Fifty techniques inside ten hours works out to one about every twelve minutes [22]. Set that against the two weeks Unit 42 says a comparable human effort would have taken [3], and the calendar compresses by roughly 34 times [23]. The labour-hour ratio is much smaller, because two weeks of red team calendar is not 336 hours at the keyboard. But elapsed time is the currency detection budgets are written in: mean time to detect, shift handover, the queue an alert sits in overnight.
The attribution to AI rests on two kinds of evidence that do not carry equal weight. The attacker said so during ransom negotiation, claiming frontier models and attack-specific agentic frameworks [5], and an adversary negotiating a payment has an incentive to sound formidable. The sturdier material is what Unit 42 observed in the environment: parallel LLM calls to several frontier agents, structured Markdown files carrying state between agents and sessions, and custom scripts the team assesses with high confidence to be AI-generated because of their UI elements [6]. Unit 42 offers those artifacts, plus Python caches and paired asset folders, as indicators defenders can hunt on [12].
The most instructive moment in the case file is a failure. The agents tried to plant backdoors in Terraform configurations, and branch-protection controls stopped them [8]. That control does not detect, escalate or notify. It refuses the write at the moment of the write, so its latency is independent of how fast the requester is thinking. What the agents did succeed at, including mapping internal microservices, pulling hard-coded tokens out of code repositories and walking those tokens into the secrets management system for master administrative credentials [7], ran against controls whose response time includes a person. Unit 42 also describes overlapping persistence across SSH keys, serverless functions, container restart policies, cloud identities and CI/CD pipelines, maintained and tested in parallel [11]. The parallelism, not the individual technique, is what a human operator cannot match.
What one incident cannot establish is a rate. Forkast cites CrowdStrike's 2026 Threat Hunting Report, published on August 3, for the finding that AI agent-triggered detection leads are growing 2.5 times as fast as human-triggered ones [15], and for a campaign that issued nearly 200,000 model requests in two minutes [16], about 1,670 per second [26]. That second figure measures volume rather than autonomy; a loop can be very loud without deciding anything. The growth multiple is a rate on a base neither source gives.
The vendor response was already in flight. Okta's Agent SSO reached general availability on August 24 and Broadcom showed AgentMinder at VMware Explore on August 31 [20], both before the September 2, 2026 date Forkast gives for the attack [14], and HiddenLayer's $100 million Series B landed on that same day [19]. None of it was built in response to this case, which is reason to treat agentic-defence product claims as untested against this particular pattern.
Unit 42's own assessment is that attackers will keep adding agents to their tool sets [24], and the mechanism it identifies is narrow and credible: agents parse raw tool output and take the next step immediately, collapsing the gaps between stages [25]. The interval that decides cases like this one is between an autonomous action and a human looking at it, and here it had to be shorter than ten hours to matter [2].
