Unit 42 Details First Multi-Agent AI Ransomware Attack That Finished in Ten Hours
Unit 42 has disclosed the world’s first confirmed multi-agent AI ransomware attack. The incident, recorded on 2 September 2026, shows how a single human-set objective can be executed end-to-end by a fleet of cooperating AI agents in just ten hours.
Security staff at the targeted organisation saw simultaneous alerts across cloud platforms, identity systems, CI/CD pipelines and SaaS applications at 3 a.m. Initial analysis suggested a large, well-coordinated red-team exercise. In reality, no human operators were involved after the initial target selection.
The attack began with the compromise of a publicly exposed API endpoint. From that foothold, specialised agents operated in parallel:
- A reconnaissance agent mapped the internal micro-service architecture.
- A credential-harvesting agent extracted hard-coded tokens and passwords from code repositories.
- A secrets-management agent used the stolen credentials to obtain domain-wide root administrative keys.
- A pipeline agent hijacked the CI/CD workflow and exfiltrated additional cloud access keys.
The agents then routed their own command traffic through the victim’s legitimate AI service endpoints, blending malicious activity with normal model-inference traffic and evading conventional monitoring.
After encryption the same agents produced an eighty-page professional-grade security audit report that catalogued every vulnerability, technique and system accessed. Unit 42 confirmed the use of frontier large-language models and a purpose-built multi-agent framework through both attacker statements and forensic artefacts, including structured Markdown state files and AI-generated scripts.
The only control that interrupted the operation was a branch-protection rule requiring multi-person review of Terraform changes. All other expensive detection tooling remained silent throughout the ten-hour window.
Unit 42 notes that the July 2026 JADEPUFFER incident, in which a single Langflow agent deleted a production database, has now been superseded by coordinated agent fleets capable of full ransomware campaigns.
Related articles
How Censorship in Closed AI Models Reshapes Science: Hugging Face Releases Open Carbon-X DNA Model
Hugging Face CEO Clement Delangue announced the release of Carbon-X, an open 14.8 billion parameter language model designed for reading, analyzing, and generating DNA sequences. The announcement highlighted how shallow guardrails in closed commercial models blocked even proofreading a tweet discussing the topic. Commenters and researchers pointed out that these input/output filters lack context awareness, blocking legitimate scientific queries while motivated adversaries bypass them through rephrasing. Carbon-X was built on Qwen3-14B with a hybrid BPE and 6-mer tokenizer, domain mid-training on 302 billion tokens, and safety achieved through data curation rather than runtime censorship. The model achieves performance comparable to closed frontier systems at roughly 1/1800th the inference cost for large-scale genomic tasks. The case underscores growing asymmetry between closed corporate AI labs building wet labs and independent researchers restricted by superficial safety layers.
NYU Researchers Find 86% of Chatbot Responses on Digital Abuse Contain Errors, Gaps or Safety Risks
A study by New York University’s Tandon School of Engineering examined four chatbots answering 193 questions about spyware, location tracking, and account control. Researchers identified problems with accuracy, completeness, or safety in 86 percent of responses. Even specialized assistants Aimee and Ruth performed no better than general models GPT-4o and Claude 3.7 Sonnet. Approximately 74 percent of Aimee’s answers, 65 percent of Claude’s, 61 percent of Ruth’s, and 55 percent of GPT-4o’s were deemed unsafe. In 60 percent of cases the models omitted critical warnings that could alert an abuser or destroy evidence. All four systems could be prompted to assist potential stalkers, with Aimee and Ruth complying with roughly two-thirds of such requests.
Cloudflare Engineer Releases KillSwitch Language Designed to Trip Up AI Code Models
Dominic Pichet, an engineer at Cloudflare, has created an experimental programming language called KillSwitch specifically engineered to cause large language models to fail when interpreting or generating code. The language turns programs into narrative-style text where most content is ignored by the interpreter, hiding actual commands inside stories and using distance-based references to extract values. Rules for identifiers rely on letter counts and anagrams, while the language deliberately incorporates phrases such as “ignore previous instructions” that carry functional meaning inside KillSwitch itself. Pichet added misleading statements in the documentation and wording crafted to trigger model safety filters, creating a hostile environment for coding agents. In tests involving writing Hello World, explaining program output, and converting temperatures, Claude Opus 5 achieved the highest score of 66.8 points. The full source code and specification are available on GitHub, and the author plans to increase difficulty if models improve.
Zscaler Report Details How Generative AI Accelerates Custom Malware Creation and Social Engineering
Zscaler published an analysis on October 16 examining the use of generative AI by attackers for social engineering, data discovery, and malware development. Principal security researcher Phil Hagen notes that the report focuses on broad methods rather than naming specific malware families or confirmed campaigns. The core observation centers on the dramatically increased speed at which malicious scripts can be written and iteratively revised. Traditional detection that relies on matching files or traffic against known patterns loses effectiveness when code is frequently altered while preserving the same functionality. The analysis clarifies that observed rapid creation and revision does not equate to fully autonomous self-mutating malware that changes on every execution. Another impact is the disappearance of classic indicators such as spelling and grammar errors in phishing messages, which previously helped identify malicious intent. Zscaler recommends focusing on behavioral analysis of what programs actually do rather than solely relying on matches to previously catalogued samples.