Dissecting Attacks Is Only Valuable If It Informs Controls: What the Unit 42 agentic AI investigation should change in your control set, stage by stage.

The volume of published incident research involving agentic AI is increasing, and the analysis that follows each report tends to concentrate on the same attribute: speed. The recent investigation from Unit 42, the threat intelligence and incident response group at Palo Alto Networks, is a representative case. A human operator delegated tactical execution to frontier AI agents, compressing what would normally take two weeks of methodical intrusion work into under ten hours across more than fifty MITRE ATT&CK techniques. There was no zero-day and no unusual tradecraft. Sub-agents combed repositories in parallel, structured Markdown files carried state between sessions, and the attacker directed the agents to leave behind an eighty-page audit of the victim’s security posture.

The operational detail is worth reading. The problem is what happens next. Reports like this are consumed as narrative, discussed for a week, and closed without anyone changing a configuration. A threat writeup that doesn’t end in a control decision hasn’t done any real defensive work, regardless of how well researched it is.

One sentence in the Unit 42 report does end in a control decision, and it’s easy to overlook. During the pipeline stage, the attacker attempted to plant backdoors in Terraform configurations and failed, because branch protection was immutable and code review was mandatory and multi-party. That control was configured well before anyone anticipated this attack, and it held against an adversary operating faster than any human response loop could match. It didn’t require foresight about agentic AI. It required a decision that infrastructure-as-code repositories receive the same governance as production.

The short version

• The intrusion used no novel techniques. Every stage maps to a control that has appeared in hardening guidance for years.
• Exactly one control stopped the adversary: immutable branch protection with mandatory multi-party review.
• The escalation path ran through hard-coded repository secrets into an over-scoped secrets manager. That’s a credential management failure, not an application security failure.
• The victim’s own AI endpoints were hijacked with stolen cloud keys, because model endpoints weren’t inventoried, rate-limited, or bound to workload identity.
• A ten-hour intrusion defeats sequential human response. Detection without automated containment produces forensics, not defense.

How to turn incident research into control decisions

The useful exercise is mechanical. Take the technique mapping the researchers publish and add one column: for each stage, name the control that would have terminated the chain there. Not detected it, terminated it.

Two patterns emerge consistently. Most stages have an answer that’s appeared in hardening guidance for a decade, which reframes the incident from novel adversary capability to accumulated control debt. A smaller number of stages have no good answer available in the current control set, and those are the ones that belong in a roadmap, rather than a summary.

Applied to the five stages Unit 42 mapped, the result looks like this.

Stage	Technique	Control that breaks the chain	Security control category
Initial access and internal recon	T1190, T1046 / AML.T0002	Authoritative inventory of exposed services and APIs, enforcement with virtual patching, default-deny egress, east-west segmentation	API attack surface management and WAAP enforcement
Secrets harvesting from repositories	T1552.001 / AML.T0014	Push protection with full git-history scanning, runtime-issued short-lived credentials, per-team repository scoping	Secret scanning and credential lifecycle management
Privilege takeover via secrets manager	T1555 / AML.T0016	Path-scoped policies with no route from application identity to administrative secrets, master credentials held outside the programmatic store, step-up approval	Secrets management policy scoping and privileged access management
CI/CD abuse and IaC modification	T1578 / AML.T0010	Immutable branch protection with multi-party review, OIDC workload federation replacing long-lived cloud keys in pipelines	CI/CD and software supply chain hardening
Hijacking victim AI endpoints	T1078 / AML.T0043	Inventory of model endpoints, keys and MCP gateways, credentials bound to workload identity and network context, rate and spend limits, invocation anomaly detection	AI endpoint governance and runtime enforcement

Five control categories, and in most organizations they belong to four different teams: API and infrastructure security, source control and secrets hygiene, identity and privileged access, and the DevOps platform group. AI endpoint governance is typically the fifth, and it’s usually either newly formed or unassigned. That distribution helps to explain why these reports rarely change anything. No single team reads one and recognizes its own backlog, so the analysis diffuses across organizational boundaries and stops.

Stage 1: Exposure precedes exploitation

The attacker breached a publicly accessible web service, tunneled into the network, and deployed an automated agent to map internal microservices. The common interpretation is that this represents a patching failure.

In most environments it doesn’t. The service exploited in incidents of this type is rarely the one tracked on a vulnerability dashboard. It’s more often an endpoint stood up for a partner integration, a staging instance that acquired a public route, or an API version documented as deprecated that still returns responses. Patching can’t be applied to inventory that doesn’t exist, and the agentic dimension worsens this relationship. Enumeration was historically the slow, noisy phase of an intrusion. When an agent maps a microservice topology in minutes, every unaccounted endpoint becomes operationally live rather than theoretically exposed.

API discovery and enforcement are directly relevant at this stage, and it’s where Wallarm’s Infrastructure Discovery and API Security components apply. Discovery establishes what’s actually reachable, including shadow and zombie APIs that never appeared in an architecture document. Enforcement blocks the exploitation attempt and allows a vulnerable service to be virtually patched without waiting on a deployment cycle from a team with different quarterly priorities. Neither capability is novel. Both were absent in this environment.

