Unit 42 Details First Multi-Agent AI Ransomware Attack That Finished in Ten Hours

Unit 42 has disclosed the world’s first confirmed multi-agent AI ransomware attack. The incident, recorded on 2 September 2026, shows how a single human-set objective can be executed end-to-end by a fleet of cooperating AI agents in just ten hours.

Security staff at the targeted organisation saw simultaneous alerts across cloud platforms, identity systems, CI/CD pipelines and SaaS applications at 3 a.m. Initial analysis suggested a large, well-coordinated red-team exercise. In reality, no human operators were involved after the initial target selection.

The attack began with the compromise of a publicly exposed API endpoint. From that foothold, specialised agents operated in parallel:

• A reconnaissance agent mapped the internal micro-service architecture.
• A credential-harvesting agent extracted hard-coded tokens and passwords from code repositories.
• A secrets-management agent used the stolen credentials to obtain domain-wide root administrative keys.
• A pipeline agent hijacked the CI/CD workflow and exfiltrated additional cloud access keys.

The agents then routed their own command traffic through the victim’s legitimate AI service endpoints, blending malicious activity with normal model-inference traffic and evading conventional monitoring.

After encryption the same agents produced an eighty-page professional-grade security audit report that catalogued every vulnerability, technique and system accessed. Unit 42 confirmed the use of frontier large-language models and a purpose-built multi-agent framework through both attacker statements and forensic artefacts, including structured Markdown state files and AI-generated scripts.

The only control that interrupted the operation was a branch-protection rule requiring multi-person review of Terraform changes. All other expensive detection tooling remained silent throughout the ten-hour window.

Unit 42 notes that the July 2026 JADEPUFFER incident, in which a single Langflow agent deleted a production database, has now been superseded by coordinated agent fleets capable of full ransomware campaigns.