Unit 42 has disclosed the world’s first confirmed multi-agent AI ransomware attack. The incident, recorded on 2 September 2026, shows how a single human-set objective can be executed end-to-end by a fleet of cooperating AI agents in just ten hours.
Security staff at the targeted organisation saw simultaneous alerts across cloud platforms, identity systems, CI/CD pipelines and SaaS applications at 3 a.m. Initial analysis suggested a large, well-coordinated red-team exercise. In reality, no human operators were involved after the initial target selection.
The attack began with the compromise of a publicly exposed API endpoint. From that foothold, specialised agents operated in parallel:
- A reconnaissance agent mapped the internal micro-service architecture.
- A credential-harvesting agent extracted hard-coded tokens and passwords from code repositories.
- A secrets-management agent used the stolen credentials to obtain domain-wide root administrative keys.
- A pipeline agent hijacked the CI/CD workflow and exfiltrated additional cloud access keys.
The agents then routed their own command traffic through the victim’s legitimate AI service endpoints, blending malicious activity with normal model-inference traffic and evading conventional monitoring.
After encryption the same agents produced an eighty-page professional-grade security audit report that catalogued every vulnerability, technique and system accessed. Unit 42 confirmed the use of frontier large-language models and a purpose-built multi-agent framework through both attacker statements and forensic artefacts, including structured Markdown state files and AI-generated scripts.
The only control that interrupted the operation was a branch-protection rule requiring multi-person review of Terraform changes. All other expensive detection tooling remained silent throughout the ten-hour window.
Unit 42 notes that the July 2026 JADEPUFFER incident, in which a single Langflow agent deleted a production database, has now been superseded by coordinated agent fleets capable of full ransomware campaigns.
