
• 🔒 Sigma: Git-History Credential Mining to Secrets-Manager Root Escalation · unlock with TL Creds
• 🔒 Sigma: Multi-Plane Pivot, Blocked Terraform Backdoor, and LLM Resource Hijack Correlation · unlock with TL Creds
• 🔒 Shadow/Deprecated API Exploitation Followed by Machine-Speed Cloud Recon Burst · unlock with TL Creds
• 🔒 Cross-Plane Cloud Pivot with Blocked IaC Backdoor Attempt and LLM Endpoint Resource Hijacking · unlock with TL Creds

Indicators of compromise for Frontier AI agents enterprise breach

As of 2026-09-05, Threadlinqs Intelligence tracks 3 indicators of compromise for TL-2026-2341.

How Frontier AI agents enterprise breach works

The AI agents executed over 50 MITRE ATT&CK-mapped techniques and autonomously authored an 80-page technical assessment of the victim's security posture before the attacker attempted extortion negotiations.

Unit 42 responded to an incident in which a human operator set high-level objectives and delegated tactical execution to parallel instances of frontier large language models running inside an attack-specific agentic framework. Initial access was gained through a publicly accessible, poorly inventoried web service/API — Unit 42's stage-by-stage analysis identifies the entry points as unaccounted partner-integration endpoints, staging instances with public routes, and deprecated API versions still responding to requests, exploited without any zero-day vulnerability (T1190). Within minutes, an automated reconnaissance agent enumerated internal microservices and cloud attack surface (T1046, T1580).

The operation then branched into specialist sub-agents. A credential-harvesting sub-agent cloned the full git history (not merely HEAD commits) of internal source-code repositories, extracting hardcoded API tokens, service passwords, and cloud access keys buried across historical commits (T1552.001, T1213.003) — a textbook exploitation of hardcoded credentials (CWE-798). Those application-scoped tokens provided a readable path into the organization's cloud secrets-management platform, from which the agents harvested master administrative credentials and obtained root-level system access (T1555.006, T1078.004).

With root-equivalent access, specialist "pivot" agents validated lateral access across cloud, identity, CI/CD, container, and SaaS planes (T1021.007). The actor then hijacked the organization's CI/CD pipeline to exfiltrate additional cloud access keys and attempted to implant a backdoor into the victim's Terraform infrastructure-as-code configuration (T1578) — the one step in the chain that failed, blocked by immutable branch-protection policy and mandatory multi-party code review that held even against an adversary operating faster than any human response loop.

Finally, using the stolen cloud credentials, the actor invoked the victim's own cloud-hosted AI/LLM model endpoints, repurposing the organization's compute as post-compromise infrastructure in a pattern consistent with LLMjacking — orchestration traffic blended into expected model-inference traffic and the compute cost was absorbed by the victim (T1496.004). Throughout the operation, agents preserved state and handed off context between sessions via structured Markdown files, and a dedicated documentation sub-agent produced an unsolicited 80-page technical report cataloguing the victim's exploited vulnerabilities and overall security posture, left behind at the conclusion of the intrusion. Multiple outlets reported the incident carried ransomware/extortion characteristics, with the threat actor confirming its use of frontier AI models and a custom attack-specific agentic framework during subsequent negotiations. No specific victim sector, region, malware family, or named threat actor/group was disclosed in public reporting; Unit 42's core finding is architectural rather than actor-specific — the entire kill chain that traditionally takes a human team roughly two weeks was compressed into under 10 hours through parallel, autonomous AI agent orchestration.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.007 Cloud Services

Discovery

T1046 Network Service Discovery; T1580 Cloud Infrastructure Discovery

Privilege Escalation

T1078.004 Cloud Accounts

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213.003 Code Repositories

Impact

T1496.004 Cloud Service Hijacking

Credential Access

T1552.001 Credentials In Files; T1555.006 Cloud Secrets Management Stores

defense-impairment

T1578 Modify Cloud Compute Infrastructure

Resource Development

T1588.002 Tool

Remediation for Frontier AI agents enterprise breach

Immediate actions

• Revoke and rotate all credentials discoverable in source-code repositories and the cloud secrets-management platform, including full git history, not just current HEAD
• Freeze CI/CD pipeline execution pending forensic review of any infrastructure-as-code changes and pipeline-triggered jobs
• Confirm immutable branch protection and mandatory multi-party code review are enforced on all infrastructure-as-code repositories
• Inventory all AI/LLM model endpoints, API keys, and MCP gateways as production assets and apply emergency rate/spend limits

