Ledger / Sep 2026
AI agents execute full ransomware intrusion in under ten hours
Confirmed
Unit 42 investigated the incident and reports the attacker told negotiators AI agents drove each step, with AI artifacts observed.
A human directed AI agents that did recon, credential theft, cloud compromise and CI/CD hijacking across 50+ ATT&CK techniques. Only secondary coverage was fetched; the original Unit 42 page was not located.
“a human criminal delegated the entire operation to AI agents, compromising an enterprise network in under ten hours”Resultsense (via The Register, reporting Unit 42)
Sources
- AI agents executed every step of this ransomware attackResultsense (via The Register, reporting Unit 42) · 3 Sep 2026 · secondary source
- Date
- Sep 2026
- Disclosed
- 2 Sep 2026
- Actor
- Unidentified extortionist (criminal), as attributed by Resultsense (via The Register, reporting Unit 42)
- Targets
- An enterprise network breached through an exposed API endpoint, then cloud, CI/CD and secrets manager
- What the AI did
- Agentic intrusion, Recon, Ops automation, Exploit dev, Data analysis
- Model
- unspecified frontier models and agentic frameworks
- Model family
- Unspecified
- Model basis
- stated by researcher
- Autonomy
- autonomous
- Outcome
- Enterprise compromise in under 10 hours (responders estimate two weeks by hand); agent produced an 80-page audit of the victim's weaknesses.