The News
AI makes hacking easier and faster, but human villains are still a large part of the process.
asserted
villains → make → process
Over the summer, a hacker was able to deploy frontier AI models to breach a European IT and software company in less than 10 hours — something that would ordinarily take human hackers around two weeks, said Palo Alto Networks, which helped defend the firm against an extortion attempt.
asserted
which → deploy → attempt
There’s a lot about the incident that Palo Alto couldn’t disclose — or doesn’t even know — including the specific company that was targeted, the identity of the human hacker, and what AI models were used.
asserted
models → ’ → hacker
But their tactics offer a step-by-step look at how an agentic attack actually works.
asserted
attack → offer → look
Concerns about the cybersecurity threat stemming from AI are increasingly urgent after tech researchers and AI frontier lab CEOs recently warned the technology could hurt society in unpredictable ways.
uncertain
technology → stem → ways
Several have called for model development to slow down.
asserted
development → call → ?
But “the sky is not falling,” said Andy Piazza, who leads threat research at specialized Palo Alto cybersecurity team Unit 42, and who revealed previously undisclosed details about the attack.
asserted
who → fall → attack
The 10-hour hack started when the (human) bad guy deployed an AI agent to do reconnaissance to figure out how to breach the company.
asserted
guy → start → company
The hacker essentially launched a massive internet scan that hunted for a way into the company’s network.
asserted
that → launch → network
It ultimately found and exploited a public API endpoint, which is essentially a door that companies expose to the open internet so outside software can talk to their systems.
asserted
software → find → systems
That’s something “AI is pretty dang good at,” Piazza said, because “devices on the internet are being scanned all of the time, and so reconnaissance is not something you can really prevent.”
asserted
you → ’ → time
Once the hacker got into the company’s system, it deployed an agent to do internal recon to figure out what systems and software were running inside the network.
asserted
systems → get → network
In this case, the company’s coding pipeline and code repositories were identified as targets.
asserted
pipeline → cod → targets
“You get a lot when you’re scanning inside of a network,” Piazza said.
asserted
Piazza → get → network
“You’re effectively trusted now because you’re inside the firewall.
asserted
you → trust → firewall
And they get a lot more details, and they can figure out what are the interesting systems they may want to go after from there.”
uncertain
they → get → details
Sub-agents then went through code repositories and extracted credentials like passwords and tokens that developers had left, written directly into the company’s software.
asserted
developers → go → software
Piazza said too many businesses aren’t diligent enough about locking down their logins and credentials, a practice that “stops a lot of stupid badness on the internet.”
asserted
that → say → internet
The agents then used those stolen logins to break into the system the company uses to build and deploy its software — and from there grabbed the keys to its cloud accounts, letting the hackers run their operation through the company’s own AI tools.
asserted
hackers → use → tools
That’s a technique known as “living off the land,” in which hackers use the victim’s own software to do harm, making it harder to detect.
asserted
it → ’ → harm
That hacking strategy could become more common since AI systems are getting more access to sensitive company data, Piazza said: “We’re starting to see [that] bad guys are getting access to that AI compute.”
uncertain
guys → become → compute
The attacker — or its agents — ultimately demanded a ransom, but “this is one of those good news stories where we identified it and got them out before they were fully successful,” he said.
asserted
he → demand → them
An AI agent still left behind an 80-page, technical report detailing the company’s vulnerabilities.
asserted
agent → leave → vulnerabilities
When someone talks about “AI hacking,” this is really the sort of thing they’re talking about: a human directing a swarm of AI agents to help them advance their malicious cause.
asserted
them → talk → cause
This wasn’t the kind of near-autonomous hack like the one in July when OpenAI agents broke out of their testing ground and hacked AI company Hugging Face.
asserted
agents → break → Face
(And even in that case, the models were trying to complete a task given to them by humans.)
asserted
models → try → humans
Those remain uncommon; it turns out even ill-intentioned AI agents need a human in the loop.
asserted
agents → remain → loop
“The bad-guy use of agentic attacks looks a lot like the good-guy use of AI: ‘Go do a thing, bring back some results, let me make a decision, and I’ll tell you the next steps,’” Piazza explained.
asserted
Piazza → look → steps
And at least for now, AI isn’t doing anything novel that a human hacker can’t also do — it just ramps up the speed and scale of well-worn techniques.
asserted
it → do → techniques
That should give some solace to people worried that robots are finding new ways to get around firewalls, but it also ramps up the pressure on organizations to lock down their systems, stat.
asserted
it → give → systems
The Aporia
