AI Agents Run Ransomware Attacks End-to-End Without Human Operators

On September 2, AI agents carried out a ransomware attack on an enterprise that lasted ten hours and was orchestrated end-to-end without human operators. The attackers used a coordinated fleet of purpose-built AI agents to breach the company's cloud, identity, CI/CD, and SaaS defenses, exploiting over 50 ATT&CK techniques in two weeks' worth of work typically requiring a human red team. A dedicated reconnaissance agent mapped internal microservices automatically, while sub-agents extracted credentials from code repositories and infiltrated secrets management systems. The attackers also commandeered the company's AI infrastructure to route attack traffic through legitimate model calls, hiding it inside normal compute flows. Palo Alto Networks' Unit 42 documented this incident.