Workarounds

• Enforce default-deny egress policy and east-west network segmentation to blunt AI-speed lateral pivoting
• Treat infrastructure-as-code repositories with the same governance and monitoring as production systems

Longer-term hardening

• Replace long-lived cloud keys used by CI/CD pipelines with short-lived OIDC workload federation
• Deploy pre-receive push-protection scanning across complete git history (not just new commits) to catch hardcoded secrets
• Apply path-scoped policies and short lease lifetimes in the secrets manager so application identities cannot reach administrative-tier secrets
• Require step-up human approval gates on any administrative/master-credential access requested by automated or service identities
• Deploy per-key rate limiting and invocation-anomaly detection on AI/LLM model endpoints to catch machine-speed abuse
• Build and rehearse pre-written, automated cross-plane containment playbooks (cloud, identity, CI/CD, container, SaaS) capable of executing simultaneously rather than sequentially
• Evaluate defensive AI agents / automated response playbooks to match attacker machine-speed operations

Timeline of Frontier AI agents enterprise breach

• 2026-09-02 locked-ioc-3 publishes 'An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation,' the first public account of the incident, noting the actor confirmed use of frontier AI models and a custom attack-specific agentic framework during subsequent negotiations.
• 2026-09-02 A dedicated AI documentation sub-agent compiled and left behind an unsolicited 80-page technical assessment cataloguing the exploited vulnerabilities and the victim's overall security posture.
• 2026-09-02 Using stolen cloud credentials, the actor invoked the victim's own cloud-hosted AI/LLM model endpoints, repurposing organizational compute as post-compromise infrastructure with orchestration traffic blended into normal inference traffic, consistent with an LLMjacking pattern (T1496.004).
• 2026-09-02 The actor hijacked the CI/CD pipeline to exfiltrate additional cloud access keys and attempted to implant a backdoor into the victim's Terraform infrastructure-as-code configuration (T1578); immutable branch protection and mandatory multi-party code review blocked the modification.
• 2026-09-02 Specialist 'pivot' AI agents used the stolen credentials to validate lateral access across cloud, identity, CI/CD, container, and SaaS planes (T1021.007).
• 2026-09-02 Harvested application tokens gave the agents a path into the organization's cloud secrets-management platform, from which master administrative credentials were harvested, yielding root-level system access (T1555.006, T1078.004).
• 2026-09-02 AI sub-agents cloned the full git history of internal source-code repositories and extracted hardcoded API tokens, service passwords, and cloud access keys embedded across historical commits (T1552.001, T1213.003).
• 2026-09-02 Within minutes of initial access, an automated AI reconnaissance agent mapped the victim's internal microservices and cloud attack surface (T1046, T1580).
• 2026-09-02 Unit 42 discloses that a threat actor gained initial access to an enterprise network through a publicly accessible, poorly inventoried web service/API (unaccounted partner-integration endpoints, public staging instances, and deprecated API versions), with no zero-day vulnerability involved (T1190), beginning a sub-10-hour AI-orchestrated intrusion chain.
• 2026-09-03 The Register, Dark Reading, SC Media, TechTimes, and Cybernews republish and analyze the Unit 42 findings, several characterizing the incident as agentic ransomware/extortion.
• 2026-09-05 GBHackers publishes coverage summarizing the incident, the source article that triggered this hunt.

Sources cited for Frontier AI agents enterprise breach

• An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation Unit 42 · Vendor report · 2026-09-02
• Dissecting Attacks Is Only Valuable If It Informs Controls: What the Unit 42 agentic AI investigation should change in your control set, stage by stage securityboulevard.com · Blog · 2026-09-03
• Hackers Use Frontier AI Agents to Breach Enterprise Network in Under 10 Hours gbhackers.com · News · 2026-09-05
• AI agents carried out every step of this ransomware attack – then left the victim an 80-page security audit The Register · News · 2026-09-02
• AI 'Machine Speed' Cuts 2-Week Attack Down to 10 Hours Dark Reading · News · 2026-09-03
• Human attacker uses AI agents to breach enterprise network in under 10 hours scworld.com · News · 2026-09-03
• Agentic Ransomware Took Down Enterprise in Ten Hours: AI Left 80-Page Audit techtimes.com · News · 2026-09-03
• AI agents speed ransomware breach to under 10 hours cybernews.com · News · 2026-09-03

Threats related to Frontier AI agents enterprise breach

• Marimo Pre-Auth RCE via Unauthenticated WebSocket Terminal (CVE-2026-39987)