An AI-assisted cyber attack

I co-authored a report on the Unit 42 blog: An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation. It describes an incident response investigation in which an attacker used AI agents to help compromise a cloud environment in less than ten hours.

The attacker harvested credentials from code repositories and a secrets manager, abused CI/CD workflows to steal cloud keys, and used the victim’s own AI services to support the intrusion. The report follows the attack from initial access through persistence and shows how AI agents helped the attacker explore the environment and adapt their tooling.

This investigation gave me a glimpse of what attacks against smaller companies could look like as these capabilities become more accessible. As I put it on Twitter:

This investigation showed me what the future looks like: nation-state-level attacks targeting even SMEs, executed at god-mode speed. The future will be… interesting!