Stages 2 and 3: The escalation path was a secrets management problem

Stages two and three are where the intrusion converted a foothold into control, and neither is an API security problem. Accuracy matters more here than product positioning.

Hard-coded tokens in source repositories are addressed through push protection at the pre-receive layer, scanning across full git history rather than current commits, and replacing static credentials with short-lived ones issued at runtime. Scanning HEAD alone provides limited assurance when the adversary clones history, which an automated agent does by default.

An application token with a readable path to master administrative credentials is a policy scoping failure in the secrets manager. The controls are path isolation, short lease lifetimes, and step-up human approval on administrative tiers. The last of these carries disproportionate weight against an autonomous adversary. An agent can’t satisfy an approval gate on its own, so it must either stop or involve a human, and both outcomes return time to the defender.

These two hops are what produced root access and cloud keys. Organizations reading this incident should route that finding to whoever owns vault policy, rather than to their API security program.

A narrower claim is available at this layer and is worth stating precisely. Secrets managers and CI/CD systems are themselves API-driven, and the behavior that separates an agent from an engineer at those control planes is breadth of access. An engineer reads a small number of secrets in a session. An agent sweeps hundreds, and that pattern is volumetrically distinct. Where API security coverage extends to internal control-plane traffic rather than terminating at the perimeter, that anomaly is observable. Whether it’s observable in a given environment depends on deployment coverage, which is a genuine constraint rather than a footnote.

Stage 5: AI infrastructure is production infrastructure that isn’t governed as such

The final stage should reorder priorities for most organizations. Using stolen cloud keys, the attacker invoked the victim’s own AI endpoints, using that infrastructure to support subsequent operations. Orchestration traffic blended into expected model traffic, and the compute cost was absorbed by the victim.

Every property that made this viable is a governance gap rather than a vulnerability. The model endpoints weren’t inventoried as production assets. The credentials weren’t bound to workload identity or network context, so they functioned from any origin. No per-key rate or spend limits existed, so volume triggered nothing. Invocation from an unfamiliar identity produced no alert, because no baseline for normal invocation had been established.

This is the gap Wallarm’s AI Hypervisor is built to close, and it’s also where the market is furthest behind its own exposure. Organizations have spent two years deploying model endpoints, MCP gateways, and agent integrations at a pace that has outrun the inventory and least-privilege discipline applied to conventional systems. The result is a category of infrastructure that’s costly, highly privileged, adjacent to sensitive data, and largely ungoverned. Adversaries have recognized that condition ahead of many defenders.

Why a ten-hour intrusion defeats human response

A caution applies to the detective half of any control set derived from this incident. An intrusion that completes in ten hours defeats sequential human response by construction. Behavioral alerting that lands in a queue with a multi-hour triage target produces useful forensics and no containment.

The report notes that the attacker established overlapping persistence across SSH keys, serverless functions, container restart policies, cloud identities, and CI/CD pipelines, maintaining and testing that portfolio in parallel. Against redundant persistence, partial containment is functionally equivalent to no containment. Revoking credentials while pipelines remain warm and cloud identities remain active signals which access path was discovered and leaves the others available. Containment has to execute simultaneously across every plane, which means it has to be automated, which means the work occurs in playbooks written before an incident rather than during one.

Practical takeaway

For each of the five stages above, name the control, name the team accountable for it, and record whether it’s currently enforced. The exercise takes under an hour and produces something incident research can’t supply on its own: a defensible investment sequence ordered by where a specific environment actually breaks.

Two important conclusions are likely to hold across most organizations. Exposure management and AI infrastructure governance are the stages where control coverage is thinnest today, and response automation is the capability that determines whether any detection investment produces containment or documentation. The remainder of the report is anatomy. Anatomy is worth studying, but it isn’t a control decision, and only control decisions change outcomes.

Frequently asked questions

What is an AI-assisted cyber attack?

An AI-assisted or agentic cyber attack is an intrusion in which a human operator sets objectives and delegates tactical execution to AI agents, which perform reconnaissance, credential harvesting, and lateral movement with limited supervision. In the Unit 42 case, agents operated in parallel and passed state between sessions through structured files, compressing roughly two weeks of manual work into under ten hours.

Did the attacker use techniques that existing security controls can’t address?

No. The intrusion used more than fifty documented MITRE ATT&CK techniques and no zero-day exploits. Every stage maps to a control that already exists in standard hardening guidance. What changed is tempo, which affects response design rather than the choice of preventive control.

Which security controls are most effective against agentic intrusions?

Controls that terminate a chain without human involvement are the most effective, because an autonomous adversary outpaces manual response. In this incident those were immutable branch protection with multi-party review, path-scoped secrets manager policies, credentials bound to workload identity, and enforcement at the API layer with accurate inventory behind it. Step-up approval gates are disproportionately valuable, since an agent can’t satisfy them without involving a human and losing its speed advantage.

What is MITRE ATLAS and how does it relate to ATT&CK?

MITRE ATLAS is a knowledge base of adversary tactics and techniques targeting AI-enabled systems, structured in the same format as MITRE ATT&CK. Incidents involving AI infrastructure are typically mapped to both, with ATT&CK covering conventional enterprise techniques and ATLAS covering AI-specific behaviors such as automated reconnaissance and model invocation with stolen credentials.